MITRE ATT&CKsub-technique

T1036.005 Match Legitimate Resource Name or Location

Published 2020-02-10 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Containers, ESXi, Linux, macOS, Windows
Version
3.0
Created
2020-02-10

Description

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1036 Masquerading technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1038 Execution Prevention mitigation
  • M1045 Code Signing mitigation
  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (226)

  • G1059 NIMBUS MANTICORE group
  • S9065 DCSYNCER.SLICK software (malware)
  • G1058 The Gentlemen group
  • S9050 Vidar software (malware)
  • G1057 ShinyHunters group
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • S9037 RustyWater software (malware)
  • G1055 VOID MANTICORE group
  • S9030 SameCoin software (malware)
  • S9031 AshTag software (malware)
  • S9033 Fooder software (malware)
  • S9034 Tsundere Botnet software (malware)
  • C0061 Operation Digital Eye campaign
  • S9015 BRICKSTORM software (malware)
  • S9019 PureCrypter software (malware)
  • S9008 Shai-Hulud software (malware)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1236 CLAIMLOADER software (malware)
  • S1237 CANONSTAGER software (malware)
  • S1238 STATICPLUGIN software (malware)
  • S1228 PUBLOAD software (malware)
  • C0056 RedPenguin campaign
Show all 226 ›

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-543 Counterfeit Websites attack pattern
  • CAPEC-616 Establish Rogue Location attack pattern

Referenced by Compliance · mitigates (12)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References