Threat intelligence / Technique

Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

81 recorded

Relationships

mapped-to

from Create files with the same name as files protected with a higher classification

Technique

mitigates

from Antivirus/Antimalware

Mitigation

mitigates

from Audit

Mitigation

mitigates

from Behavior Prevention on Endpoint

Mitigation

mitigates

from Code Signing

Mitigation

mitigates

from Execution Prevention

Mitigation

mitigates

from Restrict File and Directory Permissions

Mitigation

mitigates

from User Account Management

Mitigation

mitigates

from User Training

Mitigation

subtechnique-of

from Break Process Trees

Technique

subtechnique-of

from Browser Fingerprint

Technique

subtechnique-of

from Double File Extension

Technique

subtechnique-of

from Invalid Code Signature

Technique

subtechnique-of

from Masquerade Account Name

Technique

subtechnique-of

from Masquerade File Type

Technique

subtechnique-of

from Masquerade Task or Service

Technique

subtechnique-of

from Match Legitimate Resource Name or Location

Technique

subtechnique-of

from Overwrite Process Arguments

Technique

subtechnique-of

from Rename Legitimate Utilities

Technique

subtechnique-of

from Right-to-Left Override

Technique

subtechnique-of

from Space after Filename

Technique

uses

Group

uses

from Aoqin Dragon

Group

uses

Malware

uses

from APT28

Group

uses

from APT32

Group

uses

from ArcaneDoor

Campaign

uses

from BeaverTail

Malware

uses

Malware

uses

Malware

uses

from BRONZE BUTLER

Group

uses

from C0015

Campaign

uses

from C0018

Campaign

uses

from Contagious Interview

Group

uses

from Dacls

Malware

uses

Malware

uses

from DarkTortilla

Malware

uses

from DarkWatchman

Malware

uses

Malware

uses

from Ember Bear

Group

uses

Malware

uses

from FIN13

Group

uses

Malware

uses

Malware

uses

Malware

uses

from KV Botnet Activity

Campaign

uses

from LazyScripter

Group

uses

Group

uses

from Milan

Malware

uses

from NativeZone

Malware

uses

from Nomadic Octopus

Group

uses

Malware

uses

Group

uses

from Operation Dust Storm

Campaign

uses

from Operation Honeybee

Campaign

uses

Group

uses

from Pony

Malware

uses

Malware

uses

Malware

uses

Malware

uses

Malware

uses

from RedLine Stealer

Malware

uses

from RTM

Malware

uses

from Ryuk

Malware

uses

Malware

uses

from Salesforce Data Exfiltration

Campaign

uses

from Sandworm Team

Group

uses

Malware

uses

from Storm-1811

Group

uses

from StrelaStealer

Malware

uses

from TA551

Group

uses

Group

uses

from TrailBlazer

Malware

uses

Malware

uses

Malware

uses

from WhisperGate

Malware

uses

Group

uses

Malware

uses

from Winter Vivern

Group

uses

Malware

uses

Group

2 external

References

mitre-attack

T1036

LOLBAS Main Site

https://lolbas-project.github.io/