T1036.005: Match Legitimate Resource Name or Location
AI Answer
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, (Source: MITRE ATT&CK T1036.005)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1036.005 |
| Name | Match Legitimate Resource Name or Location |
| Tactic | stealth (stealth) |
| Platforms | Containers, ESXi, Linux, macOS, Windows |
| Sub-technique | Yes |
Why it matters
In the OpenTrojan knowledge graph, Match Legitimate Resource Name or Location (T1036.005) is one of the highest-connectivity ATT&CK techniques: 221 MITRE STIX relationships reference this technique; 63 threat groups observed using it; 143 software families associated; 15 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1036.005).
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:
Application Control:
- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution.
- Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g.,
New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml")
Script Blocking:
- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources.
- Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g.,
Set-ExecutionPolicy AllSigned)
Executable Blocking:
- Use Case: Prevent execution of binaries from suspicious locations, such as
%TEMP%or%APPDATA%directories. - Implementation: Block execution of
.exe,.bat, or.ps1files from user-writable directories.
Dynamic Analysis Prevention:
- Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time.
- Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- EKANS
- BLINDINGCAN
- Ninja
- Bumblebee
- BRICKSTORM
- NOKKI
- RotaJakiro
- Chinoxy
- Misdat
- Ursnif
- ThreatNeedle
- ZLib
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Indrik Spider
- SideCopy
- Mustard Tempest
- Kimsuky
- admin@338
- Volt Typhoon
- Patchwork
- APT41
- menuPass
- APT32
- MuddyWater
- Naikon
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- RedPenguin
- Operation Sharpshooter
- Operation Honeybee
- Triton Safety Instrumented System Attack
- C0018
- J-magic Campaign
- Operation Digital Eye
- HomeLand Justice
- C0032
- SolarWinds Compromise
- Operation CuckooBees
- 2025 Poland Wiper Attacks
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1036.005 Match Legitimate Resource Name or Location. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1036.005 Match Legitimate Resource Name or Location?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.