Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1036

T1036Masquerading

T1036 — Masquerading is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 18 detection use cases covering it and 6 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
18Use cases
6Articles
12Sub-techniques
1Tactic

Sub-techniques (12)

T1036.009 · Break Process TreesT1036.012 · Browser FingerprintT1036.007 · Double File ExtensionT1036.001 · Invalid Code SignatureT1036.010 · Masquerade Account NameT1036.008 · Masquerade File TypeT1036.004 · Masquerade Task or ServiceT1036.005 · Match Legitimate Resource Name or LocationT1036.011 · Overwrite Process ArgumentsT1036.003 · Rename Legitimate UtilitiesT1036.002 · Right-to-Left OverrideT1036.006 · Space after Filename

Use cases covering this technique (18)

Cisco NVM - Non-Network Binary Making Network Connection ESCU actions · hunting P Executables Or Script Creation In Suspicious Path ESCU actions · hunting P Executables Or Script Creation In Temp Path ESCU actions · hunting P Linux Possible System Binary Backdoor ESCU actions · hunting P Linux Suspicious Staging of Alternate System Files ESCU actions · hunting P Suspicious writes to windows Recycle Bin ESCU actions · alerting P Windows Bluetooth Service Installed From Uncommon Location ESCU actions · hunting P Windows Debugger Tool Execution ESCU actions · hunting P Windows Masquerading Msdtc Process ESCU actions · alerting P Windows NetSupport RMM DLL Loaded By Uncommon Process ESCU actions · hunting P Windows SoftEther VPN Masquerading as Legitimate Binary ESCU actions · alerting P Windows Suspicious QEMU Execution ESCU actions · alerting P Windows TinyCC Shellcode Execution ESCU actions · alerting P Suspicious writes to System Volume Information ESCU actions · hunting P [LLM] XCSSET v40 worming: non-IDE process modifying multiple Xcode .pbxproj files Bespoke install · alerting DSPCS [LLM] SleeperGem: ruby process C2 contact to Forgejo host git.disroot.org Bespoke c2 · alerting DSΣPCS [LLM] Exfiltration to attacker-controlled Sentry ingest endpoint (onering crate) Bespoke actions · alerting DSΣPDDCS [LLM] Scavenger Stealer sandbox-evasion marker file %TEMP%\SCVNGR_VM created Bespoke install · alerting DSΣPDDCS

Articles citing this technique (6)

crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit OceanLotus: From external espionage to domestic targeting art-388
crit Compromised Rust crate onering performs code exfiltration art-392
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917