Masquerading

T1036

Technique with 12 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.

Detection rules126

Rules on DetectionCode tagged with T1036 or one of its sub-techniques.

Sigma85

Rule	Level	Log source	Technique
CreateDump Process Dump	high	windows / process_creation	T1036
File Download Via Bitsadmin To A Suspicious Target Folder	high	windows / process_creation	T1036.003
File With Suspicious Extension Downloaded Via Bitsadmin	high	windows / process_creation	T1036.003
Flash Player Update from Suspicious Location	high	NULL / proxy	T1036.005
Forfiles.EXE Child Process Masquerading	high	windows / process_creation	T1036
HackTool - XORDump Execution	high	windows / process_creation	T1036
LOL-Binary Copied From System Directory	high	windows / process_creation	T1036.003
MMC Executing Files with Reversed Extensions Using RTLO Abuse	high	windows / process_creation	T1036.002
Password Protected ZIP File Opened (Suspicious Filenames)	high	windows / NULL	T1036
Potential Defense Evasion Via Rename Of Highly Relevant Binaries	high	windows / process_creation	T1036.003
Potential Defense Evasion Via Right-to-Left Override	high	windows / process_creation	T1036.002
Potential File Extension Spoofing Using Right-to-Left Override	high	windows / file_event	T1036.002
Potential LSASS Process Dump Via Procdump	high	windows / process_creation	T1036
Potential MsiExec Masquerading	high	windows / process_creation	T1036.005
Potential SysInternals ProcDump Evasion	high	windows / process_creation	T1036
Potential WerFault ReflectDebugger Registry Value Abuse	high	windows / registry_set	T1036.003
Process Execution From A Potentially Suspicious Folder	high	windows / process_creation	T1036
Process Memory Dump Via Comsvcs.DLL	high	windows / process_creation	T1036
Remote Access Tool - Renamed MeshAgent Execution - MacOS	high	macos / process_creation	T1036.003
Remote Access Tool - Renamed MeshAgent Execution - Windows	high	windows / process_creation	T1036.003
Renamed BrowserCore.EXE Execution	high	windows / process_creation	T1036.003
Renamed CreateDump Utility Execution	high	windows / process_creation	T1036
Renamed Jusched.EXE Execution	high	windows / process_creation	T1036.003
Renamed Msdt.EXE Execution	high	windows / process_creation	T1036.003
Renamed Office Binary Execution	high	windows / process_creation	T1036.003
Renamed Plink Execution	high	windows / process_creation	T1036
Renamed ProcDump Execution	high	windows / process_creation	T1036.003
Renamed Schtasks Execution	high	windows / process_creation	T1036.003
Renamed ZOHO Dctask64 Execution	high	windows / process_creation	T1036
Scheduled Task Creation Masquerading as System Processes	high	windows / process_creation	T1036.004 T1036.005
Sdiagnhost Calling Suspicious Child Process	high	windows / process_creation	T1036
Suspicious Calculator Usage	high	windows / process_creation	T1036
Suspicious Child Process Of Wermgr.EXE	high	windows / process_creation	T1036
Suspicious Double Extension Files	high	windows / file_event	T1036.007
Suspicious Download From Direct IP Via Bitsadmin	high	windows / process_creation	T1036.003
Suspicious Download From File-Sharing Website Via Bitsadmin	high	windows / process_creation	T1036.003
Suspicious DumpMinitool Execution	high	windows / process_creation	T1036
Suspicious MSDT Parent Process	high	windows / process_creation	T1036
Suspicious Parent Double Extension File Execution	high	windows / process_creation	T1036.007
Suspicious Process Masquerading As SvcHost.EXE	high	windows / process_creation	T1036.005
Suspicious Process Parents	high	windows / process_creation	T1036
Suspicious Windows Update Agent Empty Cmdline	high	windows / process_creation	T1036
Suspicious WSL Binary Hijack via Proxy Execution	high	windows / process_creation	T1036.005
Suspicious WSL Binary Masquerading	high	windows / process_creation	T1036.005
System File Execution Location Anomaly	high	windows / process_creation	T1036
Taskmgr as LOCAL_SYSTEM	high	windows / process_creation	T1036
Uncommon Svchost Command Line Parameter	high	windows / process_creation	T1036.005
Windows Binaries Write Suspicious Extensions	high	windows / file_event	T1036
CodePage Modification Via MODE.COM To Russian Language	medium	windows / process_creation	T1036
Creation Of Pod In System Namespace	medium	kubernetes / application	T1036.005
DumpMinitool Execution	medium	windows / process_creation	T1036
Explorer Process Tree Break	medium	windows / process_creation	T1036
File Download Via Bitsadmin	medium	windows / process_creation	T1036.003
File Download Via Bitsadmin To An Uncommon Target Folder	medium	windows / process_creation	T1036.003
Files With System DLL Name In Unsuspected Locations	medium	windows / file_event	T1036.005
Files With System Process Name In Unsuspected Locations	medium	windows / file_event	T1036.005
Findstr Launching .lnk File	medium	windows / process_creation	T1036
Interactive Bash Suspicious Children	medium	linux / process_creation	T1036
Masquerading as Linux Crond Process	medium	linux / NULL	T1036.003
New or Renamed User Account with '$' Character	medium	windows / NULL	T1036
Potential Binary Impersonating Sysinternals Tools	medium	windows / process_creation	T1036.005
Potential Command Line Path Traversal Evasion Attempt	medium	windows / process_creation	T1036
Potential Defense Evasion Via Binary Rename	medium	windows / process_creation	T1036.003
Potential Fake Instance Of Hxtsr.EXE Executed	medium	windows / process_creation	T1036
Potential Homoglyph Attack Using Lookalike Characters	medium	windows / process_creation	T1036 T1036.003
Potential Homoglyph Attack Using Lookalike Characters in Filename	medium	windows / file_event	T1036 T1036.003
Potential PendingFileRenameOperations Tampering	medium	windows / registry_set	T1036.003
Potential ReflectDebugger Content Execution Via WerFault.EXE	medium	windows / process_creation	T1036
Potential WSL Binary Modification from Installed Location	medium	windows / file_event	T1036.005
Potentially Suspicious Execution From Tmp Folder	medium	linux / process_creation	T1036
Procdump Execution	medium	windows / process_creation	T1036
PUA - Potential PE Metadata Tamper Using Rcedit	medium	windows / process_creation	T1036 T1036.003
Suspicious CodePage Switch Via CHCP	medium	windows / process_creation	T1036
Suspicious Copy From or To System Directory	medium	windows / process_creation	T1036.003
Suspicious Files in Default GPO Folder	medium	windows / file_event	T1036.005
Suspicious LNK Double Extension File Created	medium	windows / file_event	T1036.007
Suspicious Process Start Locations	medium	windows / process_creation	T1036
Suspicious Scheduled Task Creation via Masqueraded XML File	medium	windows / process_creation	T1036.005
Suspicious Start-Process PassThru	medium	windows / ps_script	T1036.003
Uncommon Svchost Parent Process	medium	windows / process_creation	T1036.005
Unsigned .node File Loaded	medium	windows / image_load	T1036.005
New Process Created Via Taskmgr.EXE	low	windows / process_creation	T1036
Renamed Powershell Under Powershell Channel	low	windows / ps_classic_start	T1036.003
Space After Filename - macOS	low	macos / process_creation	T1036.006
Windows Processes Suspicious Parent Directory	low	windows / process_creation	T1036.003 T1036.005

Splunk41

Rule	Type	Risk	Data source	Technique
Attacker Tools On Endpoint	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1036.005
Cisco NVM - Non-Network Binary Making Network Connection	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1036
Detect RTLO In File Name	TTP	NULL	Sysmon EventID 11	T1036.002
Detect RTLO In Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.002
Email Attachments With Lots Of Spaces	Anomaly	NULL		T1036.008
Executables Or Script Creation In Suspicious Path	Anomaly	NULL	Sysmon EventID 11	T1036
Executables Or Script Creation In Temp Path	Anomaly	NULL	Sysmon EventID 11	T1036
Execution of File with Multiple Extensions	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Execution of File With Spaces Before Extension	TTP	NULL	Sysmon EventID 1	T1036.003
Linux Kworker Process In Writable Process Path	Hunting	NULL	Sysmon for Linux EventID 1	T1036.004
Linux Possible System Binary Backdoor	Anomaly	NULL	Sysmon for Linux EventID 11	T1036
Linux Suspicious Staging of Alternate System Files	Anomaly	NULL	Sysmon for Linux EventID 11	T1036
Suspicious Copy on System32	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Suspicious microsoft workflow compiler rename	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Suspicious msbuild path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Suspicious MSBuild Rename	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Suspicious Process Executed From Container File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.008
Suspicious Rundll32 Rename	Hunting	NULL	Sysmon EventID 1	T1036.003
Suspicious writes to System Volume Information	Hunting	NULL	Sysmon EventID 1	T1036
Suspicious writes to windows Recycle Bin	TTP	NULL	Sysmon EventID 1 AND Sysmon EventID 11	T1036
System Processes Run From Unexpected Locations	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Windows Bluetooth Service Installed From Uncommon Location	Anomaly	NULL	Windows Event Log System 7045	T1036
Windows Builtin Account Name Was Changed	TTP	NULL	Windows Event Log Security 4781	T1036.010
Windows Debugger Tool Execution	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036
Windows DotNet Binary in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Windows Executable Masquerading as Benign File Types	Anomaly	NULL	Sysmon EventID 29	T1036.008
Windows InstallUtil in Non Standard Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Windows LOLBAS Executed As Renamed File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.003
Windows LOLBAS Executed Outside Expected Path	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1036.005
Windows Masquerading Msdtc Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036
Windows MSC EvilTwin Directory Path Manipulation	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.005
Windows NetSupport RMM DLL Loaded By Uncommon Process	Anomaly	NULL	Sysmon EventID 7	T1036
Windows Process Execution From ProgramData	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.005
Windows Process Execution in Temp Dir	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.005
Windows Renamed Powershell Execution	TTP	NULL	Sysmon EventID 1	T1036.003
Windows SoftEther VPN Masquerading as Legitimate Binary	TTP	NULL	Sysmon EventID 1	T1036
Windows Suspicious Process File Path	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1036.005
Windows Suspicious QEMU Execution	TTP	NULL	Sysmon EventID 1	T1036
Windows Svchost.exe Parent Process Anomaly	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1036.009
Windows TinyCC Shellcode Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1036
Windows Unusual SysWOW64 Process Run System32 Executable	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1036.009

Sub-techniques12

ID	Name	Examples
T1036.001	Invalid Code Signature	9
T1036.002	Right-to-Left Override	5
T1036.003	Rename Legitimate Utilities	11
T1036.004	Masquerade Task or Service	93
T1036.005	Match Legitimate Resource Name or Location	221
T1036.006	Space after Filename	2
T1036.007	Double File Extension	5
T1036.008	Masquerade File Type	20
T1036.009	Break Process Trees	2
T1036.010	Masquerade Account Name	7
T1036.011	Overwrite Process Arguments	1
T1036.012	Browser Fingerprint	1

Campaigns7

ArcaneDoor C0015 C0018 KV Botnet Activity Operation Dust Storm Operation Honeybee Salesforce Data Exfiltration

Procedure examples60

Groups20

Used by	Procedure example
GroupAgrius	Agrius used the Plink tool for tunneling and connections to remote machines, renaming it `systems.exe` in some instances. Unit42 Agrius 2023
GroupAoqin Dragon	Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads. SentinelOne Aoqin Dragon June 2022
GroupAPT28	APT28 has renamed the WinRAR utility to avoid detection. Cybersecurity Advisory GRU Brute Force Campaign July 2021
GroupAPT32	APT32 has disguised a Cobalt Strike beacon as a Flash Installer. Cybereason Cobalt Kitty 2017
GroupBRONZE BUTLER	BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF. Trend Micro Tick November 2019
GroupContagious Interview	Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications. Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers. ESET Contagious Interview BeaverTail InvisibleFerret February 2025 Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 Sekoia ClickFake 2025 Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
GroupEmber Bear	Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as `dump64.exe` to evade detection. Cadet Blizzard emerges as novel threat actor
GroupFIN13	FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file. Mandiant FIN13 Aug 2022 Sygnia Elephant Beetle Jan 2022

View all 20 groups examples

Software33

Used by	Procedure example
MalwareAppleSeed	AppleSeed can disguise JavaScript files as PDFs. Malwarebytes Kimsuky June 2021
MalwareBeaverTail	BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes. PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024
MalwareBisonal	Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script. Talos Bisonal Mar 2020
MalwareBoomBox	BoomBox has the ability to mask malicious data strings as PDF files. MSTIC Nobelium Toolset May 2021
MalwareDacls	The Dacls Mach-O binary has been disguised as a .nib file. SentinelOne Lazarus macOS July 2020
MalwareDarkGate	DarkGate can masquerade as pirated media content for initial delivery to victims. Ensilo Darkgate 2018
MalwareDarkTortilla	DarkTortilla's payload has been renamed `PowerShellInfo.exe`. Secureworks DarkTortilla Aug 2022
MalwareDarkWatchman	DarkWatchman has used an icon mimicking a text file to mask a malicious executable. Prevailion DarkWatchman 2021

View all 33 software examples

Campaigns7

Used by	Procedure example
CampaignArcaneDoor	ArcaneDoor involved the use of digital certificates on adversary-controlled network infrastructure that mimicked the formatting used by legitimate Cisco ASA appliances. Cisco ArcaneDoor 2024
CampaignC0015	During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file. DFIR Conti Bazar Nov 2021
CampaignC0018	During C0018, AvosLocker was disguised using the victim company name as the filename. Cisco Talos Avos Jun 2022
CampaignKV Botnet Activity	KV Botnet Activity involves changing process filename to `pr_set_mm_exe_file` and process name to `pr_set_name` during later infection stages. Lumen KVBotnet 2023
CampaignOperation Dust Storm	For Operation Dust Storm, the threat actors disguised some executables as JPG files. Cylance Dust Storm
CampaignOperation Honeybee	During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document. McAfee Honeybee
CampaignSalesforce Data Exfiltration	During Salesforce Data Exfiltration, threat actors used voice calls to socially engineer victims into authorizing a modified version of the Salesforce Data Loader app. Google Salesforce JUN 2025

References1

LOLBAS Main Site Open source
LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.