cyberstrikeus T1036 Masquerading
High-Level Description
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Containers, ESXi, Linux, macOS, Windows
What to Check
- Identify if Masquerading technique is applicable to target environment
- Check Containers systems for indicators of Masquerading
- Check ESXi systems for indicators of Masquerading
- Check Linux systems for indicators of Masquerading
- Verify mitigations are bypassed or absent (8 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: System File Copied to Unusual Location
It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.
Supported Platforms: windows
copy-item "$env:windir\System32\cmd.exe" -destination "$env:allusersprofile\cmd.exe"
start-process "$env:allusersprofile\cmd.exe"
sleep -s 5
stop-process -name "cmd" | out-null
Atomic Test 2: Malware Masquerading and Execution from Zip File
When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique as reported here
Supported Platforms: windows
Expand-Archive -Path "PathToAtomicsFolder\..\ExternalPayloads\T1036.zip" -DestinationPath "$env:userprofile\Downloads\T1036" -Force
cd "$env:userprofile\Downloads\T1036"
cmd /c "$env:userprofile\Downloads\T1036\README.cmd" >$null 2>$null
Dependencies:
- Zip file must be present.
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Masquerading by examining the target platforms (Containers, ESXi, Linux).
Assess Existing Defenses: Review whether mitigations for T1036 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1047 Audit
Audit user accounts to ensure that each one has a defined purpose.
M1018 User Account Management
Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.
M1017 User Training
Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.
M1045 Code Signing
Require signed binaries.
M1040 Behavior Prevention on Endpoint
Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).
M1022 Restrict File and Directory Permissions
Use file system access controls to protect folders such as C:\Windows\System32.
M1049 Antivirus/Antimalware
Anti-virus can be used to automatically quarantine suspicious files.
M1038 Execution Prevention
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.
Detection
Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Masquerading technique applicable | Low | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |