MITRE ATT&CKtechnique

T1036 Masquerading

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Containers, ESXi, Linux, macOS, Windows
Version
2.0
Created
2017-05-31

Description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (8)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1045 Code Signing mitigation
  • M1047 Audit mitigation
  • M1049 Antivirus/Antimalware mitigation
  • M1017 User Training mitigation
  • M1018 User Account Management mitigation
  • M1022 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · subtechnique of (12)

  • T1036.012 Browser Fingerprint sub-technique
  • T1036.011 Overwrite Process Arguments sub-technique
  • T1036.010 Masquerade Account Name sub-technique
  • T1036.009 Break Process Trees sub-technique
  • T1036.008 Masquerade File Type sub-technique
  • T1036.007 Double File Extension sub-technique
  • T1036.001 Invalid Code Signature sub-technique
  • T1036.002 Right-to-Left Override sub-technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1036.006 Space after Filename sub-technique

Referenced by MITRE ATT&CK · uses (61)

  • G1058 The Gentlemen group
  • S9038 DynoWiper software (malware)
  • S9010 GlassWorm software (malware)
  • C0059 Salesforce Data Exfiltration campaign
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1240 RedLine Stealer software (malware)
  • G1046 Storm-1811 group
  • C0046 ArcaneDoor campaign
  • S1183 StrelaStealer software (malware)
  • S1164 UPSTYLE software (malware)
  • G1035 Winter Vivern group
  • C0035 KV Botnet Activity campaign
  • G1030 Agrius group
  • S1111 DarkGate software (malware)
  • G1016 FIN13 group
  • S1066 DarkTortilla software (malware)
  • C0018 C0018 campaign
  • C0015 C0015 campaign
  • C0016 Operation Dust Storm campaign
  • S1046 PowGoop software (malware)
  • C0006 Operation Honeybee campaign
  • G1007 Aoqin Dragon group
  • G1003 Ember Bear group
  • S1018 Saint Bot software (malware)
  • S1015 Milan software (malware)
  • S0696 Flagpro software (malware)
  • S0689 WhisperGate software (malware)
  • S0682 TrailBlazer software (malware)
  • S0673 DarkWatchman software (malware)
Show all 61 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-177 Create files with the same name as files protected with a higher classification attack pattern

Referenced by Compliance · mitigates (14)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-9.7 Deploy and Maintain Email Server Anti-Malware Protections CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References