Masquerading

ID: T1036
Tactics: TA0005 Stealth
Platforms: Containers, ESXi, Linux, macOS, Windows
Data sources: Process Creation, Service Creation, File Modification, File Metadata, Process Metadata, Image Metadata, Service Metadata, Command Execution
Source: attack.mitre.org
MITRE last modified: 12 May 2026

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.^[1]

Sub-techniques (12)

Detection

DET0127 Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy
Data components: Process Creation, Service Creation, File Modification, File Metadata, Process Metadata, Image Metadata, Service Metadata, Command Execution

Mitigations (8)

M1017 User Training: Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.
M1018 User Account Management: Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.
M1022 Restrict File and Directory Permissions: Use file system access controls to protect folders such as C:\\Windows\\System32.
M1038 Execution Prevention: Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
M1040 Behavior Prevention on Endpoint: Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).
M1045 Code Signing: Require signed binaries.
M1047 Audit: Audit user accounts to ensure that each one has a defined purpose.
M1049 Antivirus/Antimalware: Anti-virus can be used to automatically quarantine suspicious files.

Groups (21)

Software (33)

References

LOLBAS Main Site