Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.[1]
Top 8%of all ATT&CK techniques for number of groups
20 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has delivered BeaverTail malware masquerading as legitimate software or applications.12345Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.6
created 2025-10-196 referencesaka DeceptiveDevelopment
Has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.1
During Salesforce Data Exfiltration, threat actors used voice calls to socially engineer victims into authorizing a modified version of the Salesforce Data Loader app.1
Involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.1
During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.1
2017–2018
All 7 campaigns for this technique · 6 newest in this preview
33 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.1
Malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.1
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy
Enterprise
5 platforms
AN0355 · Windows
Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
OriginalFilenameMismatch
Compare executable file name with PE metadata OriginalFilename field
KnownSystemUtilityPaths
Tune based on expected installation directories for signed binaries
TimeWindow
Correlation window between file creation and service/process execution
AN0356 · Linux
Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
DropLocationPattern
Directories where new binaries are suspicious (e.g., /tmp)
FilenameAnomalies
Regex for Unicode/RLO/space abuse in filenames
ExecutionDelayWindow
Time range between file write and execution used for joining
AN0357 · macOS
Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
InfoPlistDiscrepancy
Mismatch between bundle metadata and file system path/name
LaunchAgentPath
Unusual LaunchDaemon/LaunchAgent paths can be tuned per org
ExecutionTrigger
Window between install and first execution (e.g., at user login)
AN0358 · Containers
Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ImageLabelMismatch
Tune detection based on mismatch between image name and labels
StartupScriptLocation
Detect binaries added or modified in startup path (e.g., /entrypoint.sh)
ProcessNamePattern
Allow tuning based on suspicious binary naming inside containers
AN0359 · ESXi
Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ServiceNameBaseline
Tune based on default service names vs. suspicious new entries
ScriptFilePath
Watch for new binaries/scripts in boot or cron folders
ExecutionContext
Determine if execution happens at boot or scheduled interval
1 analytic
In Windows, files should never execute out of certain directory locations. Any of these locations may exist for a variety of reasons, and executables may be present in the directory but should not execute. As a result, some defenders make the mistake of ignoring these directories and assuming that a process will never run from one. There are known TTPs that have taken advantage of this fact to go undetected. This fact should inform defenders to monitor these directories more closely, knowing that they should never contain running processes.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
The RECYCLER and SystemVolumeInformation directories will be present on every drive. Replace %systemroot% and %windir% with the actual paths as configured by the endpoints.
processes = search Process:Create
suspicious_locations = filter process where (
image_path == "*:\RECYCLER\*" or
image_path == "*:\SystemVolumeInformation\*" or
image_path == "%windir%\Tasks\*" or
image_path == "%systemroot%\debug\*"
)
output suspicious_locations
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\:\\recycler\\|\:\\systemvolumeinformation\\|\%windir\%\\tasks\\|\%systemroot\%\\debug\\).*)i group count_unique $App limit 100
Sigma version of the above pseudocode, with some modifications.
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*:\RECYCLER\*", "*:\SystemVolumeInformation\*", "C:\Windows\Tasks\*", "C:\Windows\System32\debug\*"]
Unit tests
CAR’s own validation procedures for this analytic.
- Typically %systemroot% is C:\\Windows but you can check this by running "echo %systemdrive%" at the command line.
- Copy C:\\Windows\\system32\\notepad to C:\\Windows\\Tasks.
- Run notepad. The analytic should fire.
- Delete the executable to clean up from the test.
Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.
Tests2Executorspowershell 2Need elevation0 of 2Have prerequisites1Have cleanup2Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
System File Copied to Unusual Location
windows
powershell
—
—
Yes
It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.
When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique as reported here
The following analytic detects the creation or overwrite of commonly targeted Linux system binaries such as cat, ls, cp, ps, mv, netstat, ss, and lsof. (...)
The following analytic detects the creation of sensitive system files such as nsswitch.conf, passwd, shadow, sudoers, and NSS shared libraries outside of their canonical /etc or /var/lib/docker paths. (...)
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.
Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth. (...)
The following analytic identifies the execution of msdtc.exe with specific command-line parameters (-a or -b), which are indicative of the PlugX malware. (...)
The following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool by any process on a Windows system. (...)
Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. (...)