[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1036":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1036","T1036","Masquerading",20,"MITRE","**What attackers do.** Attackers make malicious files, processes, services or tasks look legitimate, for example by naming them like system binaries, placing them in trusted-looking paths or faking file extensions. This serves the Defence Evasion tactic.\n\n**How to defend.** Use application control based on signatures and hashes rather than file names, and baseline where legitimate system binaries live. Endpoint detection rules can compare a process name with its path, signer and expected parent. Show full file extensions to users so double extensions stand out.\n\n**Signs to look for.** Look for system binary names running from unusual folders, executables with mismatched internal and on-disk names, files with double extensions or right-to-left override characters, and services or tasks with names close to real ones. The common gap is trusting process names in alerts without checking path and signature.","Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and\u002For security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of Masquerading.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1036\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"fake-claude-ai-ads-trick-users-into-running-malware-via-clickfix","Fake Claude AI Ads Trick Users into Running Malware via ClickFix","2026-10-09T22:20:47.165+00:00",{"slug":25,"title":26,"published_at":27},"unpatched-ahsaycbs-backup-flaws-weaponized-for-crypto-mining","Unpatched AhsayCBS Backup Flaws Weaponized for Crypto Mining","2026-10-09T12:20:56.625+00:00",{"slug":29,"title":30,"published_at":31},"russian-apt-uac-0099-upgrades-matchboil-malware-with-enhanced-stealth-against-ukrainian-targets","Russian APT UAC-0099 Upgrades MatchBoil Malware with Enhanced Stealth Against Ukrainian Targets","2026-10-08T20:21:35.327+00:00",{"slug":33,"title":34,"published_at":35},"linux-backdoors-masquerade-as-legitimate-tools-to-evade-detection","Linux Backdoors Masquerade as Legitimate Tools to Evade Detection","2026-10-06T22:22:05.813+00:00",{"slug":37,"title":38,"published_at":39},"malicious-linux-backdoors-impersonate-legitimate-mail-security-products","Malicious Linux Backdoors Impersonate Legitimate Mail Security Products","2026-10-02T14:20:37.948+00:00",{"slug":41,"title":42,"published_at":43},"sectoprat-hides-in-legitimate-apps-evading-signature-detection","SectopRAT Hides in Legitimate Apps, Evading Signature Detection","2026-09-24T22:21:29.706+00:00",{"slug":45,"title":46,"published_at":47},"darkme-rat-campaign-swaps-zero-days-for-fake-image-file-lures","DarkMe RAT Campaign Swaps Zero-Days for Fake Image File Lures","2026-09-23T12:21:28.922+00:00",{"slug":49,"title":50,"published_at":51},"invisible-unicode-characters-used-to-bypass-email-security-filters","Invisible Unicode Characters Used to Bypass Email Security Filters","2026-09-06T16:20:22.447+00:00",{"slug":53,"title":54,"published_at":55},"fake-software-installers-deliver-malware-to-chinese-speaking-users","Fake Software Installers Deliver Malware to Chinese-Speaking Users","2026-09-02T00:20:24.543+00:00",{"slug":57,"title":58,"published_at":59},"ftp-banner-abuse-used-to-deliver-stealthy-remote-access-trojans","FTP Banner Abuse Used to Deliver Stealthy Remote Access Trojans","2026-08-21T12:20:43.345+00:00",{"slug":61,"title":62,"published_at":63},"apt29-hijacks-public-wi-fi-gateways-to-steal-m365-credentials-from-traveling-employees","APT29 Hijacks Public Wi-Fi Gateways to Steal M365 Credentials from Traveling Employees","2026-08-03T10:20:42.204+00:00",{"slug":65,"title":66,"published_at":67},"text-salting-technique-bypasses-ai-email-security-filters-at-scale","Text Salting Technique Bypasses AI Email Security Filters at Scale","2026-07-16T22:21:00.247+00:00",[69,74,79,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",17,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",9,{"slug":80,"name":81,"problem":82,"stories":78},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":84,"name":85,"problem":86,"stories":87},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",6,{"slug":89,"name":90,"problem":91,"stories":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",5,{"slug":94,"name":95,"problem":96,"stories":97},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",2,[99,105,110,115,120,125,130,135],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","2","Control 2","Inventory and Control of Software Assets",13,{"family":100,"item":106,"code":107,"title":108,"together":109},"9","Control 9","Email and Web Browser Protections",11,{"family":111,"item":112,"code":113,"title":114,"together":109},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":116,"item":117,"code":118,"title":119,"together":109},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":100,"item":121,"code":122,"title":123,"together":124},"13","Control 13","Network Monitoring and Defense",10,{"family":116,"item":126,"code":127,"title":128,"together":129},"sc-7","SC-7","Boundary Protection",8,{"family":100,"item":131,"code":132,"title":133,"together":134},"14","Control 14","Security Awareness and Skills Training",7,{"family":116,"item":136,"code":137,"title":138,"together":134},"at-2","AT-2","Literacy Training and Awareness"]