THREATNOIR
Subscribe
MITRE ATT&CK · T1036

Masquerading

MITRE · cited in 20 of our lessons

Explanation

What attackers do. Attackers make malicious files, processes, services or tasks look legitimate, for example by naming them like system binaries, placing them in trusted-looking paths or faking file extensions. This serves the Defence Evasion tactic.

How to defend. Use application control based on signatures and hashes rather than file names, and baseline where legitimate system binaries live. Endpoint detection rules can compare a process name with its path, signer and expected parent. Show full file extensions to users so double extensions stand out.

Signs to look for. Look for system binary names running from unusual folders, executables with mismatched internal and on-disk names, files with double extensions or right-to-left override characters, and services or tasks with names close to real ones. The common gap is trusting process names in alerts without checking path and signature.

Open the technique on MITRE ATT&CK
The official text
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 20.