tfMITRE ATT&CK sub-technique

Browser Fingerprint T1036.012

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 22 September 2025
Last modified: 12 May 2026

Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Browser Fingerprint MITRE reference T1036.012

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

FatDukeS0512 ↗

Has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.1

created 2020-09-24MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1036.012

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Browser Fingerprint detection strategy DET0898

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Spoofed User-Agent

Enterprise

3 platforms

AN2029 · Windows

Process execution without GUI context (e.g., powershell.exe, wscript.exe) generates HTTP traffic with a spoofed User-Agent mimicking a legitimate browser. No corresponding UI application (e.g., msedge.exe) is active or in parent lineage. The User-Agent deviates from known enterprise baselines or contains spoofed platform indicators. User-Agent strings can be gathered with API calls such as ShellExecuteW to open the default browser on a socket to receive an HTTP reply, or by hard coding the User-Agent string for a specific browser.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	API Calls
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	Inbound HTTP POST with suspicious payload size or user-agent

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HeaderSignatureMatch	Specific HTTP header anomalies or patterns (e.g., spoofed User-Agent).
UserAgentFingerprint	Flag browser-based sessions
NonBrowserProcessList	List of non-browser binaries expected not to initiate web requests (e.g., powershell.exe, cscript.exe)

AN2031 · Linux

Detection of HTTP outbound requests with inconsistent or spoofed User-Agent headers from command-line tools (e.g., curl, wget, python requests) following interactive user shells or scheduled jobs outside of normal user session behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Connection CreationDC0082	auditd:SYSCALL	outbound connections
Network Traffic ContentDC0085	NSM:Flow	http.log, conn.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HeaderSignatureMatch	Specific HTTP header anomalies or patterns (e.g., spoofed User-Agent).
UserAgentFingerprint	Flag browser-based sessions

AN2032 · macOS

Observation of scripted network requests (e.g., using osascript, curl, or python) that include mismatched or spoofed browser User-Agent strings compared to the typical macOS Safari or Chrome baseline, especially when triggered by non-interactive launch agents, login hooks, or background daemons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec logs
Network Connection CreationDC0082	macos:unifiedlog	network connection events
Network Traffic ContentDC0085	NSM:Flow	Inbound HTTP POST with suspicious payload size or user-agent

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAgentFingerprint	Flag browser-based sessions
HeaderSignatureMatch	Specific HTTP header anomalies or patterns (e.g., spoofed User-Agent).

Browser Fingerprint detections T1036.012

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs