Detect Masquerading in Sumo Logic CSE
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Canonical reference
- https://attack.mitre.org/techniques/T1036/
Sumo Detection Query
_sourceCategory=*windows* OR _sourceCategory=*sysmon*
| where EventID = "1" OR EventCode = "1"
| parse field=Message "Image: *\n" as process_path nodrop
| parse field=Message "OriginalFileName: *\n" as original_filename nodrop
| parse field=Message "CommandLine: *\n" as command_line nodrop
| parse field=Message "ParentImage: *\n" as parent_image nodrop
| parse field=Message "User: *\n" as user nodrop
| parse field=Message "ProcessId: *\n" as process_id nodrop
| if(isBlank(process_path), Image, process_path) as process_path
| toUpperCase(process_path) as path_upper
| parse regex field=path_upper "(?<process_name>[^\\\\]+)$" nodrop
| toLowercase(process_name) as process_name_lower
| where process_name_lower in ("svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "wininit.exe", "winlogon.exe", "explorer.exe", "spoolsv.exe", "taskhost.exe", "taskhostw.exe", "conhost.exe", "dllhost.exe", "runtimebroker.exe")
| where !(path_upper matches /^C:\\WINDOWS\\SYSTEM32\\/)
| where !(path_upper matches /^C:\\WINDOWS\\SYSWOW64\\/)
| where !(path_upper = "C:\\WINDOWS\\EXPLORER.EXE")
| where !(path_upper matches /^C:\\WINDOWS\\WINSXS\\/)
| fields _messageTime, _sourceHost, user, process_path, original_filename, command_line, parent_image, process_id
| sort by _messageTime descDetects masqueraded system binaries running from non-standard paths by parsing Sysmon process creation events and filtering known trusted binary locations.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software management platforms (e.g., SCCM, Tanium) that copy system utilities to staging directories before execution
- Developer workstations running build systems or CI/CD agents that invoke system binaries from project-relative paths
- System recovery or forensic tools that execute system binaries from alternate root partitions or recovery media
Other platforms for T1036
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Masquerade as svchost.exe from Temp Directory
Expected signal: Sysmon Event ID 1: Process Create with Image=%TEMP%\svchost.exe, OriginalFileName=Cmd.Exe. Security Event ID 4688 with NewProcessName containing svchost.exe in a temp directory. Sysmon Event ID 11: FileCreate for svchost.exe in temp.
- Test 2Masquerade as lsass.exe from User Profile
Expected signal: Sysmon Event ID 1: Process Create with Image=%APPDATA%\lsass.exe, OriginalFileName=NOTEPAD.EXE. The OriginalFileName mismatch is a key indicator.
- Test 3Masquerade as explorer.exe from Downloads
Expected signal: Sysmon Event ID 1: Process Create with Image in Downloads folder, OriginalFileName mismatch. File creation event for explorer.exe in Downloads.
References (7)
- https://attack.mitre.org/techniques/T1036/
- https://www.elastic.co/blog/how-hunt-masquerade-ball
- https://lolbas-project.github.io/
- https://x.com/ItsReallyNick/status/1055321652777619457
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1036 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (12)
- T1036.001Invalid Code Signature
- T1036.002Right-to-Left Override
- T1036.003Rename Legitimate Utilities
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1036.006Space after Filename
- T1036.007Double File Extension
- T1036.008Masquerade File Type
- T1036.009Break Process Trees
- T1036.010Masquerade Account Name
- T1036.011Overwrite Process Arguments
- T1036.012Browser Fingerprint