Skip to content
Sign In
Learn

T1036.005

Match Legitimate Resource Name or Location

What it is

Attackers give their programs the same name as a familiar Windows or Linux program, or place them in a folder that looks like a system folder, so that a quick look at a process list or a file listing passes them over. It is a sub-technique of Masquerading. The disguise works on people more than on tools: the name is right, but the location or the details around it are not.

How adversaries use it

The attacker copies their program to disk under the name of a built-in system program, often in a user-writable folder, a look-alike folder or a removable drive rather than the system folder where the real one lives. Scheduled jobs and services then start it, and anyone glancing at running processes sees a name they expect.

Detect it in Elastic

Data source: Windows and Linux process creation events

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) when a process starts process.name: the program's file name, which is what the disguise copies process.executable: the full path, which is where the disguise usually fails process.parent.name: what started it, which is often unusual for that name user.name: the account it ran as host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-529.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "conhost.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "executable": "E:\\Depot\\conhost.exe"
  },
  "@timestamp": "2026-06-16T13:12:09.648Z"
}

Prebuilt Elastic rule: Potential Masquerading as Svchost

Hunt guidance

The name alone proves nothing; compare it with where the program ran from. Start with a list of system program names your hosts run, and look for any of them starting from outside the system folders: process.name: "conhost.exe" and not process.executable: C\:\\Windows\\System32\\*, repeated for each name on your list. Look for system names in user-writable or removable locations, system names started by a script host or an unusual parent, and names that differ from the real one by a single letter. The prebuilt rule named on this page checks only svchost.exe and names one letter away from it, so for every other system name on your list this hunt is the detection.

Ruling out legitimate activity

Some legitimate software ships helpers with names that match system programs, and 32-bit copies of system programs live in a second system folder. Check the file's signer and version information where your data has it, and whether the path belongs to installed software. A system name in a temporary or user folder, started by a script, is rarely legitimate.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.