T1036.005
Masquerading: Match Legitimate Name or Location
Description from ATT&CK
Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
Adversaries may also use the same icon of the file they are trying to mimic.
Atomic Tests
Atomic Test #1 - Execute a process from a directory masquerading as the current parent directory.
Create and execute a process from a directory masquerading as the current parent directory (
instead of normal 1
...
)1
..
Supported Platforms: macos,linux
auto_generated_guid: 812c3ab8-94b0-4698-a9bf-9420af23ce24
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
test_message | Test message to echo out to the screen | string | Hello from the Atomic Red Team test T1036.005#1 |
Attack Commands: Run with sh!
1
2
3
4
mkdir $HOME/...
cp $(which sh) $HOME/...
$HOME/.../sh -c "echo #{test_message}"
Cleanup Commands:
1
2
3
rm -f $HOME/.../sh
rmdir $HOME/.../
Atomic Test #2 - Masquerade as a built-in system executable
Launch an executable that attempts to masquerade as a legitimate executable.
Supported Platforms: windows
auto_generated_guid: 35eb8d16-9820-4423-a2a1-90c4f5edd9ca
Inputs:
Name | Description | Type | Default Value |
---|---|---|---|
executable_filepath | File path where the generated executable will be dropped and executed from. The filename should be the name of a built-in system utility. | string | $Env:windir\Temp\svchost.exe |
Attack Commands: Run with powershell!
1
2
3
4
5
6
7
8
9
10
Add-Type -TypeDefinition @'
public class Test {
public static void Main(string[] args) {
System.Console.WriteLine("tweet, tweet");
}
}
'@ -OutputAssembly "#{executable_filepath}"
Start-Process -FilePath "#{executable_filepath}"
Cleanup Commands:
1
2
Remove-Item -Path "#{executable_filepath}" -ErrorAction Ignore