1. Home
  2. ATT&CK Techniques
  3. T1036 Masquerading

T1036 Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.AE-02.01 Event analysis and detection Mitigates T1036 Masquerading
Comments
This diagnostic statement provides for implementation of methods to block similar future attacks via security tools such as antivirus and IDS/IPS to provide protection against threats and exploitation attempts.
References
    PR.IR-01.08 End-user device access Mitigates T1036 Masquerading
    Comments
    This diagnostic statement implements technical controls (e.g., VPN, antivirus software) to address the risks of end-user personal computing devices accessing the organization’s network and resources.
    References
      PR.PS-01.01 Configuration baselines Mitigates T1036 Masquerading
      Comments
      This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation.
      References
        PR.PS-01.08 End-user device protection Mitigates T1036 Masquerading
        Comments
        This diagnostic statement provides protections for endpoints from masquerading or manipulated artifacts through configuration requirements, connection requirements, and other mechanisms to protect network, application, and data integrity.
        References
          DE.CM-09.01 Software and data integrity checking Mitigates T1036 Masquerading
          Comments
          This diagnostic statement protects against Masquerading through the use of verifying integrity of software/firmware, loading software that is trusted, ensuring privileged process integrity and checking software signatures.
          References
            PR.PS-05.01 Malware prevention Mitigates T1036 Masquerading
            Comments
            Antivirus/Antimalware software can be utilized to detect and quarantine suspicious files that adversaries have manipulated to appear legitimate or benign.
            References
              DE.CM-01.01 Intrusion detection and prevention Mitigates T1036 Masquerading
              Comments
              Implementing methods similar to Host Intrusion prevention (HIPS) can identify and prevent execution of malicious files and its metadata manipulated by adversaries.
              References
                PR.PS-01.03 Configuration deviation Mitigates T1036 Masquerading
                Comments
                This diagnostic statement provides protection from Masquerading through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baselining and integrity checking can help protect against adversaries attempting to compromise and modify software and its configurations.
                References
                  PR.PS-05.02 Mobile code prevention Mitigates T1036 Masquerading
                  Comments
                  Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
                  References
                    EX.DD-04.01 Third-party systems and software evaluation Mitigates T1036 Masquerading
                    Comments
                    This diagnostic statement describes the organization's formal process for evaluating externally-sourced applications, software, and firmware by assessing compatibility, security, integrity, and authenticity before deployment and after major changes. For example, requiring software from external vendors to be signed with valid certificates before deployment to aid in mitigating software supply chain attacks.
                    References
                      PR.AA-01.01 Identity and credential management Mitigates T1036 Masquerading
                      Comments
                      This diagnostic statement protects against Masquerading through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                      References
                        PR.PS-01.08 End-user device protection Mitigates T1036 Masquerading
                        Comments
                        This diagnostic statement protects against Masquerading through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                        References

                          NIST 800-53 Mappings

                          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                          CA-07 Continuous Monitoring mitigates T1036 Masquerading
                          CM-06 Configuration Settings mitigates T1036 Masquerading
                          IA-09 Service Identification and Authentication mitigates T1036 Masquerading
                          IA-09 Service Identification and Authentication mitigates T1036 Masquerading
                          SI-10 Information Input Validation mitigates T1036 Masquerading
                          SI-03 Malicious Code Protection mitigates T1036 Masquerading
                          SI-07 Software, Firmware, and Information Integrity mitigates T1036 Masquerading
                          CM-02 Baseline Configuration mitigates T1036 Masquerading
                          CM-07 Least Functionality mitigates T1036 Masquerading
                          SI-04 System Monitoring mitigates T1036 Masquerading
                          AC-02 Account Management mitigates T1036 Masquerading
                          AC-03 Access Enforcement mitigates T1036 Masquerading
                          AC-06 Least Privilege mitigates T1036 Masquerading

                          VERIS Mappings

                          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                          action.hacking.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
                          action.malware.variety.Disable controls Disable or interfere with security controls related-to T1036 Masquerading
                          action.malware.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading
                          action.malware.vector.Email attachment Email via user-executed attachment. Child of 'Email' related-to T1036 Masquerading
                          action.social.variety.Evade Defenses Modification of the action (rather than the system, as in 'Disable controls') to avoid detection. related-to T1036 Masquerading

                          Azure Mappings

                          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                          defender_for_app_service Microsoft Defender for Cloud: Defender for App Service technique_scores T1036 Masquerading
                          Comments
                          This control only addresses a minority of this technique's procedure examples and one of its sub-techniques resulting in an overall Minimal score.
                          References
                          1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference
                          2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction
                          3. https://azure.microsoft.com/en-us/services/app-service/
                          4. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers

                          GCP Mappings

                          Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                          google_secops Google Security Operations technique_scores T1036 Masquerading
                          Comments
                          Google Security Operations is able to trigger an alert based on Windows starting uncommon processes (e.g., Detects Winword starting uncommon sub process MicroScMgmt.exe used for CVE-2015-1641). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/proactive_exploit_detection/process_creation/exploit_for_cve_2015_1641.yaral
                          References
                          1. ['https://cloud.google.com/security/products/security-operations'
                          2. 'https://cloud.google.com/chronicle/docs/secops/secops-overview'
                          3. 'https://github.com/chronicle/detection-rules']

                          ATT&CK Subtechniques

                          Technique ID Technique Name Number of Mappings
                          T1036.007 Double File Extension 10
                          T1036.005 Match Legitimate Name or Location 17
                          T1036.008 Masquerade File Type 20
                          T1036.009 Break Process Trees 2
                          T1036.004 Masquerade Task or Service 1
                          T1036.001 Invalid Code Signature 11
                          T1036.003 Rename System Utilities 9
                          T1036.010 Masquerade Account Name 7