MITRE ATT&CKsub-technique

T1036.012 Browser Fingerprint

Published 2025-09-22 Modified 2026-05-12 Official page ↗

Domain: enterprise
Tactics: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 2025-09-22

Description

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent. Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.

Subtechnique of · MITRE ATT&CK (1)

T1036 Masquerading technique

Tactic · MITRE ATT&CK (1)

TA0005 Stealth tactic

Referenced by MITRE ATT&CK · mitigates (1)

M1047 Audit mitigation

Referenced by MITRE ATT&CK · uses (3)

S9061 LIGHTRAIL software (malware)
S9052 MiniFast software (malware)
S0512 FatDuke software (malware)

References

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent Mozilla User Agent
https://arxiv.org/pdf/2110.10129 Gummy Browsers Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques