Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.[1] Masquerading may also include the use of Proxy or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.

ID: T1036
Tactic: Defense Evasion
Platforms: Containers, Linux, Windows, macOS
Defense Bypassed: Application Control
Contributors: Bartosz Jerzman; David Lu, Tripwire; Elastic; Felipe Espósito, @Pr0teus; Goldstein Menachem; Nick Carr, Mandiant; Oleg Kolesnikov, Securonix
Version: 1.6
Created: 31 May 2017
Last Modified: 15 October 2023

Procedure Examples

ID Name Description
S0622 AppleSeed

AppleSeed can disguise JavaScript files as PDFs.[2]

G0007 APT28

APT28 has renamed the WinRAR utility to avoid detection.[3]

G0050 APT32

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.[4]

S0268 Bisonal

Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.[5]

S0635 BoomBox

BoomBox has the ability to mask malicious data strings as PDF files.[6]

G0060 BRONZE BUTLER

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.[7]

C0015 C0015

During C0015, the threat actors named a binary file compareForfor.jpg to disguise it as a JPG file.[8]

C0018 C0018

During C0018, AvosLocker was disguised using the victim company name as the filename.[9]

S0497 Dacls

The Dacls Mach-O binary has been disguised as a .nib file.[10]

S1066 DarkTortilla

DarkTortilla's payload has been renamed PowerShellInfo.exe.[11]

S0673 DarkWatchman

DarkWatchman has used an icon mimicking a text file to mask a malicious executable.[12]

G0035 Dragonfly

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.[13]

S0634 EnvyScout

EnvyScout has used folder icons for malicious files to lure victims into opening them.[6]

S0512 FatDuke

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.[14]

G1016 FIN13

FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.[15][16]

S0696 Flagpro

Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.[17]

S0661 FoggyWeb

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.[18]

G0094 Kimsuky

Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.[19]

G0140 LazyScripter

LazyScripter has used several different security software icons to disguise executables.[20]

G0045 menuPass

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.[21]

S1015 Milan

Milan has used an executable named companycatalogue to appear benign.[22]

S0637 NativeZone

NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.[23]

G0133 Nomadic Octopus

Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.[24]

S0368 NotPetya

NotPetya drops PsExec with the filename dllhost.dat.[25]

G0049 OilRig

OilRig has used .doc file extensions to mask malicious executables.[26]

C0016 Operation Dust Storm

For Operation Dust Storm, the threat actors disguised some executables as JPG files.[27]

C0006 Operation Honeybee

During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.[28]

G0068 PLATINUM

PLATINUM has renamed rar.exe to avoid detection.[29]

S1046 PowGoop

PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).[30]

S0565 Raindrop

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.[31][32]

S0458 Ramsay

Ramsay has masqueraded as a JPG image file.[33]

S0662 RCSession

RCSession has used a file named English.rtf to appear benign on victim hosts.[34][35]

S0148 RTM

RTM has been delivered as archived Windows executable files masquerading as PDF documents.[36]

S0446 Ryuk

Ryuk can create .dll files that actually contain a Rich Text File format document.[37]

S1018 Saint Bot

Saint Bot has renamed malicious binaries as wallpaper.mp4 and slideshow.mp4 to avoid detection.[38][39]

C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.[40]

S0615 SombRAT

SombRAT can use a legitimate process name to hide itself.[41]

G0127 TA551

TA551 has masked malware DLLs as dat and jpg files.[42]

G0139 TeamTNT

TeamTNT has disguised their scripts with docker-related file names.[43]

S0682 TrailBlazer

TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.[44]

S0266 TrickBot

The TrickBot downloader has used an icon to appear as a Microsoft Word document.[45]

S0689 WhisperGate

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.[46]

G0112 Windshift

Windshift has used icons mimicking MS Office files to mask malicious executables.[47] Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.[48]

S0466 WindTail

WindTail has used icons mimicking MS Office files to mask payloads.[47]

S0658 XCSSET

XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist. [49]

G0128 ZIRCONIUM

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.[50][51]

Mitigations

ID Mitigation Description
M1049 Antivirus/Antimalware

Anti-virus can be used to automatically quarantine suspicious files.

M1040 Behavior Prevention on Endpoint

Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).

M1045 Code Signing

Require signed binaries.

M1038 Execution Prevention

Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

M1022 Restrict File and Directory Permissions

Use file system access controls to protect folders such as C:\Windows\System32.

M1017 User Training

Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. [52]

Note: For Windows, Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on potential Masquerading.

DS0022 File File Metadata

Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".

Check and ensure that file headers/signature and extensions match using magic bytes detection and/or file signature validation.[53] In Linux, the file command may be used to check the file signature.[54]

File Modification

Monitor for changes made to files outside of an update or patch that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Windows Event ID 4663 (An Attempt Was Made to Access An Object) can be used to alert on attempted file accesses that may be associate with Masquerading.

DS0007 Image Image Metadata

Collecting disk and resource filenames for binaries, comparing that the InternalName, OriginalFilename, and/or ProductName match what is expected, could provide useful leads but may not always be indicative of malicious activity. [55]

DS0009 Process OS API Execution

Monitor for API calls such as fork() which can be abused to masquerade or manipulate process metadata.

Process Creation

Monitor for newly executed processes that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. The RECYCLER and SystemVolumeInformation directories will be present on every drive. Replace %systemroot% and %windir% with the actual paths as configured by the endpoints.

Analytic 1 - Suspicious Run Locations

suspicious_locations = filter process where ( image_path == ":\RECYCLER*" or image_path == ":\SystemVolumeInformation*" or image_path == "%windir%\Tasks*" or image_path == "%systemroot%\debug*")

Process Metadata

Monitor for file names that are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled.

DS0003 Scheduled Job Scheduled Job Metadata

Monitor for contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.

On Windows, Event ID 4698 (Security Log - A scheduled task was created) can be used to alert on the creation of scheduled tasks and provides metadata including the task name and task content (as XML).

On Linux, auditing frameworks such as the Linux Auditing System (auditd) can be used to alert on invocations of cron, and provides the metadata included when executing the command.

Scheduled Job Modification

Monitor for changes made to scheduled jobs that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

DS0019 Service Service Creation

Monitor for newly constructed services/daemons that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Service Metadata

Monitor for contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.

References

  1. LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.
  2. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  3. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
  4. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  5. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  6. MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.
  7. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  8. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.
  9. Venere, G. Neal, C. (2022, June 21). Avos ransomware group expands with new attack arsenal. Retrieved January 11, 2023.
  10. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  11. Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.
  12. Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.
  13. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  14. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  15. Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.
  16. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.
  17. Hada, H. (2021, December 28). Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.
  18. Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.
  19. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022.
  20. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021.
  21. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  22. ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.
  23. Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021.
  24. Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.
  25. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  26. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  27. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.
  28. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  1. Carr, N.. (2018, October 25). Nick Carr Status Update. Retrieved April 22, 2019.
  2. FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.
  3. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
  4. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  5. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  6. Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.
  7. Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
  8. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  9. ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021.
  10. Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.
  11. Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
  12. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  13. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  14. Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
  15. Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.
  16. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  17. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  18. S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.
  19. Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.
  20. The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  21. Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.
  22. Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.
  23. Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.
  24. Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.
  25. Li, V. (2019, October 2). Polyglot Files: a Hacker’s best friend. Retrieved September 27, 2022.
  26. Kessler, G. (2022, December 9). GCK'S FILE SIGNATURES TABLE. Retrieved August 23, 2022.
  27. Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.