Masquerading works because analysts and many detection rules trust names: a file called svchost.exe, a scheduled task under \Microsoft\Windows\ or an account called svc_backup looks normal at a glance. MITRE ATT&CK T1036 Masquerading covers manipulating the name, location, metadata or appearance of an artefact so it looks legitimate to users and security tools, including renaming abusable system utilities to slip past monitoring. In ATT&CK v20 it sits in the Stealth tactic (TA0005), has 12 sub-techniques and spans Windows, Linux, macOS, ESXi, containers and, for account names, identity providers and SaaS. Its most used sub-technique, T1036.005 Match Legitimate Resource Name or Location, is recorded for 141 malware families and 66 groups. This guide explains each sub-technique family from the defender's side, then concentrates on detection by comparing what an object claims to be with what it actually is, and on the application control and permission settings that make masquerading ineffective. It is for detection engineers, SOC analysts and endpoint and identity owners. For the wider stealth tactic, see the Defence Evasion Techniques Guide.
Key takeaways
- Compare claims with facts. A masquerade changes what an object is called or where it sits, not what it is. Original file name, signer, hash, parent process and path rarely all line up for a fake.
- OriginalFileName defeats renaming. ATT&CK's DET0005 flags binaries whose on-disk name does not match PE metadata such as OriginalFilename, and Microsoft App Control rules use OriginalFileName by default, so a renamed utility is still recognised.
- Location is evidence. System binaries run from a small set of protected directories; the same name anywhere else, or a trusted directory writable by users, is a finding.
- Tasks, services and accounts masquerade too. T1036.004 and T1036.010 hide persistence and identities behind plausible names, so naming baselines belong in identity and configuration monitoring, not just file monitoring.
- Users are part of the attack surface. Right-to-left override characters, double extensions and file-type spoofing target people, so show extensions and block risky types at the gateway.
How the attack works
ATT&CK says masquerading "occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation". The 12 sub-techniques fall into five defender-relevant families:
| Family | Sub-techniques (v20) | What is faked | Primary detection signal |
|---|---|---|---|
| Names and locations of files | .003 Rename Legitimate Utilities; .005 Match Legitimate Resource Name or Location | A trusted file name, or a trusted directory such as System32 | On-disk name versus OriginalFileName, hash and signer; binary path versus expected path |
| File type and appearance | .002 Right-to-Left Override; .006 Space after Filename; .007 Double File Extension; .008 Masquerade File Type | What the user or tool thinks the file type is | U+202E in file names; executable second extensions; header (magic bytes) not matching extension |
| Trust metadata | .001 Invalid Code Signature | Signature information copied from a signed program | Signature present but validation fails |
| Scheduled tasks, services and accounts | .004 Masquerade Task or Service; .010 Masquerade Account Name | Plausible names and descriptions for persistence or identities | New tasks and services with legitimate-looking names but unusual binaries; accounts resembling existing service or admin accounts |
| Runtime appearance | .009 Break Process Trees; .011 Overwrite Process Arguments; .012 Browser Fingerprint | Parent-child relationships, the process name shown in /proc, or HTTP user-agent and system attributes | Orphaned processes, argv[0] not matching the executable, user-agent strings inconsistent with the host |
Where it shows up
- Tooling on compromised infrastructure: CISA's advisory AA24-038A describes Volt Typhoon running FRP clients renamed to
BrightmetricAgent.exeandSMSvcService.exeand an archive utility likely renamed toronf.exe; ATT&CK also records names such ascisco_up.exeandvm3dservice.exe. See the Volt Typhoon Threat Actor Profile. - Renamed system utilities: ATT&CK records menuPass renaming and moving certutil, and Daggerfly running a renamed rundll32 as
dbengin.exeunderProgramData\Microsoft\PlayReady. This directly targets rules written for T1218 System Binary Proxy Execution. - Persistence with plausible names: Lazarus Group used a scheduled task named
SRCheck; see the T1053 Scheduled Task/Job Defensive Guide and the T1543 Create or Modify System Process Defensive Guide. - Identity masquerading: ATT&CK records Storm-1811 creating Microsoft Teams accounts that spoof IT support, Magic Hound creating local accounts named
helpandDefaultAccount, and APT29 creating an Azure AD certificate whose common name matched an application's display name. - Phishing payloads: right-to-left override, double extensions and spoofed file types make executables look like documents or images.
Impact
Masquerading buys time. Analysts skim past familiar names, path-based allowlists admit the file, and detection rules keyed on process names never fire. The cost appears later: longer dwell time, persistence that survives incident response because it looked like part of Windows, and identities that pass access reviews because their names match a real team. On Linux and ESXi, where file integrity monitoring is often thin, a binary named like a system daemon can run for months.
Detection
ATT&CK v20 provides DET0127 for the parent technique and a detection strategy for each sub-technique. The common principle is a discrepancy check.
| Check | Telemetry | ATT&CK strategy | What to alert on |
|---|---|---|---|
| Name versus PE metadata | Sysmon 1 (OriginalFileName, hashes, signature status in EDR), Sysmon 11 | DET0005 (.003) | Image name differs from OriginalFileName or InternalName for known utilities (for example a file whose OriginalFileName is rundll32.exe, certutil.exe or powershell.exe running under another name) |
| Trusted name, wrong place or parent | Security 4688, Sysmon 1 and 11 | DET0347 (.005) | System binary names executing outside their usual directories, or from trusted directories with an unexpected hash, signer or parent |
| Task and service names | System 7045 (service installed), Security 4698 (scheduled task created), Sysmon 1 | DET0117 (.004) | New tasks or services that mimic Microsoft names but point to binaries in user-writable paths, scripts or LOLBAS |
| File name tricks | Sysmon 11 and 1, mail and web gateway logs | DET0527 (.002), DET0366 (.007), DET0226 (.008) | U+202E in names; .pdf.exe style names that execute; headers inconsistent with extension |
| Invalid signatures | Sysmon 1, Microsoft Defender operational log, PowerShell 4103 and 4104 | DET0031 (.001) | Binaries claiming a signature that fails validation, especially with unusual parents |
| Account names | Security 4720 (account created), identity provider audit logs | DET0383 (.010) | New or renamed accounts resembling admin or service accounts: suffixes, homoglyphs, names like admin1 |
| Linux and macOS runtime | auditd execve, osquery, Endpoint Security exec events | DET0127, DET0164 (.011), DET0443 (.009), DET0292 (.006) | Binaries in /tmp or /dev/shm named like daemons, argv[0] not matching the executable path, trailing spaces in names |
| ESXi and containers | ESXi shell and hostd logs, container runtime events | DET0127 | Scripts or services with legitimate-sounding names in /etc/rc.local.d or cron that are not in the default build; renamed binaries injected into containers |
Making it work in practice
- Maintain a reference list: for the 50 to 100 binaries attackers most often rename (scripting hosts, proxy execution binaries, archivers, remote tools), record OriginalFileName, expected paths, signer and normal parents.
- Hunt by hash, not name: group executions by hash and look for one hash with several names, or one name with several hashes.
- Baseline tasks and services: export scheduled tasks and services from a gold image and alert on additions, especially under
\Microsoft\Windows\. See the Windows Event Log Guide. - Score combined anomalies: name mismatch plus user-writable path plus network connection is a strong alert; any one alone may be benign software packaging.
Prevention and hardening
| Control | How to apply it | Sub-techniques addressed |
|---|---|---|
| Application control by publisher and original file name | App Control for Business FilePublisher or FileName rules, which use OriginalFileName by default; deny rules for unneeded utilities apply even when renamed. See the Application Allowlisting Guide | .003, .005 (ATT&CK M1038, M1045) |
| Careful path rules | Use FilePath rules only for admin-writable paths; App Control checks at runtime that only administrators can write to the path, so do not disable that protection (rule option 18) | .005 |
| File and directory permissions | Keep standard users out of System32, Program Files and other trusted paths; audit ACL changes on them | .003, .005 (M1022) |
| Signature enforcement | Require valid signatures for drivers and, where feasible, user-mode code; treat failed validation as a block, not a warning. See the Code Signing Security Guide | .001 (M1045) |
| Reputation-based execution | ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" (01443614-cd74-433a-b99e-2ecdc07bfc25), audit first | .005, .008 |
| Show real file types | Turn off hiding of known file extensions, block executable types and RTLO-named files at mail and web gateways | .002, .007, .008 (M1028, M1017) |
| Account naming and creation controls | Naming standards with owner tags, creation of privileged and service accounts only through workflow, alerting on lookalikes | .010 (M1018) |
| Linux execution control | fapolicyd or equivalent trust databases, noexec on /tmp and /dev/shm. See the fapolicyd and Linux Application Allowlisting Guide | .005, .006, .011 |
Rollout
- Collect metadata: confirm your EDR or Sysmon records OriginalFileName, signer and hash for every process start.
- Deploy discrepancy detections in alert-only mode for two weeks, tuning out packaged software that renames binaries legitimately.
- Audit application control: run FilePublisher-based policies in audit mode and review what would be blocked.
- Enforce on high-value tiers first: domain controllers, privileged access workstations and identity servers.
- Roll back by redeploying the previous App Control policy version or switching rules back to audit, and keep exceptions time-limited with owners.
Where identity fits
T1036.010 is identity masquerading: accounts, service principals and certificates named to look like trusted services or helpdesk staff. ATT&CK lists identity provider, SaaS, IaaS and Office suite platforms for it. Enforce naming conventions with a recorded owner for every service account and workload identity, flag new identities whose names closely match existing privileged ones, and review application display names and credentials added to service principals. See the MITRE ATT&CK T1136 Create Account Guide and the Service Account Security Guide.
Lessons from incidents
The SolarWinds supply chain compromise is the clearest case. ATT&CK records that APT29 renamed software and DLLs with legitimate names, named a scheduled task \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager, and that SUNBURST created VBScripts named after existing services or folders, while the TEARDROP and Raindrop loaders used names resembling Windows files. Each of these would have passed a name-based review. Hash and signer baselines for tasks and binaries, and alerting on new tasks under Microsoft paths, are the controls that catch this pattern.
Common failure patterns
- Detections keyed only on process name: a rule for
rundll32.exemisses the same binary renamed. Key on OriginalFileName and hash. - Path allowlists over user-writable folders: allowing everything under
C:\ProgramDataor a vendor folder with weak ACLs invites placement of lookalike files. - Trusting anything under
\Microsoft\Windows\in task lists: attackers place tasks there precisely because reviewers skip it. - No naming governance for accounts: without owners and conventions, a lookalike service account is indistinguishable from a real one.
- Ignoring Linux and ESXi: daemon-like names in temporary paths go unseen without file integrity monitoring and auditd.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1036 and .001 to .012 (TA0005) | The technique family |
| ATT&CK mitigations | M1045, M1038, M1022, M1040, M1049, M1047, M1018, M1017, M1028 | Official mitigations across sub-techniques |
| NIST SP 800-53 Rev. 5 | CM-7(5) Authorized Software; SI-7 Software, Firmware, and Information Integrity | Execution control and integrity verification |
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege; SI-4 System Monitoring; AU-12 Audit Record Generation | Protecting trusted paths; collecting the metadata that exposes fakes |
| NIST CSF 2.0 | PR.PS-05; DE.CM-09 | Preventing unauthorised software; monitoring computing environments |
Practitioner checklist
- Confirm process telemetry includes OriginalFileName, signer, hash, path and parent on every endpoint and server.
- Deploy name-versus-metadata and trusted-name-wrong-path detections for commonly abused utilities.
- Baseline scheduled tasks, services and autostart entries and alert on additions with Microsoft-like names.
- Use publisher and original-file-name based application control rules; avoid path rules over user-writable folders.
- Lock down ACLs on System32, Program Files and vendor directories, and alert on changes.
- Show file extensions and block RTLO, double-extension and type-spoofed attachments at the gateway.
- Enforce account and service principal naming with owners, and alert on lookalike identities.
- Extend checks to Linux, macOS, ESXi and containers with auditd, Endpoint Security and file integrity monitoring.
Standards and references
- MITRE ATT&CK: Masquerading (T1036)
- MITRE ATT&CK: Match Legitimate Resource Name or Location (T1036.005)
- MITRE ATT&CK: Masquerade Account Name (T1036.010)
- CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- Microsoft: App Control for Business policy and file rule levels
- Microsoft: Attack surface reduction rules reference
- Microsoft Sysinternals: Sysmon
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Defence Evasion Techniques Guide · ATT&CK Stealth and Defense Impairment Tactics Guide · Application Allowlisting Guide · T1218 System Binary Proxy Execution Defensive Guide