Log in Request a demo

Attack technique

Masquerading

Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate.

In short

Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate. They may change its name, where it sits or its descriptive details. The aim is to avoid being noticed by people and by security tools.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1036ATT&CK technique
  2. Detection4ways to spot itLook for mismatches · Unusual placement
  3. Defences4ways to stop itRequire signed software · Control what can run

How it works

Attackers copy the look of things that are normally trusted. This can be a name, a storage location or the metadata attached to a file.

Common forms include renaming a system tool, giving a file a misleading type, or naming a task or service so it sounds routine. MITRE lists these as separate sub-techniques.

The idea is simple: a harmful item that looks ordinary is less likely to be questioned during a quick review or a basic security check. MITRE lists 12 sub-techniques: T1036.001 Invalid Code Signature, T1036.002 Right-to-Left Override, T1036.003 Rename Legitimate Utilities, T1036.004 Masquerade Task or Service, T1036.005 Match Legitimate Resource Name or Location, T1036.006 Space after Filename, T1036.007 Double File Extension, T1036.008 Masquerade File Type, T1036.009 Break Process Trees, T1036.010 Masquerade Account Name, T1036.011 Overwrite Process Arguments and T1036.012 Browser Fingerprint Mimicking.

A real example

  • MITRE ATT&CK lists Agrius as renaming a tunneling tool to systems.exe in some cases.
  • MITRE ATT&CK lists AppleSeed as able to disguise JavaScript files as PDFs.
  • MITRE ATT&CK lists APT28 as renaming the WinRAR utility to avoid detection.
  • MITRE ATT&CK lists Dacls as having a Mach-O binary disguised as a .nib file.
  • MITRE ATT&CK lists DarkTortilla as having a payload renamed PowerShellInfo.exe.

How to detect

  1. Look for mismatches

    Compare what an item claims to be with how it behaves. A file whose name, metadata or icon does not fit its actual execution is a warning sign.

  2. Unusual placement

    Watch for programs or scripts with familiar names sitting in uncommon folders, or names that use odd characters.

  3. Services, bundles and images

    Check for services with legitimate-sounding names, application bundles with inconsistent details, and renamed container images.

  4. Data sources MITRE lists

    Command Execution, File Metadata, File Modification, Image Metadata, Process Creation, Process Metadata, Service Creation, Service Metadata

How to defend

  1. Require signed software

    Allow only signed binaries and images, so a renamed unsigned file is less likely to run.

  2. Control what can run

    Use application controls that judge a program by more than its file name.

  3. Protect system folders

    Use file and directory permissions to guard important system locations.

  4. Audit accounts and train users

    Review accounts for a defined purpose, enforce account naming rules and train people not to open suspicious attachments or links.

Questions

What is masquerading in cyber attacks?

Masquerading (T1036) is when an attacker changes how a file, program, service or account looks so it seems legitimate, for example by changing its name, location or descriptive details.

What forms does masquerading take?

Common forms include renaming a system tool, giving a file a misleading type, or naming a task or service so it sounds routine. MITRE lists these as separate sub-techniques.

How can I detect masquerading?

Compare what an item claims to be with how it behaves. Watch for familiar names in uncommon folders, services with legitimate-sounding names and renamed container images.

How do I defend against masquerading?

Allow only signed software, use application controls that judge a program by more than its name, protect system folders with permissions, and train people not to open suspicious attachments.

In our research

  1. SlippyNunchucks Hijacks Sogou Input Method Lookups to Deliver DarkVigil: The Attack Chain Step by Step November 2026
  2. VAPOR PANDA and ARTEX: How AI Agents Ran a China-Nexus Espionage Campaign October 2026
  3. Turn a Threat Report Into ATT&CK Mappings and Sigma Rules With an AI Agent October 2026
  4. ATT&CK techniques most used across threat groups October 2026
  5. BugSleep Backdoor Technical Analysis December 2025
  6. Caught in a Phishing Storm: Here’s How to Regain Control October 2025

Sources

  1. MITRE ATT&CK T1036: Masquerading MITRE
  2. MITRE ATT&CK T1036.005: Masquerading: Match Legitimate Resource Name or Location MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT1

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Read more

Threat group

APT36

MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least 2013. It mainly targets diplomatic, defense and research organizations in India and Afghanistan with weaponized documents, lookalike websites and remote access trojans such as Crimson.

Read more