T1036.005Stealth
Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
24 Sigma rules tagged T1036.005Match Legitimate Resource Name or LocationT1036.00524 general rules
- Exploit for CVE-2015-1641criticalstable
- Greenbug Espionage Group Indicatorscriticaltest
- RedSun - TieringEngineService.exe Detected as EICAR Test Filecriticalexperimental
- RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dircriticalexperimental
- Flash Player Update from Suspicious Locationhightest
- Lazarus System Binary Masqueradinghightest
- Potential MsiExec Masqueradinghightest
- Small Sieve Malware File Indicator Creationhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Match Legitimate Resource Name or Location
1 CVE, by priority. Each link shows its badge.- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority