Skip to content

T1036 Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.1

Item Value
ID T1036
Sub-techniques T1036.001, T1036.002, T1036.003, T1036.004, T1036.005, T1036.006, T1036.007
Tactics TA0005
CAPEC ID CAPEC-177
Platforms Containers, Linux, Windows, macOS
Version 1.4
Created 31 May 2017
Last Modified 18 October 2021

Procedure Examples

ID Name Description
S0622 AppleSeed AppleSeed can disguise JavaScript files as PDFs.21
G0007 APT28 APT28 has renamed the WinRAR utility to avoid detection.31
G0016 APT29 APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.34
G0050 APT32 APT32 has disguised a Cobalt Strike beacon as a Flash Installer.43
S0268 Bisonal Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.22
S0635 BoomBox BoomBox has the ability to mask malicious data strings as PDF files.12
G0060 BRONZE BUTLER BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.42
S0497 Dacls The Dacls Mach-O binary has been disguised as a .nib file.15
S0673 DarkWatchman DarkWatchman has used an icon mimicking a text file to mask a malicious executable.19
G0035 Dragonfly Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.36
S0634 EnvyScout EnvyScout has used folder icons for malicious files to lure victims into opening them.12
S0512 FatDuke FatDuke has attempted to mimic a compromised user’s traffic by using the same user agent as the installed browser.24
S0696 Flagpro Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.9
S0661 FoggyWeb FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.27
G0094 Kimsuky Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.33
G0032 Lazarus Group Lazarus Group has disguised malicious template files as JPEG files to avoid detection.40
G0140 LazyScripter LazyScripter has used several different security software icons to disguise executables.37
G0045 menuPass menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.39
S0637 NativeZone NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.10
G0133 Nomadic Octopus Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.35
S0368 NotPetya NotPetya drops PsExec with the filename dllhost.dat.26
G0049 OilRig OilRig has used .doc file extensions to mask malicious executables.41
G0068 PLATINUM PLATINUM has renamed rar.exe to avoid detection.32
S0650 QakBot The QakBot payload has been disguised as a PNG file.7
S0565 Raindrop Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.1718
S0458 Ramsay Ramsay has masqueraded as a JPG image file.16
S0662 RCSession RCSession has used a file named English.rtf to appear benign on victim hosts.1314
S0148 RTM RTM has been delivered as archived Windows executable files masquerading as PDF documents.23
S0446 Ryuk Ryuk can create .dll files that actually contain a Rich Text File format document.5
S0615 SombRAT SombRAT can use a legitimate process name to hide itself.20
G0127 TA551 TA551 has masked malware DLLs as dat and jpg files.38
S0682 TrailBlazer TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.11
S0266 TrickBot The TrickBot downloader has used an icon to appear as a Microsoft Word document.4
S0609 TRITON TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.25
S0689 WhisperGate WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.6
G0112 Windshift Windshift has used icons mimicking MS Office files to mask malicious executables.28 Windshift has also attempted to hide executables by changing the file extension to “.scr” to mimic Windows screensavers.44
S0466 WindTail WindTail has used icons mimicking MS Office files to mask payloads.28
S0658 XCSSET XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist. 8
G0128 ZIRCONIUM ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.2930

Mitigations

ID Mitigation Description
M1045 Code Signing Require signed binaries.
M1038 Execution Prevention Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
M1022 Restrict File and Directory Permissions Use file system access controls to protect folders such as C:\Windows\System32.

Detection

ID Data Source Data Component
DS0017 Command Command Execution
DS0022 File File Metadata
DS0007 Image Image Metadata
DS0009 Process Process Metadata
DS0003 Scheduled Job Scheduled Job Metadata
DS0019 Service Service Creation

References

  1. LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020. ↩

  2. Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016. ↩

  3. Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019. ↩

  4. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020. ↩

  5. ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021. ↩

  6. S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022. ↩

  7. Group IB. (2020, September). LOCK LIKE A PRO. Retrieved September 27, 2021. ↩

  8. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021. ↩

  9. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022. ↩

  10. Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021. ↩

  11. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. ↩

  12. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021. ↩↩

  13. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021. ↩

  14. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021. ↩

  15. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020. ↩

  16. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. ↩

  17. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021. ↩

  18. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021. ↩

  19. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022. ↩

  20. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. ↩

  21. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021. ↩

  22. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. ↩

  23. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. ↩

  24. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. ↩

  25. Johnson, B, et. al. (2017, December 14). Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021. ↩

  26. Chiu, A. (2016, June 27). New Ransomware Variant “Nyetya” Compromises Systems Worldwide. Retrieved March 26, 2019. ↩

  27. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021. ↩

  28. Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift’s implant: OSX.WindTail (part 1). Retrieved October 3, 2019. ↩↩

  29. Huntley, S. (2020, October 16). How We’re Tackling Evolving Online Threats. Retrieved March 24, 2021. ↩

  30. Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021. ↩

  31. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021. ↩

  32. Carr, N.. (2018, October 25). Nick Carr Status Update. Retrieved April 22, 2019. ↩

  33. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022. ↩

  34. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021. ↩

  35. Kaspersky Lab’s Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018. ↩

  36. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  37. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021. ↩

  38. Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021. ↩

  39. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018. ↩

  40. Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021. ↩

  41. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021. ↩

  42. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020. ↩

  43. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018. ↩

  44. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021. ↩

Back to top