# T1036.005 - Match Legitimate Name or Location
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1036/005)
<blockquote>Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Adversaries may also use the same icon of the file they are trying to mimic.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Execute a process from a directory masquerading as the current parent directory.](#atomic-test-1---execute-a-process-from-a-directory-masquerading-as-the-current-parent-directory)


<br/>

## Atomic Test #1 - Execute a process from a directory masquerading as the current parent directory.
Create and execute a process from a directory masquerading as the current parent directory (`...` instead of normal `..`)

**Supported Platforms:** macOS, Linux


**auto_generated_guid:** 812c3ab8-94b0-4698-a9bf-9420af23ce24





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| test_message | Test message to echo out to the screen | String | Hello from the Atomic Red Team test T1036.005#1|


#### Attack Commands: Run with `sh`! 


```sh
mkdir $HOME/...
cp $(which sh) $HOME/...
$HOME/.../sh -c "echo #{test_message}"
```

#### Cleanup Commands:
```sh
rm -f $HOME/.../sh
rmdir $HOME/.../
```





<br/>
