T1036.008sub-technique of T1036 Masquerading

Masquerade File Type

Linux · macOS · Windowsnothing on this site yetT1036.008 on attack.mitre.org

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Masquerading via File Type Modification

Detects behavior where files with non-executable or misleading extensions (e.g.,.jpg,.txt) are created or modified but subsequently executed as binaries based on internal file headers or abnormal parent process lineage.
Detects when a script or binary is named with misleading or benign-looking extensions (.jpg,.doc) and is then executed via command line or a scheduled task. Includes ELF header mismatches and content-type inconsistencies on disk.
Detects binaries disguised as media or document types through extension-only masquerading or by modifying the file signature. Observes execution of files whose extension is not typically executable (.jpg,.txt), yet have valid Mach-O headers or execute via Terminal or launch services.

what reduces it

M1038 Execution Prevention. Ensure that input sanitization is performed and that files are validated properly before execution; furthermore, implement a strict allow list to ensure that only authorized file types are processed. Restrict and/or block execution of files where headers and extensions do not match.
M1040 Behavior Prevention on Endpoint. Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of files with mismatching file signatures.
M1049 Antivirus/Antimalware. Anti-virus can be used to automatically quarantine suspicious files.

the rest of T1036

T1036.001 Invalid Code Signature · not covered yet
T1036.002 Right-to-Left Override · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.004 Masquerade Task or Service · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.006 Space after Filename · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.011 Overwrite Process Arguments · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.