// MITRE ATT&CK
T1036 · Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. T...
¿Cómo detectarlo y mitigarlo?
La detección de Masquerading parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (12)
T1036.001
Invalid Code Signature T1036.002
Right-to-Left Override T1036.003
Rename Legitimate Utilities T1036.004
Masquerade Task or Service T1036.005
Match Legitimate Resource Name or Location T1036.006
Space after Filename T1036.007
Double File Extension T1036.008
Masquerade File Type T1036.009
Break Process Trees T1036.010
Masquerade Account Name T1036.011
Overwrite Process Arguments T1036.012
Browser Fingerprint
Invalid Code Signature T1036.002
Right-to-Left Override T1036.003
Rename Legitimate Utilities T1036.004
Masquerade Task or Service T1036.005
Match Legitimate Resource Name or Location T1036.006
Space after Filename T1036.007
Double File Extension T1036.008
Masquerade File Type T1036.009
Break Process Trees T1036.010
Masquerade Account Name T1036.011
Overwrite Process Arguments T1036.012
Browser Fingerprint
Técnicas relacionadas
T1055.011
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.