// MITRE ATT&CK
T1036 · Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. T...
How to detect & mitigate it
Detecting Masquerading starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Sub-techniques (12)
T1036.001
Invalid Code Signature T1036.002
Right-to-Left Override T1036.003
Rename Legitimate Utilities T1036.004
Masquerade Task or Service T1036.005
Match Legitimate Resource Name or Location T1036.006
Space after Filename T1036.007
Double File Extension T1036.008
Masquerade File Type T1036.009
Break Process Trees T1036.010
Masquerade Account Name T1036.011
Overwrite Process Arguments T1036.012
Browser Fingerprint
Invalid Code Signature T1036.002
Right-to-Left Override T1036.003
Rename Legitimate Utilities T1036.004
Masquerade Task or Service T1036.005
Match Legitimate Resource Name or Location T1036.006
Space after Filename T1036.007
Double File Extension T1036.008
Masquerade File Type T1036.009
Break Process Trees T1036.010
Masquerade Account Name T1036.011
Overwrite Process Arguments T1036.012
Browser Fingerprint
Related techniques
T1055.011
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Extra Window Memory Injection T1205.002
Socket Filters T1027.011
Fileless Storage T1218.011
Rundll32 T1027.009
Embedded Payloads T1564.012
File/Path Exclusions T1216.001
PubPrn T1574.007
Path Interception by PATH Environment Variable
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.