Detect Masquerading in Microsoft Sentinel
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Canonical reference
- https://attack.mitre.org/techniques/T1036/
KQL Detection Query
let KnownSystemBinaries = dynamic(["svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "wininit.exe", "winlogon.exe", "explorer.exe", "spoolsv.exe", "taskhost.exe", "taskhostw.exe", "conhost.exe", "dllhost.exe", "RuntimeBroker.exe"]);
let TrustedPaths = dynamic(["C:\\Windows\\System32\\", "C:\\Windows\\SysWOW64\\", "C:\\Windows\\"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (KnownSystemBinaries)
| where not(FolderPath has_any (TrustedPaths))
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine,
ProcessId, InitiatingProcessId
| sort by Timestamp descDetects processes with names matching known Windows system binaries (svchost.exe, csrss.exe, lsass.exe, etc.) executing from non-standard locations outside System32/SysWOW64. This is a broad parent-level detection that catches various masquerading techniques where adversaries name their malware after legitimate system processes but run them from user-writable directories.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate software installers that temporarily extract executables with system-like names to temp directories
- Windows Subsystem for Linux (WSL) and virtualization software that may run processes with similar names
- Software testing and development environments where binaries are compiled with system-like names
- Some third-party security tools that use helper processes named after system binaries
Other platforms for T1036
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Masquerade as svchost.exe from Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\svchost.exe, OriginalFileName=Cmd.Exe. Security Event ID 4688 with NewProcessName containing svchost.exe in a temp directory. Sysmon Event ID 11: FileCreate for svchost.exe in temp.
- Test 2Masquerade as lsass.exe from User Profile
Expected signal: Sysmon Event ID 1: Process Create with Image=%APPDATA%\lsass.exe, OriginalFileName=NOTEPAD.EXE. The OriginalFileName mismatch is a key indicator.
- Test 3Masquerade as explorer.exe from Downloads
Expected signal: Sysmon Event ID 1: Process Create with Image in Downloads folder, OriginalFileName mismatch. File creation event for explorer.exe in Downloads.
References (7)
- https://attack.mitre.org/techniques/T1036/
- https://www.elastic.co/blog/how-hunt-masquerade-ball
- https://lolbas-project.github.io/
- https://x.com/ItsReallyNick/status/1055321652777619457
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1036 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1036.001Invalid Code Signature
- T1036.002Right-to-Left Override
- T1036.003Rename Legitimate Utilities
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1036.006Space after Filename
- T1036.007Double File Extension
- T1036.008Masquerade File Type
- T1036.009Break Process Trees
- T1036.010Masquerade Account Name
- T1036.011Overwrite Process Arguments
- T1036.012Browser Fingerprint