T1036 Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1036 Masquerading
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-01.08 End-user device access Mitigates T1036 Masquerading
    Comments
    This diagnostic statement implements technical controls (e.g., VPN, antivirus software) to address the risks of end-user personal computing devices accessing the organization’s network and resources.
    References
      PR.PS-01.01 Configuration baselines Mitigates T1036 Masquerading
      Comments
      This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
      References
        DE.CM-09.01 Software and data integrity checking Mitigates T1036 Masquerading
        Comments
        This diagnostic statement protects against Masquerading through the use of verifying integrity of software/firmware, loading software that is trusted, ensuring privileged process integrity and checking software signatures.
        References
          PR.PS-05.01 Malware prevention Mitigates T1036 Masquerading
          Comments
          Antivirus/Antimalware software can be utilized to detect and quarantine suspicious files that adversaries have manipulated to appear legitimate or benign.
          References
            DE.CM-01.01 Intrusion detection and prevention Mitigates T1036 Masquerading
            Comments
            Implementing methods similar to Host Intrusion prevention (HIPS) can identify and prevent execution of malicious files and its metadata manipulated by adversaries.
            References
              PR.PS-01.03 Configuration deviation Mitigates T1036 Masquerading
              Comments
              This diagnostic statement provides protection from Masquerading through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baselining and integrity checking can help protect against adversaries attempting to compromise and modify software and its configurations.
              References
                PR.PS-05.02 Mobile code prevention Mitigates T1036 Masquerading
                Comments
                Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
                References
                  EX.DD-04.01 Third-party systems and software evaluation Mitigates T1036 Masquerading
                  Comments
                  This diagnostic statement describes the organization's formal process for evaluating externally-sourced applications, software, and firmware by assessing compatibility, security, integrity, and authenticity before deployment and after major changes. For example, requiring software from external vendors to be signed with valid certificates before deployment to aid in mitigating software supply chain attacks.
                  References
                    PR.AA-01.01 Identity and credential management Mitigates T1036 Masquerading
                    Comments
                    This diagnostic statement protects against Masquerading through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                    References
                      PR.PS-01.08 End-user device protection Mitigates T1036 Masquerading
                      Comments
                      This diagnostic statement protects against Masquerading through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                      References

                        NIST 800-53 Mappings

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        microsoft_sentinel Microsoft Sentinel technique_scores T1036 Masquerading
                        Comments
                        This control provides minimal to partial coverage of a minority of this technique's sub-techniques and a minority of its procedure examples, resulting in an overall score of Minimal.
                        References
                        defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1036 Masquerading

                        GCP Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        google_secops Google Security Operations technique_scores T1036 Masquerading
                        Comments
                        Google Security Operations is able to trigger an alert based on Windows starting uncommon processes (e.g., Detects Winword starting uncommon sub process MicroScMgmt.exe used for CVE-2015-1641). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/process_creation/exploit_for_cve_2015_1641.yaral
                        References

                        M365 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        EOP-AMW-E3 Antimalware Technique Scores T1036 Masquerading
                        Comments
                        In Microsoft 365 organizations with mailboxes in Exchange Online or standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, email messages are automatically protected against malware by EOP. Some of the major categories of malware are: Viruses that infect other programs and data, and spread through your computer or network looking for programs to infect. Spyware that gathers your personal information, such as sign-in information and personal data, and sends it back to its author. Ransomware that encrypts your data and demands payment to decrypt it. Anti-malware software doesn't help you decrypt encrypted files, but it can detect the malware payload that's associated with the ransomware. EOP offers multi-layered malware protection that's designed to catch all known malware in Windows, Linux, and Mac that travels into or out of your organization. The following options help provide anti-malware protection: Layered defenses against malware: Multiple anti-malware scan engines help protect against both known and unknown threats. These engines include powerful heuristic detection to provide protection even during the early stages of a malware outbreak. This multi-engine approach has been shown to provide significantly more protection than using just one anti-malware engine. Real-time threat response: During some outbreaks, the anti-malware team might have enough information about a virus or other form of malware to write sophisticated policy rules that detect the threat, even before a definition is available from any of the scan engines used by the service. These rules are published to the global network every 2 hours to provide your organization with an extra layer of protection against attacks. Fast anti-malware definition deployment: The anti-malware team maintains close relationships with partners who develop anti-malware engines. As a result, the service can receive and integrate malware definitions and patches before they're publicly released. Our connection with these partners often allows us to develop our own remedies as well. The service checks for updated definitions for all anti-malware engines every hour. License Requirements: M365 E3 or Microsoft Defender for Office plan 1.
                        References
                        DEF-QUAR-E3 Quarantine Policies Technique Scores T1036 Masquerading
                        Comments
                        In Exchange Online Protection (EOP) and Microsoft Defender for Office 365, quarantine policies allow admins to define the user experience for quarantined messages. Traditionally, users have been allowed or denied levels of interactivity with quarantine messages based on why the message was quarantined. For example, users can view and release messages that were quarantined as spam or bulk, but they can't view or release messages that were quarantined as high confidence phishing or malware. The following M365 features are supported by quarantine policies, “Response” to Anti-malware and Anti-Phishing tagged items. Files that are quarantined as malware by Safe Attachments for SharePoint, OneDrive, and Microsoft Teams. License requirements: M365 E3 (or Defender for Office plan 1)
                        References
                        DEF-ZHAP-E3 Zero Hour Auto Purge Technique Scores T1036 Masquerading
                        Comments
                        Zero-hour auto purge (ZAP) is a protection feature in Exchange Online Protection (EOP) that retroactively detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to Exchange Online mailboxes. With the E5 licensing or Office Plan 2, ZAP is also able to retroactively detect existing malicious chat messages in Microsoft Teams that are identified as malware or high confidence phishing. License Requirements: ZAP for Defender O365 is included with M365's E3 and requires E5 when leveraging ZAP for Teams security.
                        References
                        DEF-AACI-E3 Adaptive Application Control Integration Technique Scores T1036 Masquerading
                        Comments
                        This control provides detection for some of this technique's sub-techniques and procedure examples and therefore its coverage score is Partial, resulting in a Partial score. Its detection occurs once every twelve hours, so its temporal score is also Partial.
                        References
                        DEF-AACI-E3 Adaptive Application Control Integration Technique Scores T1036 Masquerading
                        Comments
                        This control provides detection for some of this technique's sub-techniques and procedure examples and therefore its coverage score is Partial, resulting in a Partial score. Its detection occurs once every twelve hours, so its temporal score is also Partial.
                        References

                        ATT&CK Subtechniques

                        Technique ID Technique Name Number of Mappings
                        T1036.007 Double File Extension 11
                        T1036.005 Match Legitimate Name or Location 20
                        T1036.008 Masquerade File Type 20
                        T1036.009 Break Process Trees 3
                        T1036.004 Masquerade Task or Service 2
                        T1036.001 Invalid Code Signature 13
                        T1036.003 Rename System Utilities 9
                        T1036.010 Masquerade Account Name 9
                        T1036.006 Space after Filename 2