T1036

Masquerading

Containers · ESXi · Linux · macOS · Windowsnothing on this site yetT1036 on attack.mitre.org

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy

Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.
Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.
Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.
Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.

what reduces it

M1017 User Training. Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.
M1038 Execution Prevention. Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
M1045 Code Signing. Require signed binaries.
M1040 Behavior Prevention on Endpoint. Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).
M1018 User Account Management. Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.
M1022 Restrict File and Directory Permissions. Use file system access controls to protect folders such as C:\\Windows\\System32.

sub-techniques

T1036.001 Invalid Code Signature · not covered yet
T1036.002 Right-to-Left Override · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.004 Masquerade Task or Service · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.006 Space after Filename · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.008 Masquerade File Type · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.011 Overwrite Process Arguments · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.