Detect Masquerading in CrowdStrike LogScale
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Canonical reference
- https://attack.mitre.org/techniques/T1036/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(svchost|csrss|lsass|services|smss|wininit|winlogon|explorer|spoolsv|taskhost|taskhostw|conhost|dllhost|RuntimeBroker)\.exe$/
| ImageFileName != /(?i)^\\Device\\HarddiskVolume[0-9]+\\Windows\\System32\\/
| ImageFileName != /(?i)^\\Device\\HarddiskVolume[0-9]+\\Windows\\SysWOW64\\/
| ImageFileName != /(?i)^\\Device\\HarddiskVolume[0-9]+\\Windows\\WinSxS\\/
| ImageFileName != /(?i)^\\Device\\HarddiskVolume[0-9]+\\Windows\\explorer\.exe$/
| regex(field=ImageFileName, regex="(?i)(?P<binary_name>[^\\\\]+)$")
| table([@timestamp, ComputerName, UserName, ImageFileName, binary_name, CommandLine, ParentImageFileName, ParentCommandLine, TargetProcessId, ContextProcessId])
| sort(field=@timestamp, order=desc)Detects masqueraded Windows system binaries in CrowdStrike Falcon telemetry by matching process image names against known system binary list and excluding legitimate device paths under Windows system directories.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor self-tests or prevention policy simulations that launch processes from non-standard paths to validate detection coverage
- Windows installer packages that temporarily extract and execute system binaries from %TEMP% directories during in-place upgrade sequences
- Antivirus or DLP quarantine processes that relocate suspect files including binaries matching system name patterns before remediation
Other platforms for T1036
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Masquerade as svchost.exe from Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\svchost.exe, OriginalFileName=Cmd.Exe. Security Event ID 4688 with NewProcessName containing svchost.exe in a temp directory. Sysmon Event ID 11: FileCreate for svchost.exe in temp.
- Test 2Masquerade as lsass.exe from User Profile
Expected signal: Sysmon Event ID 1: Process Create with Image=%APPDATA%\lsass.exe, OriginalFileName=NOTEPAD.EXE. The OriginalFileName mismatch is a key indicator.
- Test 3Masquerade as explorer.exe from Downloads
Expected signal: Sysmon Event ID 1: Process Create with Image in Downloads folder, OriginalFileName mismatch. File creation event for explorer.exe in Downloads.
References (7)
- https://attack.mitre.org/techniques/T1036/
- https://www.elastic.co/blog/how-hunt-masquerade-ball
- https://lolbas-project.github.io/
- https://x.com/ItsReallyNick/status/1055321652777619457
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1036 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1036.001Invalid Code Signature
- T1036.002Right-to-Left Override
- T1036.003Rename Legitimate Utilities
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1036.006Space after Filename
- T1036.007Double File Extension
- T1036.008Masquerade File Type
- T1036.009Break Process Trees
- T1036.010Masquerade Account Name
- T1036.011Overwrite Process Arguments
- T1036.012Browser Fingerprint