Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.[1]

ID: T1036
Tactic: Defense Evasion
Platforms: Containers, Linux, Windows, macOS
Data Sources: Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Defense Bypassed: Application control by file name or path
CAPEC ID: CAPEC-177
Contributors: Bartosz Jerzman; David Lu, Tripwire; Elastic; Felipe Espósito, @Pr0teus; Nick Carr, FireEye; Oleg Kolesnikov, Securonix
Version: 1.4
Created: 31 May 2017
Last Modified: 24 April 2021

Procedure Examples

ID Name Description
G0016 APT29

APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.[2]

G0050 APT32

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.[3]

S0534 Bazar

The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.[4]

G0060 BRONZE BUTLER

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.[5]

S0497 Dacls

The Dacls Mach-O binary has been disguised as a .nib file.[6]

G0074 Dragonfly 2.0

Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.[7][8]

G0045 menuPass

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.[9]

G0129 Mustang Panda

Mustang Panda has used an additional filename extension to hide the true file type.[10][11]

S0368 NotPetya

NotPetya drops PsExec with the filename dllhost.dat.[12]

G0068 PLATINUM

PLATINUM has renamed rar.exe to avoid detection.[13]

S0565 Raindrop

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.[14][15]

S0458 Ramsay

Ramsay has masqueraded as a JPG image file.[16]

S0148 RTM

RTM has been delivered as archived Windows executable files masquerading as PDF documents.[17]

S0446 Ryuk

Ryuk can create .dll files that actually contain a Rich Text File format document.[18]

G0127 TA551

TA551 has masked malware DLLs as dat and jpg files.[19]

S0266 TrickBot

The TrickBot downloader has used an icon to appear as a Microsoft Word document.[20]

G0112 Windshift

Windshift has used icons mimicking MS Office files to mask malicious executables.[21] Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.[22]

S0466 WindTail

WindTail has used icons mimicking MS Office files to mask payloads.[21]

G0128 ZIRCONIUM

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.[23][24]

Mitigations

ID Mitigation Description
M1045 Code Signing

Require signed binaries.

M1038 Execution Prevention

Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

M1022 Restrict File and Directory Permissions

Use file system access controls to protect folders such as C:\Windows\System32.

Detection

Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.

If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. [25] Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.[26]

Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".

References

  1. LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.
  2. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  3. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  4. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  5. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  6. Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.
  7. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  8. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  9. Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
  10. Meyers, A. (2018, June 15). Meet CrowdStrike’s Adversary of the Month for June: MUSTANG PANDA. Retrieved April 12, 2021.
  11. Anomali Threat Research. (2019, October 7). China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations. Retrieved April 12, 2021.
  12. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  13. Carr, N.. (2018, October 25). Nick Carr Status Update. Retrieved April 22, 2019.
  1. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
  2. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  3. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  4. Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
  5. ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021.
  6. Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
  7. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  8. Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.
  9. The Blackberry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.
  10. Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.
  11. Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.
  12. Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.
  13. Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.