1. Home
  2. ATT&CK Techniques
  3. T1036 Masquerading

T1036 Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1036 Masquerading
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-01.08 End-user device access Mitigates T1036 Masquerading
    Comments
    This diagnostic statement implements technical controls (e.g., VPN, antivirus software) to address the risks of end-user personal computing devices accessing the organization’s network and resources.
    References
      PR.PS-01.01 Configuration baselines Mitigates T1036 Masquerading
      Comments
      This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
      References
        DE.CM-09.01 Software and data integrity checking Mitigates T1036 Masquerading
        Comments
        This diagnostic statement protects against Masquerading through the use of verifying integrity of software/firmware, loading software that is trusted, ensuring privileged process integrity and checking software signatures.
        References
          PR.PS-05.01 Malware prevention Mitigates T1036 Masquerading
          Comments
          Antivirus/Antimalware software can be utilized to detect and quarantine suspicious files that adversaries have manipulated to appear legitimate or benign.
          References
            DE.CM-01.01 Intrusion detection and prevention Mitigates T1036 Masquerading
            Comments
            Implementing methods similar to Host Intrusion prevention (HIPS) can identify and prevent execution of malicious files and its metadata manipulated by adversaries.
            References
              PR.PS-01.03 Configuration deviation Mitigates T1036 Masquerading
              Comments
              This diagnostic statement provides protection from Masquerading through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baselining and integrity checking can help protect against adversaries attempting to compromise and modify software and its configurations.
              References
                PR.PS-05.02 Mobile code prevention Mitigates T1036 Masquerading
                Comments
                Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
                References
                  EX.DD-04.01 Third-party systems and software evaluation Mitigates T1036 Masquerading
                  Comments
                  This diagnostic statement describes the organization's formal process for evaluating externally-sourced applications, software, and firmware by assessing compatibility, security, integrity, and authenticity before deployment and after major changes. For example, requiring software from external vendors to be signed with valid certificates before deployment to aid in mitigating software supply chain attacks.
                  References
                    PR.AA-01.01 Identity and credential management Mitigates T1036 Masquerading
                    Comments
                    This diagnostic statement protects against Masquerading through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                    References
                      PR.PS-01.08 End-user device protection Mitigates T1036 Masquerading
                      Comments
                      This diagnostic statement protects against Masquerading through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                      References

                        NIST 800-53 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        CA-07 Continuous Monitoring mitigates T1036 Masquerading
                        CM-06 Configuration Settings mitigates T1036 Masquerading
                        IA-09 Service Identification and Authentication mitigates T1036 Masquerading
                        IA-09 Service Identification and Authentication mitigates T1036 Masquerading
                        SI-10 Information Input Validation mitigates T1036 Masquerading
                        SI-03 Malicious Code Protection mitigates T1036 Masquerading
                        SI-07 Software, Firmware, and Information Integrity mitigates T1036 Masquerading
                        CM-02 Baseline Configuration mitigates T1036 Masquerading
                        CM-07 Least Functionality mitigates T1036 Masquerading
                        SI-04 System Monitoring mitigates T1036 Masquerading
                        AC-02 Account Management mitigates T1036 Masquerading
                        AC-03 Access Enforcement mitigates T1036 Masquerading
                        AC-06 Least Privilege mitigates T1036 Masquerading

                        VERIS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
                        action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036 Masquerading
                        action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
                        action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1036 Masquerading
                        action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        microsoft_sentinel Microsoft Sentinel technique_scores T1036 Masquerading
                        Comments
                        This control provides minimal to partial coverage of a minority of this technique's sub-techniques and a minority of its procedure examples, resulting in an overall score of Minimal.
                        References
                        1. https://learn.microsoft.com/en-us/azure/sentinel/overview
                        2. https://learn.microsoft.com/en-us/azure/sentinel/hunting
                        defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1036 Masquerading
                        Comments
                        This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score.
                        References
                        1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference
                        2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
                        3. https://azure.microsoft.com/en-us/services/app-service/
                        4. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers

                        GCP Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        google_secops Google Security Operations technique_scores T1036 Masquerading
                        Comments
                        Google Security Operations is able to trigger an alert based on Windows starting uncommon processes (e.g., Detects Winword starting uncommon sub process MicroScMgmt.exe used for CVE-2015-1641). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/process_creation/exploit_for_cve_2015_1641.yaral
                        References
                        1. ['https://cloud.google.com/security/products/security-operations'
                        2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
                        3. 'https://github.com/chronicle/detection-rules']

                        ATT&CK Subtechniques

                        Technique ID Technique Name Number of Mappings
                        T1036.007 Double File Extension 10
                        T1036.005 Match Legitimate Name or Location 18
                        T1036.008 Masquerade File Type 19
                        T1036.009 Break Process Trees 2
                        T1036.004 Masquerade Task or Service 2
                        T1036.001 Invalid Code Signature 11
                        T1036.003 Rename System Utilities 9
                        T1036.010 Masquerade Account Name 7