Threat Actors may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.