Masquerading: Browser Fingerprint
- ID
- T1036.012
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1036 Masquerading
- Platforms
- Linux, macOS, Windows
- Data sources
- Network Traffic Content, Network Connection Creation, OS API Execution, Process Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.[2]
Adversaries may gather this information through System Information Discovery or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.[3]
Detection
- DET0898 Detection of Spoofed User-Agent
Data components: Network Traffic Content, Network Connection Creation, OS API Execution, Process Creation
Mitigations (1)
- M1047 Audit
Review and limit the fingerprinting surface to only necessary information on each browser to make the browser less unique. For example, the available fonts may be limited to a standard font list. [1]