Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and security tools and evade monitoring. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.[1]

Procedure Examples

Name Description
TrickBot

The TrickBot downloader has used an icon to appear as a Microsoft Word document.[2]

UNC2452

UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.[3]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.

If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. [4] Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.[5]

Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".

References

Attachments

ID
VT0015
MITRE ID
Sub-techniques
Tactic
Defense Evasion
Platforms
Linux
Windows
macOS
Data Sources
Binary file metadata
File monitoring
Process command-line parameters
Process monitoring
Defense Bypassed
Application control by file name or path
CAPEC ID
Version
1.3

Created: 21 December 2020

Last Modified: 21 December 2020