Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containeri...
BY SOURCE
PROCEDURES (32)
Auto-extracted: 5 detections for process creation monitoring
Auto-extracted: 3 detections for privilege
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for network connection monitoring
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for parent process
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for masquerad
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for module load monitoring
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for dll side
Auto-extracted: 1 detections for kernel
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for file monitoring