MirrorFaceG1054 ↗
Has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.1
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 08 March 2023
- Last modified
- 12 May 2026
- Contributors
- Ben Smith; CrowdStrike Falcon OverWatch
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either .JPE, .JPEG or .JPG.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.13
Tools & malwareTop 23%
Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Masquerade File Type MITRE reference T1036.008
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
BlackByteG1043 ↗
Masqueraded configuration files containing encryption keys as PNG files.1
Volt TyphoonG1017 ↗
Has appended copies of the ntds.dit database with a .gif file extension.1
Mustang PandaG0129 ↗
Has masqueraded malicious executables as legitimate files that download PlugX malware.12
All 4 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.12
2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as .txt files.1
Operation AkaiRyūC0060 ↗
During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.12
All 3 campaigns for this technique
13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PureCrypterS9019 ↗
Has used a .NET downloader named 63342221.BAT and has used .jpg, .png, and .log as false extensions for malicious files.1
HeartCryptS9018 ↗
Can append a BMP header to encoded malicious payloads to masquerade them as BMP files.1
STATICPLUGINS1238 ↗
Has masqueraded as a BMP file to hide its true MSI file extension.1
Lumma StealerS1213 ↗
Has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.1
KapekaS1190 ↗
Masquerades as a Microsoft Word Add-In file, with the extension .wll, but is a malicious DLL file.12
StrelaStealerS1183 ↗
All 13 software entries for this technique · 6 newest in this preview
Offense vs defense T1036.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 3
first rule: 2020 Q2 · 1 of 3 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016), Operation AkaiRyū (dated 2004) fall before the 2017 window)Masquerade File Type detection strategy DET0226
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Masquerading via File Type Modification
3 platforms
AN0630 · Windows
Detects behavior where files with non-executable or misleading extensions (e.g., .jpg, .txt) are created or modified but subsequently executed as binaries based on internal file headers or abnormal parent process lineage. This includes identifying polyglot files or malformed magic bytes indicative of masquerading attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| benign_extensions | List of non-executable file types commonly used to mask payloads (.jpg, .txt, .gif) |
| monitored_directories | Targeted directories for initial access and downloads (e.g., %TEMP%, Downloads, AppData) |
| MagicByteMismatchThreshold | Detection tolerance for mismatches between extension and file signature (magic bytes) |
| TimeWindow | Time range between file creation and first execution |
| ParentProcessAnomalyScore | Anomaly score threshold for suspicious parent-child process combinations |
AN0631 · Linux
Detects when a script or binary is named with misleading or benign-looking extensions (.jpg, .doc) and is then executed via command line or a scheduled task. Includes ELF header mismatches and content-type inconsistencies on disk.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File MetadataDC0059 | linux:osquery | Read headers and detect MIME type mismatch |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| benign_extensions | Linux-targeted masquerade extensions (.jpg, .pdf, .png) |
| HeaderInspectionEnabled | Whether to parse file signatures or MIME types from file headers |
| ExecPathScope | Monitored directory scope for adversarial execution (e.g., /tmp/, /home/username/Downloads) |
AN0632 · macOS
Detects binaries disguised as media or document types through extension-only masquerading or by modifying the file signature. Observes execution of files whose extension is not typically executable (.jpg, .txt), yet have valid Mach-O headers or execute via Terminal or launch services.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | launchservices events for misleading extensions |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LaunchAgentScope | Scope of services monitored for unusual launches (e.g., Finder, Terminal, Preview) |
| SignatureEnforcementLevel | How strictly the detection checks header validity vs. file extension |
| TimeWindow | Time range for linking file modification and execution events |
Anti-virus can be used to automatically quarantine suspicious files.
Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of files with mismatching file signatures.
Execution PreventionM1038
Ensure that input sanitization is performed and that files are validated properly before execution; furthermore, implement a strict allow list to ensure that only authorized file types are processed. Restrict and/or block execution of files where headers and extensions do not match.
Tests1Executorssh 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformslinux
Tests from Atomic Red Team (MIT licence) · technique definition