T1036.005 Match Legitimate Resource Name or Location

T1036.005 Match Legitimate Resource Name or Location

Sub-technique of: T1036

High-Level Description

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Containers, ESXi, Linux, macOS, Windows

What to Check

• Identify if Match Legitimate Resource Name or Location technique is applicable to target environment
• Check Containers systems for indicators of Match Legitimate Resource Name or Location
• Check ESXi systems for indicators of Match Legitimate Resource Name or Location
• Check Linux systems for indicators of Match Legitimate Resource Name or Location
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Execute a process from a directory masquerading as the current parent directory

Create and execute a process from a directory masquerading as the current parent directory (... instead of normal ..)

Supported Platforms: macos, linux

mkdir $HOME/...
cp $(which sh) $HOME/...