T1036 IBM QRadar · QRadar

Detect Masquerading in IBM QRadar

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.

MITRE ATT&CK

Tactic
Defense Evasion
Technique
T1036 Masquerading
Canonical reference
https://attack.mitre.org/techniques/T1036/

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip,
       username,
       "Process Name" AS process_name,
       "Process Path" AS process_path,
       "Parent Process Name" AS parent_process,
       "Command" AS command_line,
       LOGSOURCENAME(logsourceid) AS log_source,
       hostname
FROM events
WHERE LOGSOURCETYPEID = 12 /* Microsoft Windows Security Event Log */
  AND QIDNAME(qid) LIKE '%Process%'
  AND ("Process Name" ILIKE 'svchost.exe'
    OR "Process Name" ILIKE 'csrss.exe'
    OR "Process Name" ILIKE 'lsass.exe'
    OR "Process Name" ILIKE 'services.exe'
    OR "Process Name" ILIKE 'smss.exe'
    OR "Process Name" ILIKE 'wininit.exe'
    OR "Process Name" ILIKE 'winlogon.exe'
    OR "Process Name" ILIKE 'explorer.exe'
    OR "Process Name" ILIKE 'spoolsv.exe'
    OR "Process Name" ILIKE 'taskhost.exe'
    OR "Process Name" ILIKE 'taskhostw.exe'
    OR "Process Name" ILIKE 'conhost.exe'
    OR "Process Name" ILIKE 'dllhost.exe'
    OR "Process Name" ILIKE 'RuntimeBroker.exe')
  AND "Process Path" NOT ILIKE 'C:\Windows\System32\%'
  AND "Process Path" NOT ILIKE 'C:\Windows\SysWOW64\%'
  AND "Process Path" NOT ILIKE 'C:\Windows\explorer.exe'
  AND "Process Path" NOT ILIKE 'C:\Windows\winsxs\%'
LAST 24 HOURS
high severity medium confidence

Detects Windows system binaries executing outside their expected directories using QRadar normalized process event fields, indicating potential masquerading via binary relocation.

Data Sources

Microsoft Windows Security Event Log (DSM)Sysmon via Universal DSM

Required Tables

events

False Positives & Tuning

  • Application packaging tools that extract and execute system utilities from temp directories as part of installation routines
  • Backup and recovery software that may stage system processes in alternate locations during bare-metal restore operations
  • Sandboxed application containers or browser-based isolation technologies that redirect system binary paths
Download portable Sigma rule (.yml)

Other platforms for T1036

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Masquerade as svchost.exe from Temp Directory

    Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\svchost.exe, OriginalFileName=Cmd.Exe. Security Event ID 4688 with NewProcessName containing svchost.exe in a temp directory. Sysmon Event ID 11: FileCreate for svchost.exe in temp.

  2. Test 2Masquerade as lsass.exe from User Profile

    Expected signal: Sysmon Event ID 1: Process Create with Image=%APPDATA%\lsass.exe, OriginalFileName=NOTEPAD.EXE. The OriginalFileName mismatch is a key indicator.

  3. Test 3Masquerade as explorer.exe from Downloads

    Expected signal: Sysmon Event ID 1: Process Create with Image in Downloads folder, OriginalFileName mismatch. File creation event for explorer.exe in Downloads.

Last updated: 2026-04-16 Research depth: deep
References (7)

Unlock Pro Content

Get the full detection package for T1036 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Sub-techniques (12)

Related Techniques

T1036.001Invalid Code SignatureT1036.003Rename Legitimate UtilitiesT1036.005Match Legitimate Resource Name or LocationT1036.007Double File ExtensionT1036.008Masquerade File TypeT1574.001DLLT1218.011Rundll32T1027Obfuscated Files or Information

Same Tactic: Defense Evasion

Popular Detections