Contagious InterviewG1052 ↗
Has delivered BeaverTail malware masquerading as legitimate software or applications.12345 Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.6
tfMITRE ATT&CK technique
Masquerading T1036
- Tactic
- Stealth
- Platforms
- Containers, ESXi, Linux, macOS, Windows
- Version
- 2.0
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Bartosz Jerzman; David Lu, Tripwire; Elastic; Felipe Espósito, @Pr0teus; Menachem Goldstein; Nick Carr, Mandiant; Oleg Kolesnikov, Securonix
Sub-techniques 12131 rules across the family · 53 mapped directly to T1036 · 8 of 12 carry rules
.001Invalid Code Signature0.002Right-to-Left Override5.003Rename Legitimate Utilities37.004Masquerade Task or Service4.005Match Legitimate Resource Name or Location27.006Space after Filename1.007Double File Extension3.008Masquerade File Type4.009Break Process Trees2.010Masquerade Account Name0.011Overwrite Process Arguments0.012Browser Fingerprint0
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
20
Threat groupsTop 8%
Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.7
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.33
Tools & malwareTop 11%
Tools & malware89th percentile · 89% of ATT&CK techniques have this many tools implementing them or fewer.53
Detection rulesTop 4%
Detection rules96th percentile · 96% of ATT&CK techniques have this many detection rules written or fewer.Masquerading MITRE reference T1036
Top 8%of all ATT&CK techniques for number of groups
20 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-1811G1046 ↗
Has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.1
Winter VivernG1035 ↗
Created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.1
AgriusG1030 ↗
Used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.1
FIN13G1016 ↗
Has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.12
Aoqin DragonG1007 ↗
Has used fake icons including antivirus and external drives to disguise malicious payloads.1
All 20 groups for this technique · 6 newest in this preview
7 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
ArcaneDoorC0046 ↗
Involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances.1
KV Botnet ActivityC0035 ↗
Involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.1
C0018C0018 ↗
During C0018, AvosLocker was disguised using the victim company name as the filename.1
C0015C0015 ↗
During C0015, the threat actors named a binary file compareForfor.jpg to disguise it as a JPG file.1
Operation HoneybeeC0006 ↗
During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.1
Operation Dust StormC0016 ↗
For Operation Dust Storm, the threat actors disguised some executables as JPG files.1
All 7 campaigns for this technique · 6 newest in this preview
33 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DynoWiperS9038 ↗
Has been named after well-known files schtask.exe, schtask2.exe, and <redacted>_update.exe.12
GlassWormS9010 ↗
Has masqueraded as legitimate VSCode extensions.12 GlassWorm has also impersonated Github projects.1
BeaverTailS1246 ↗
Has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.1
RedLine StealerS1240 ↗
Malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.1
StrelaStealerS1183 ↗
PE executable payloads have used uncommon but legitimate extensions such as .com instead of .exe.1
UPSTYLES1164 ↗
Has masqueraded filenames using examples such as update.py.1
All 33 software entries for this technique · 6 newest in this preview
Offense vs defense T1036
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 40Splunk ESCU (cumulative) · 13
first rule: 2017 Q4 · 7 of 7 campaigns plottedMasquerading detection strategy DET0127
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy
5 platforms
AN0355 · Windows
Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7045 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OriginalFilenameMismatch | Compare executable file name with PE metadata OriginalFilename field |
| KnownSystemUtilityPaths | Tune based on expected installation directories for signed binaries |
| TimeWindow | Correlation window between file creation and service/process execution |
AN0356 · Linux
Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File MetadataDC0059 | linux:osquery | file_events |
| File ModificationDC0061 | linux:syslog | rename |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DropLocationPattern | Directories where new binaries are suspicious (e.g., /tmp) |
| FilenameAnomalies | Regex for Unicode/RLO/space abuse in filenames |
| ExecutionDelayWindow | Time range between file write and execution used for joining |
AN0357 · macOS
Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| Process MetadataDC0034 | macos:unifiedlog | process |
| File MetadataDC0059 | fs:fileevents | /var/log/install.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| InfoPlistDiscrepancy | Mismatch between bundle metadata and file system path/name |
| LaunchAgentPath | Unusual LaunchDaemon/LaunchAgent paths can be tuned per org |
| ExecutionTrigger | Window between install and first execution (e.g., at user login) |
AN0358 · Containers
Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Image MetadataDC0028 | docker:events | docker.events.json |
| Process CreationDC0032 | containerd:runtime | /var/log/containers/*.log |
| File ModificationDC0061 | ebpf:syscalls | file_write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ImageLabelMismatch | Tune detection based on mismatch between image name and labels |
| StartupScriptLocation | Detect binaries added or modified in startup path (e.g., /entrypoint.sh) |
| ProcessNamePattern | Allow tuning based on suspicious binary naming inside containers |
AN0359 · ESXi
Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Service MetadataDC0041 | esxi:hostd | registers services with legitimate-sounding names |
| Command ExecutionDC0064 | esxi:shell | scripts or binaries with misleading names |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ServiceNameBaseline | Tune based on default service names vs. suspicious new entries |
| ScriptFilePath | Watch for new binaries/scripts in boot or cron folders |
| ExecutionContext | Determine if execution happens at boot or scheduled interval |
1 analytic
In Windows, files should never execute out of certain directory locations. Any of these locations may exist for a variety of reasons, and executables may be present in the directory but should not execute. As a result, some defenders make the mistake of ignoring these directories and assuming that a process will never run from one. There are known TTPs that have taken advantage of this fact to go undetected. This fact should inform defenders to monitor these directories more closely, knowing that they should never contain running processes.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PSA | Process Spawn Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | image_path |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
The RECYCLER and SystemVolumeInformation directories will be present on every drive. Replace %systemroot% and %windir% with the actual paths as configured by the endpoints.
processes = search Process:Create suspicious_locations = filter process where ( image_path == "*:\RECYCLER\*" or image_path == "*:\SystemVolumeInformation\*" or image_path == "%windir%\Tasks\*" or image_path == "%systemroot%\debug\*" ) output suspicious_locations
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.*(\:\\recycler\\|\:\\systemvolumeinformation\\|\%windir\%\\tasks\\|\%systemroot\%\\debug\\).*)i group count_unique $App limit 100
Sigma version of the above pseudocode, with some modifications.
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*:\RECYCLER\*", "*:\SystemVolumeInformation\*", "C:\Windows\Tasks\*", "C:\Windows\System32\debug\*"]
Unit tests
CAR’s own validation procedures for this analytic.
- Typically %systemroot% is C:\\Windows but you can check this by running "echo %systemdrive%" at the command line. - Copy C:\\Windows\\system32\\notepad to C:\\Windows\\Tasks. - Run notepad. The analytic should fire. - Delete the executable to clean up from the test.
["copy C:\\windows\\system32\\notepad.exe C:\\windows\\tasks","start C:\\windows\\tasks\\notepad.exe","del C:\\windows\\tasks\\notepad.exe"]
Anti-virus can be used to automatically quarantine suspicious files.
AuditM1047
Audit user accounts to ensure that each one has a defined purpose.
Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).
Code SigningM1045
Require signed binaries.
Execution PreventionM1038
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
Use file system access controls to protect folders such as C:\\Windows\\System32.
Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.
User TrainingM1017
Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.
Tests2ExecutorsPowerShell 2Need elevation0 of 2Have prerequisites1Have cleanup2Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | System File Copied to Unusual Location | windows | PowerShell | — | — | Yes | ||||||||||
It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory. Attack command copy-item "$env:windir\System32\cmd.exe" -destination "$env:allusersprofile\cmd.exe" start-process "$env:allusersprofile\cmd.exe" sleep -s 5 stop-process -name "cmd" | out-null Cleanup command remove-item "$env:allusersprofile\cmd.exe" -force -erroraction silentlycontinue GUID5377bf9e-8456-46ef-88e3-eb4fa70d3350 | ||||||||||||||||
| 02 | Malware Masquerading and Execution from Zip File | windows | PowerShell | — | 1 | Yes | ||||||||||
When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique as reported here Input arguments
Attack command Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip" -DestinationPath "$env:userprofile\Downloads\T1036" -Force cd "$env:userprofile\Downloads\T1036" cmd /c "$env:userprofile\Downloads\T1036\README.cmd" >$null 2>$null Cleanup command taskkill /IM Calculator.exe /f >$null 2>$null Remove-Item "$env:userprofile\Downloads\T1036" -recurse -ErrorAction Ignore Prerequisite Zip file must be present. Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest #{url} -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip"
GUID8866d054-7f5a-40cb-8b54-f3b8a98e0bdd | ||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition