SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Malware

Trojan

Malware disguised as legitimate software to get installed

categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Emotet, Qbot, TrickBot

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1036 · System File Copied to Unusual Location · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1036 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1036 -TestGuids 51005ac7-52e2-45e0-bdab-d17c6d4916cd -TimeoutSeconds 120'
ATT&CK T1036 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1036 -Tool atomic -RunId run-2026-10-14-013 -Command 'Invoke-AtomicTest T1036 -TestGuids 51005ac7-52e2-45e0-bdab-d17c6d4916cd -TimeoutSeconds 120'
ATT&CK T1036 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1036 -Tool atomic -RunId run-2026-10-18-007 -Command 'Invoke-AtomicTest T1036 -TestGuids 51005ac7-52e2-45e0-bdab-d17c6d4916cd -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-28 · detected in 38s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)
Sysmon · EID 1Powershell process spawned Windows command shell instance
Sysmon · EID 11Executable file created by powershell: C:\ProgramData\cmd.exe
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell executed "Copy-Item"
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
… and 7 more event type(s)

Detection that fired

  • ✓ Wazuh 100404 (level 13) lab rule — Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)
  • ✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~61560 incidental alerts/hour — tune against this.

detected windows · 2026-10-27 · detected in 39s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)
Sysmon · EID 1Powershell process spawned Windows command shell instance
Sysmon · EID 11Executable file created by powershell: C:\ProgramData\cmd.exe
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell executed "Copy-Item"
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
… and 6 more event type(s)

Detection that fired

  • ✓ Wazuh 100404 (level 13) lab rule — Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~65976 incidental alerts/hour — tune against this.

Classification

32 values: 2 lab-measured, 16 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vectorMalware
Reach (CVSS)Local
Attack complexityLow
Privileges requiredNone
User interactionActive
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceHigh
MaturityCommoditized

Impact & scope

SeverityHigh
ImpactConfidentialityIntegrity
PlatformContainersESXiLinuxmacOSWindows
EnvironmentOn-premises
Target asset classEndpoint
Kill-chain phase (tactic)Stealth

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Command ExecutionFile MetadataFile ModificationImage MetadataProcess CreationProcess MetadataService CreationService Metadata
Defense bypassedApplication control

Detection & response

Mitigated by 27

  • M1017 attack-mitigation
  • M1018 attack-mitigation
  • M1022 attack-mitigation
  • M1038 attack-mitigation
  • M1040 attack-mitigation
  • M1045 attack-mitigation
  • M1047 attack-mitigation
  • M1049 attack-mitigation
  • D3-CF d3fend
  • D3-CM d3fend
  • D3-CQ d3fend
  • D3-DA d3fend
  • D3-DF d3fend
  • D3-EAL d3fend
  • D3-EDL d3fend
  • D3-EFA d3fend
  • D3-FA d3fend
  • D3-FE d3fend
  • D3-FEV d3fend
  • D3-FIM d3fend
  • D3-LFP d3fend
  • D3-RF d3fend
  • D3-RFAM d3fend
  • D3-SCA d3fend
  • D3-SCF d3fend
  • D3-SFA d3fend
  • D3-SJA d3fend

Detected by 96

  • DET0127 attack-detection-strategy
  • 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d sigma
  • 0718cd72-f316-4aa2-988f-838ea8533277 sigma
  • 0b0cd537-fc77-4e6e-a973-e53495c1083d sigma
  • 0ba1da6d-b6ce-4366-828c-18826c9de23e sigma
  • 0c92f2e6-f08f-4b73-9216-ecb0ca634689 sigma
  • 0cf2e1c6-8d10-4273-8059-738778f981ad sigma
  • 12fbff88-16b5-4b42-9754-cd001a789fb3 sigma
  • 1327381e-6ab0-4f38-b583-4c1b8346a56b sigma
  • 13c02350-4177-4e45-ac17-cf7ca628ff5e sigma
  • 15b75071-74cc-47e0-b4c6-b43744a62a2b sigma
  • 18da1007-3f26-470f-875d-f77faf1cab31 sigma
  • 1a1ed54a-2ba4-4221-94d5-01dee560d71e sigma
  • 1c12727d-02bf-45ff-a9f3-d49806a3cf43 sigma
  • 1cfac73c-be78-4f9a-9b08-5bde0c3953ab sigma
  • 2ad78473-6978-40f5-b8f1-89c7e1c27a1a sigma
  • 2ddef153-167b-4e89-86b6-757a9e65dcac sigma
  • 2e65275c-8288-4ab4-aeb7-6274f58b6b20 sigma
  • 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592 sigma
  • 312b42b1-bded-4441-8b58-163a3af58775 sigma
  • 3215aa19-f060-4332-86d5-5602511f3ca8 sigma
  • 32e280f1-8ad4-46ef-9e80-910657611fbc sigma
  • 33339be3-148b-4e16-af56-ad16ec6c7e7b sigma
  • 340a090b-c4e9-412e-bb36-b4b16fe96f9b sigma
  • 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 sigma
  • 3711eee4-a808-4849-8a14-faf733da3612 sigma
  • 39466c42-c189-476a-989f-8cdb135c163a sigma
  • 396f6630-f3ac-44e3-bfc8-1b161bc00c4e sigma
  • 3d7679bd-0c00-440c-97b0-3f204273e6c7 sigma
  • 3dfd06d2-eaf4-4532-9555-68aca59f57c4 sigma
  • 3f7f5b0b-5b16-476c-a85f-ab477f6dd24b sigma
  • 45eb2ae2-9aa2-4c3a-99a5-6e5077655466 sigma
  • 4922a5dd-6743-4fc2-8e81-144374280997 sigma
  • 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67 sigma
  • 4e762605-34a8-406d-b72e-c1a089313320 sigma
  • 4eec988f-7bf0-49f1-8675-1e6a510b3a2a sigma
  • 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 sigma
  • 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 sigma
  • 52d097e2-063e-4c9c-8fbb-855c8948d135 sigma
  • 54f0434b-726f-48a1-b2aa-067df14516e4 sigma
  • … and 56 more in the database

Tested by 24

  • 03ae82a6-9fa0-465b-91df-124d8ca5c4e8 atomic
  • 1214f818-673b-4494-9fbd-99af0e185866 atomic
  • 24136435-c91a-4ede-9da1-8b284a1c1a23 atomic
  • 26cde240-0112-4806-8c97-bdde43dab298 atomic
  • 35eb8d16-9820-4423-a2a1-90c4f5edd9ca atomic
  • 3a2a578b-0a01-46e4-92e3-62e2859b42f0 atomic
  • 4449c89b-ec82-43a4-89c1-91e2f1abeecc atomic
  • 51005ac7-52e2-45e0-bdab-d17c6d4916cd atomic
  • 5ba5a3d1-cf3c-4499-968a-a93155d1f717 atomic
  • 812c3ab8-94b0-4698-a9bf-9420af23ce24 atomic
  • 83810c46-f45e-4485-9ab6-8ed0e9e6ed7f atomic
  • 89a7dd26-e510-4c9f-9b15-f3bae333360f atomic
  • a315bfff-7a98-403b-b442-2ea1b255e556 atomic
  • ac9d0fc3-8aa8-4ab5-b11f-682cd63b40aa atomic
  • ad4b73c2-d6e2-4d8b-9868-4c6f55906e01 atomic
  • b721c6ef-472c-4263-a0d9-37f1f4ecff66 atomic
  • b95ce2eb-a093-4cd8-938d-5258cef656ea atomic
  • bc15c13f-d121-4b1f-8c7d-28d95854d086 atomic
  • c3d24a39-2bfe-4c6a-b064-90cd73896cb0 atomic
  • c7fa0c3b-b57f-4cba-9118-863bf4e653fc atomic
  • d7c03c7e-31cd-43c7-859a-ec053f73b23a atomic
  • dac81590-8b63-4769-8b82-310beedc4f09 atomic
  • f0e3aaea-5cd9-4db6-a077-631dd19b27a8 atomic
  • f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9 atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-013partially-detectedatomicwindows2026-10-14
run-2026-10-18-007partially-detectedatomicwindows2026-10-18
run-2026-10-27-008detectedatomicwindows2026-10-27
run-2026-10-28-013detectedatomicwindows2026-10-28
  • run-2026-10-14-013 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1036 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=16 max_level=15 dwell_s=90
  • run-2026-10-18-007 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1036 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1501 max_level=15 dwell_s=90
  • run-2026-10-27-008 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1036 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1796 max_level=15 dwell_s=90
  • run-2026-10-28-013 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1036 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1710 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 70 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1036 as the nearest framework entries; ids verified to exist in the cached catalogues.
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 60 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-013 (partially-detected) for T1036: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-007 (partially-detected) for T1036: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-008 (detected): Wazuh rule(s) 100404 fired on T1036 within the detonation window
    Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)
  • ev-0007 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-013 (detected): Wazuh rule(s) 100404 fired on T1036 within the detonation window
    Masquerading: a core Windows system binary executed from a non-system directory (System32/SysWOW64 name running elsewhere)