{"id":"T1036","name":"Masquerading","url":"https://attack.mitre.org/techniques/T1036","tactics":["stealth"],"platforms":["Containers","ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0127","stix_id":"x-mitre-detection-strategy--408aedab-4a23-41ad-809d-fe9c3805b7f6","name":"Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy","url":"https://attack.mitre.org/detectionstrategies/DET0127","analytics":[{"id":"AN0355","stix_id":"x-mitre-analytic--e3d982ec-2729-4e98-b340-affa13096fd6","name":"Analytic 0355","description":"Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0355","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"EventCode=7045","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"}],"mutable_elements":[{"field":"OriginalFilenameMismatch","description":"Compare executable file name with PE metadata OriginalFilename field"},{"field":"KnownSystemUtilityPaths","description":"Tune based on expected installation directories for signed binaries"},{"field":"TimeWindow","description":"Correlation window between file creation and service/process execution"}],"live":true,"detection_strategies":["DET0127"],"techniques":["T1036"]},{"id":"AN0356","stix_id":"x-mitre-analytic--3191336e-8cdb-4d41-80a4-aa2ab869f7bf","name":"Analytic 0356","description":"Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0356","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"rename","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"linux-syslog"},{"name":"linux:osquery","channel":"file_events","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"DropLocationPattern","description":"Directories where new binaries are suspicious (e.g., /tmp)"},{"field":"FilenameAnomalies","description":"Regex for Unicode/RLO/space abuse in filenames"},{"field":"ExecutionDelayWindow","description":"Time range between file write and execution used for joining"}],"live":true,"detection_strategies":["DET0127"],"techniques":["T1036"]},{"id":"AN0357","stix_id":"x-mitre-analytic--7ebea786-db9c-439d-9caf-d0dd740047f3","name":"Analytic 0357","description":"Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0357","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"fs:fileevents","channel":"/var/log/install.log","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"fs-fileevents"}],"mutable_elements":[{"field":"InfoPlistDiscrepancy","description":"Mismatch between bundle metadata and file system path/name"},{"field":"LaunchAgentPath","description":"Unusual LaunchDaemon/LaunchAgent paths can be tuned per org"},{"field":"ExecutionTrigger","description":"Window between install and first execution (e.g., at user login)"}],"live":true,"detection_strategies":["DET0127"],"techniques":["T1036"]},{"id":"AN0358","stix_id":"x-mitre-analytic--6927a2ad-c56f-4e87-9392-6e3eef07e57e","name":"Analytic 0358","description":"Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0358","platforms":["Containers"],"log_source_references":[{"name":"containerd:runtime","channel":"/var/log/containers/*.log","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"containerd-runtime"},{"name":"docker:events","channel":"docker.events.json","data_component":"DC0028","data_component_name":"Image Metadata","log_source_slug":"docker-events"},{"name":"ebpf:syscalls","channel":"file_write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"ebpf-syscalls"}],"mutable_elements":[{"field":"ImageLabelMismatch","description":"Tune detection based on mismatch between image name and labels"},{"field":"StartupScriptLocation","description":"Detect binaries added or modified in startup path (e.g., /entrypoint.sh)"},{"field":"ProcessNamePattern","description":"Allow tuning based on suspicious binary naming inside containers"}],"live":true,"detection_strategies":["DET0127"],"techniques":["T1036"]},{"id":"AN0359","stix_id":"x-mitre-analytic--f3dfb562-94ef-44ea-be4f-17ac2d0771b5","name":"Analytic 0359","description":"Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0359","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"registers services with legitimate-sounding names","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"esxi-hostd"},{"name":"esxi:shell","channel":"scripts or binaries with misleading names","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"ServiceNameBaseline","description":"Tune based on default service names vs. suspicious new entries"},{"field":"ScriptFilePath","description":"Watch for new binaries/scripts in boot or cron folders"},{"field":"ExecutionContext","description":"Determine if execution happens at boot or scheduled interval"}],"live":true,"detection_strategies":["DET0127"],"techniques":["T1036"]}],"live":true,"version":"1.0","techniques":["T1036"]}],"sigma_rules":[{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","author":"Micah Babinski","status":"test","level":"medium","date":"2022-12-11","modified":"2023-03-05","description":"Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.","references":["https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe","https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915","https://github.com/electron/rcedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036.003","attack.t1036","attack.t1027.005","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","techniques":["T1036.003","T1036","T1027.005","T1027"],"cves":[]},{"id":"12fbff88-16b5-4b42-9754-cd001a789fb3","title":"CodePage Modification Via MODE.COM To Russian Language","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-01-17","modified":null,"description":"Detects a CodePage modification using the \"mode.com\" utility to Russian language.\nThis behavior has been used by threat actors behind Dharma ransomware.\n","references":["https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode","https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html","https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml","techniques":["T1036"],"cves":[]},{"id":"1327381e-6ab0-4f38-b583-4c1b8346a56b","title":"Potential Command Line Path Traversal Evasion Attempt","author":"Christian Burkard (Nextron Systems)","status":"test","level":"medium","date":"2021-10-26","modified":"2023-03-29","description":"Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline","references":["https://twitter.com/hexacorn/status/1448037865435320323","https://twitter.com/Gal_B1t/status/1062971006078345217"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml","techniques":["T1036"],"cves":[]},{"id":"15b75071-74cc-47e0-b4c6-b43744a62a2b","title":"Suspicious Process Start Locations","author":"juju4, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-01-16","modified":"2022-01-07","description":"Detects suspicious process run from unusual locations","references":["https://car.mitre.org/wiki/CAR-2013-05-002"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","car.2013-05-002"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml","techniques":["T1036"],"cves":[]},{"id":"1a1ed54a-2ba4-4221-94d5-01dee560d71e","title":"Renamed CreateDump Utility Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-09-20","modified":"2023-02-14","description":"Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory","references":["https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/","https://twitter.com/bopin2020/status/1366400799199272960"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_renamed_createdump.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"1c12727d-02bf-45ff-a9f3-d49806a3cf43","title":"Renamed Plink Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-06","modified":"2023-02-03","description":"Detects the execution of a renamed version of the Plink binary","references":["https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/","https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_renamed_plink.yml","techniques":["T1036"],"cves":[]},{"id":"2e65275c-8288-4ab4-aeb7-6274f58b6b20","title":"Procdump Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2021-08-16","modified":"2026-06-29","description":"Detects usage of the SysInternals Procdump utility","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/procdump"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"312b42b1-bded-4441-8b58-163a3af58775","title":"Potentially Suspicious Execution From Tmp Folder","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-06-02","modified":"2025-08-05","description":"Detects a potentially suspicious execution of a process located in the '/tmp/' folder","references":["https://blogs.jpcert.or.jp/en/2023/05/gobrat.html","https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/","https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection","https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml","techniques":["T1036"],"cves":[]},{"id":"32e280f1-8ad4-46ef-9e80-910657611fbc","title":"Potential Homoglyph Attack Using Lookalike Characters","author":"Micah Babinski, @micahbabinski","status":"test","level":"medium","date":"2023-05-07","modified":null,"description":"Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\nThis is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\nare indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\n","references":["https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish","http://www.irongeek.com/homoglyph-attack-generator.php"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1036.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml","techniques":["T1036","T1036.003"],"cves":[]},{"id":"33339be3-148b-4e16-af56-ad16ec6c7e7b","title":"Findstr Launching .lnk File","author":"Trent Liffick","status":"test","level":"medium","date":"2020-05-01","modified":"2024-01-15","description":"Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack","references":["https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1202","attack.t1027.003"],"path":"rules/windows/process_creation/proc_creation_win_findstr_lnk.yml","techniques":["T1036","T1202","T1027.003"],"cves":[]},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-28","modified":"2025-01-22","description":"Detects a renamed \"dctask64.exe\" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.\nThis binary can be abused for DLL injection, arbitrary command and process execution.\n","references":["https://twitter.com/gN3mes1s/status/1222088214581825540","https://twitter.com/gN3mes1s/status/1222095963789111296","https://twitter.com/gN3mes1s/status/1222095371175911424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036","attack.t1055.001","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","techniques":["T1036","T1055.001","T1202","T1218"],"cves":[]},{"id":"396f6630-f3ac-44e3-bfc8-1b161bc00c4e","title":"Suspicious Child Process Of Wermgr.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-10-14","modified":"2024-08-29","description":"Detects suspicious Windows Error Reporting manager (wermgr.exe) child process","references":["https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html","https://www.echotrail.io/insights/search/wermgr.exe","https://github.com/binderlabs/DirCreate2System"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml","techniques":["T1055","T1036"],"cves":[]},{"id":"3d7679bd-0c00-440c-97b0-3f204273e6c7","title":"New Process Created Via Taskmgr.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2018-03-13","modified":"2024-01-18","description":"Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC","references":["https://twitter.com/ReneFreingruber/status/1172244989335810049"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml","techniques":["T1036"],"cves":[]},{"id":"3dfd06d2-eaf4-4532-9555-68aca59f57c4","title":"Process Execution From A Potentially Suspicious Folder","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2019-01-16","modified":"2024-07-12","description":"Detects a potentially suspicious execution from an uncommon folder.","references":["https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt","https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses","https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/","https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_susp_execution_path.yml","techniques":["T1036"],"cves":[]},{"id":"45eb2ae2-9aa2-4c3a-99a5-6e5077655466","title":"Suspicious Computer Account Name Change CVE-2021-42287","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-22","modified":"2022-12-25","description":"Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287","references":["https://medium.com/@mvelazco/hunting-for-samaccountname-spoofing-cve-2021-42287-and-domain-controller-impersonation-f704513c8a45"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.t1036","attack.t1098","cve.2021-42287","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-42287/win_security_samaccountname_spoofing_cve_2021_42287.yml","techniques":["T1036","T1098"],"cves":["CVE-2021-42287"]},{"id":"4e762605-34a8-406d-b72e-c1a089313320","title":"Potential Fake Instance Of Hxtsr.EXE Executed","author":"Sreeman","status":"test","level":"medium","date":"2020-04-17","modified":"2024-02-08","description":"HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.\nHxTsr.exe is part of Outlook apps, because it resides in a hidden \"WindowsApps\" subfolder of \"C:\\Program Files\".\nAny instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe\n","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml","techniques":["T1036"],"cves":[]},{"id":"4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6","title":"Potential Homoglyph Attack Using Lookalike Characters in Filename","author":"Micah Babinski, @micahbabinski","status":"test","level":"medium","date":"2023-05-08","modified":null,"description":"Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.\nThis is used as an obfuscation and masquerading techniques. Only \"perfect\" homoglyphs are included; these are characters that\nare indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.\n","references":["https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish","http://www.irongeek.com/homoglyph-attack-generator.php"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1036","attack.t1036.003"],"path":"rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml","techniques":["T1036","T1036.003"],"cves":[]},{"id":"515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48","title":"CreateDump Process Dump","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-01-04","modified":"2022-08-19","description":"Detects uses of the createdump.exe LOLOBIN utility to dump process memory","references":["https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/","https://twitter.com/bopin2020/status/1366400799199272960"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"52d097e2-063e-4c9c-8fbb-855c8948d135","title":"Suspicious Windows Update Agent Empty Cmdline","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-26","modified":"2023-11-11","description":"Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags\n","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml","techniques":["T1036"],"cves":[]},{"id":"54f0434b-726f-48a1-b2aa-067df14516e4","title":"Password Protected ZIP File Opened (Suspicious Filenames)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-09","modified":null,"description":"Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.","references":["https://twitter.com/sbousseaden/status/1523383197513379841"],"logsource":{"product":"windows","service":"security"},"tags":["attack.command-and-control","attack.stealth","attack.t1027","attack.t1105","attack.t1036"],"path":"rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml","techniques":["T1027","T1105","T1036"],"cves":[]},{"id":"5afee48e-67dd-4e03-a783-f74259dcf998","title":"Potential LSASS Process Dump Via Procdump","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2018-10-30","modified":"2025-10-19","description":"Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.\nThis rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.\nLSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.\nAttackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.\n","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/procdump","https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002","https://x.com/wietze/status/1958302556033065292?s=12"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.credential-access","attack.t1003.001","car.2013-05-009"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"646ea171-dded-4578-8a4d-65e9822892e3","title":"Process Memory Dump Via Comsvcs.DLL","author":"Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2020-02-18","modified":"2025-02-23","description":"Detects a process memory dump via \"comsvcs.dll\" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)","references":["https://twitter.com/shantanukhande/status/1229348874298388484","https://twitter.com/pythonresponder/status/1385064506049630211?s=21","https://twitter.com/Hexacorn/status/1224848930795552769","https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/","https://twitter.com/SBousseaden/status/1167417096374050817","https://twitter.com/Wietze/status/1542107456507203586","https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py","https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1036","attack.t1003.001","car.2013-05-009"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"66e563f9-1cbd-4a22-a957-d8b7c0f44372","title":"HackTool - XORDump Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-28","modified":"2023-02-08","description":"Detects suspicious use of XORDump process memory dumping utility","references":["https://github.com/audibleblink/xordump"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_hktl_xordump.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"737e618a-a410-49b5-bec3-9e55ff7fbc15","title":"Suspicious Calculator Usage","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-02-09","modified":"2023-11-09","description":"Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.\n","references":["https://twitter.com/ItsReallyNick/status/1094080242686312448"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml","techniques":["T1036"],"cves":[]},{"id":"79b06761-465f-4f88-9ef2-150e24d3d737","title":"Potential SysInternals ProcDump Evasion","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-11","modified":"2023-05-09","description":"Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name","references":["https://twitter.com/mrd0x/status/1480785527901204481"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"7a74da6b-ea76-47db-92cc-874ad90df734","title":"Suspicious MSDT Parent Process","author":"Nextron Systems","status":"test","level":"high","date":"2022-06-01","modified":"2023-02-06","description":"Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation","references":["https://twitter.com/nao_sec/status/1530196847679401984","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml","techniques":["T1036","T1218"],"cves":[]},{"id":"949f1ffb-6e85-4f00-ae1e-c3c5b190d605","title":"Explorer Process Tree Break","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber","status":"test","level":"medium","date":"2019-06-29","modified":"2025-10-31","description":"Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,\nwhich is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from \"svchost\"\n","references":["https://twitter.com/CyberRaiju/status/1273597319322058752","https://twitter.com/bohops/status/1276357235954909188?s=12","https://twitter.com/nas_bench/status/1535322450858233858","https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml","techniques":["T1036"],"cves":[]},{"id":"9fff585c-c33e-4a86-b3cd-39312079a65f","title":"Taskmgr as LOCAL_SYSTEM","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-03-18","modified":"2022-05-27","description":"Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml","techniques":["T1036"],"cves":[]},{"id":"b8fd0e93-ff58-4cbd-8f48-1c114e342e62","title":"Windows Binaries Write Suspicious Extensions","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-12","modified":"2025-10-07","description":"Detects Windows executables that write files with suspicious extensions","references":["Internal Research"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml","techniques":["T1036"],"cves":[]},{"id":"c7942406-33dd-4377-a564-0f62db0593a3","title":"Suspicious CodePage Switch Via CHCP","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-10-14","modified":"2023-03-07","description":"Detects a code page switch in command line or batch scripts to a rare language","references":["https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers","https://twitter.com/cglyer/status/1183756892952248325"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml","techniques":["T1036"],"cves":[]},{"id":"cbec226f-63d9-4eca-9f52-dfb6652f24df","title":"Suspicious Process Parents","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-21","modified":"2022-09-08","description":"Detects suspicious parent processes that should not have any children or should only have a single possible child program","references":["https://twitter.com/x86matthew/status/1505476263464607744?s=12","https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_susp_parents.yml","techniques":["T1036"],"cves":[]},{"id":"cfeed607-6aa4-4bbd-9627-b637deb723c8","title":"New or Renamed User Account with '$' Character","author":"Ilyas Ochkov, oscd.community","status":"test","level":"medium","date":"2019-10-25","modified":"2024-01-16","description":"Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.\n","references":["https://twitter.com/SBousseaden/status/1387743867663958021"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml","techniques":["T1036"],"cves":[]},{"id":"d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e","title":"CodePage Modification Via MODE.COM","author":"Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"low","date":"2024-01-19","modified":null,"description":"Detects a CodePage modification using the \"mode.com\" utility.\nThis behavior has been used by threat actors behind Dharma ransomware.\n","references":["https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode","https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html","https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_mode_codepage_change.yml","techniques":["T1036"],"cves":[]},{"id":"dee0a7a3-f200-4112-a99b-952196d81e42","title":"DumpMinitool Execution","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-04-06","modified":"2023-04-12","description":"Detects the use of \"DumpMinitool.exe\" a tool that allows the dump of process memory via the use of the \"MiniDumpWriteDump\"","references":["https://twitter.com/mrd0x/status/1511415432888131586","https://twitter.com/mrd0x/status/1511489821247684615","https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/","https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"e4a6b256-3e47-40fc-89d2-7a477edd6915","title":"System File Execution Location Anomaly","author":"Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2017-11-27","modified":"2026-07-28","description":"Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.\n","references":["https://twitter.com/GelosSnake/status/934900723426439170","https://asec.ahnlab.com/en/39828/","https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml","techniques":["T1036"],"cves":[]},{"id":"ea3ecad2-db86-4a89-ad0b-132a10d2db55","title":"Interactive Bash Suspicious Children","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-03-14","modified":null,"description":"Detects suspicious interactive bash as a parent to rather uncommon child processes","references":["Internal Research"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.004","attack.t1036"],"path":"rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml","techniques":["T1059.004","T1036"],"cves":[]},{"id":"eb1c4225-1c23-4241-8dd4-051389fde4ce","title":"Suspicious DumpMinitool Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-06","modified":"2023-04-12","description":"Detects suspicious ways to use the \"DumpMinitool.exe\" binary","references":["https://twitter.com/mrd0x/status/1511415432888131586","https://twitter.com/mrd0x/status/1511489821247684615","https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1036","attack.t1003.001"],"path":"rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml","techniques":["T1036","T1003.001"],"cves":[]},{"id":"f3d39c45-de1a-4486-a687-ab126124f744","title":"Sdiagnhost Calling Suspicious Child Process","author":"Nextron Systems, @Kostastsale","status":"test","level":"high","date":"2022-06-01","modified":"2024-08-23","description":"Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)","references":["https://twitter.com/nao_sec/status/1530196847679401984","https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/","https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/","https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml","techniques":["T1036","T1218"],"cves":[]},{"id":"f53714ec-5077-420e-ad20-907ff9bb2958","title":"Forfiles.EXE Child Process Masquerading","author":"Nasreddine Bencherchali (Nextron Systems), Anish Bogati","status":"test","level":"high","date":"2024-01-05","modified":null,"description":"Detects the execution of \"forfiles\" from a non-default location, in order to potentially spawn a custom \"cmd.exe\" from the current working directory.\n","references":["https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml","techniques":["T1036"],"cves":[]},{"id":"fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd","title":"Potential ReflectDebugger Content Execution Via WerFault.EXE","author":"X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2023-06-30","modified":null,"description":"Detects execution of \"WerFault.exe\" with the \"-pr\" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow","references":["https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html","https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1036"],"path":"rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml","techniques":["T1036"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2022-26500","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-26501","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}