Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Adversaries may also use the same icon of the file they are trying to mimic.
Match Legitimate Name or Location
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1036/005  external_id: T1036.005     source_name: Twitter ItsReallyNick Masquerading Update  description: Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.  url: https://twitter.com/ItsReallyNick/status/1055321652777619457     source_name: Docker Images  description: Docker. (n.d.). Docker Images. Retrieved April 6, 2021.  url: https://docs.docker.com/engine/reference/commandline/images/     source_name: Elastic Masquerade Ball  description: Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.  url: https://www.elastic.co/blog/how-hunt-masquerade-ball     