Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.[1]
| ID | Name | Description |
|---|---|---|
| S0622 | AppleSeed | |
| G0007 | APT28 | |
| G0016 | APT29 |
APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.[4] |
| G0050 | APT32 |
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.[5] |
| S0268 | Bisonal |
Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.[6] |
| S0635 | BoomBox |
BoomBox has the ability to mask malicious data strings as PDF files.[7] |
| G0060 | BRONZE BUTLER |
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.[8] |
| S0497 | Dacls |
The Dacls Mach-O binary has been disguised as a .nib file.[9] |
| S0673 | DarkWatchman |
DarkWatchman has used an icon mimicking a text file to mask a malicious executable.[10] |
| G0035 | Dragonfly |
Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.[11] |
| S0634 | EnvyScout |
EnvyScout has used folder icons for malicious files to lure victims into opening them.[7] |
| S0512 | FatDuke |
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.[12] |
| S0696 | Flagpro |
Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.[13] |
| S0661 | FoggyWeb |
FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.[14] |
| G0094 | Kimsuky |
Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.[15] |
| G0032 | Lazarus Group |
Lazarus Group has disguised malicious template files as JPEG files to avoid detection.[16] |
| G0140 | LazyScripter |
LazyScripter has used several different security software icons to disguise executables.[17] |
| G0045 | menuPass |
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.[18] |
| S0637 | NativeZone |
NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.[19] |
| G0133 | Nomadic Octopus |
Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.[20] |
| S0368 | NotPetya | |
| G0049 | OilRig |
OilRig has used .doc file extensions to mask malicious executables.[22] |
| G0068 | PLATINUM | |
| S0650 | QakBot | |
| S0565 | Raindrop |
Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.[25][26] |
| S0458 | Ramsay | |
| S0662 | RCSession |
RCSession has used a file named English.rtf to appear benign on victim hosts.[28][29] |
| S0148 | RTM |
RTM has been delivered as archived Windows executable files masquerading as PDF documents.[30] |
| S0446 | Ryuk |
Ryuk can create .dll files that actually contain a Rich Text File format document.[31] |
| S0615 | SombRAT |
SombRAT can use a legitimate process name to hide itself.[32] |
| G0127 | TA551 | |
| S0682 | TrailBlazer |
TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.[34] |
| S0266 | TrickBot |
The TrickBot downloader has used an icon to appear as a Microsoft Word document.[35] |
| S0609 | TRITON |
TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.[36] |
| S0689 | WhisperGate |
WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.[37] |
| G0112 | Windshift |
Windshift has used icons mimicking MS Office files to mask malicious executables.[38] Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.[39] |
| S0466 | WindTail |
WindTail has used icons mimicking MS Office files to mask payloads.[38] |
| S0658 | XCSSET |
XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and |
| G0128 | ZIRCONIUM |
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.[41][42] |
| ID | Mitigation | Description |
|---|---|---|
| M1045 | Code Signing |
Require signed binaries. |
| M1038 | Execution Prevention |
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed. |
| M1022 | Restrict File and Directory Permissions |
Use file system access controls to protect folders such as C:\Windows\System32. |
Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. [43] Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.[44]
Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".