MITRE ATT&CKtechnique

T1655 Masquerading

Published 2023-07-12 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android, iOS
Version
1.0
Created
2023-07-12

Description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or appearance of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading

Related

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · subtechnique of (1)

  • T1655.001 Match Legitimate Name or Location sub-technique

Referenced by MITRE ATT&CK · uses (5)

  • S9006 VajraSpy software (malware)
  • S9004 Crocodilus software (malware)
  • S1225 CherryBlos software (malware)
  • S1208 FjordPhantom software (malware)
  • S1185 LightSpy software (malware)

References