{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1036","id":"T1036","name":"Masquerading","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1036","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"1ede20db947ebdb93d516465e271d6ba2bb41063532a3503df2ed1a7182e27de","description":"Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1036","external_id":"T1036"},{"source_name":"LOLBAS Main Site","description":"LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.","url":"https://lolbas-project.github.io/"}],"platforms":["Containers","ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1036.001","id":"T1036.001","name":"Invalid Code Signature","page":"techniques/enterprise/T1036.001/"},{"key":"enterprise/T1036.002","id":"T1036.002","name":"Right-to-Left Override","page":"techniques/enterprise/T1036.002/"},{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1036.004","id":"T1036.004","name":"Masquerade Task or Service","page":"techniques/enterprise/T1036.004/"},{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"},{"key":"enterprise/T1036.006","id":"T1036.006","name":"Space after Filename","page":"techniques/enterprise/T1036.006/"},{"key":"enterprise/T1036.007","id":"T1036.007","name":"Double File Extension","page":"techniques/enterprise/T1036.007/"},{"key":"enterprise/T1036.008","id":"T1036.008","name":"Masquerade File Type","page":"techniques/enterprise/T1036.008/"},{"key":"enterprise/T1036.009","id":"T1036.009","name":"Break Process Trees","page":"techniques/enterprise/T1036.009/"},{"key":"enterprise/T1036.010","id":"T1036.010","name":"Masquerade Account Name","page":"techniques/enterprise/T1036.010/"},{"key":"enterprise/T1036.011","id":"T1036.011","name":"Overwrite Process Arguments","page":"techniques/enterprise/T1036.011/"},{"key":"enterprise/T1036.012","id":"T1036.012","name":"Browser Fingerprint","page":"techniques/enterprise/T1036.012/"}],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0028","name":"Image Metadata","page":"telemetry/DC0028/","kind":"attack_component","category":"Cloud control plane","description":"Virtual-machine image properties such as owner, state, platform, source disk and permissions.","collection_focus":"Collect authorized cloud VM image inventory with stable image IDs and observation time; this component is not container registry metadata.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["image_id","owner","state","platform","public"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0028","collector":"illustrative-lab-collector","observation":{"image_id":"image-lab-1","owner":"lab-account","state":"available","platform":"Linux","public":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0034","name":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component","category":"Host state and inventory","description":"Point-in-time process properties such as owner, executable and start time.","collection_focus":"Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["process_id","image","owner_uid","started_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0041","name":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component","category":"Host state and inventory","description":"Service configuration and current state at observation time.","collection_focus":"Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["service","executable","start_mode","state"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","containers","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1036","technique_page":"techniques/enterprise/T1036/","page":"detections/enterprise/T1036/","status":"rule_source_available","counts":{"sigma":38,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"312b42b1-bded-4441-8b58-163a3af58775","title":"Potentially Suspicious Execution From Tmp Folder","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/312b42b1-bded-4441-8b58-163a3af58775.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"ea3ecad2-db86-4a89-ad0b-132a10d2db55","title":"Interactive Bash Suspicious Children","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/ea3ecad2-db86-4a89-ad0b-132a10d2db55.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"cfeed607-6aa4-4bbd-9627-b637deb723c8","title":"New or Renamed User Account with '$' Character","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/cfeed607-6aa4-4bbd-9627-b637deb723c8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml","author":"Ilyas Ochkov, oscd.community","kind":"sigma"},{"id":"54f0434b-726f-48a1-b2aa-067df14516e4","title":"Password Protected ZIP File Opened (Suspicious Filenames)","status":"test","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/54f0434b-726f-48a1-b2aa-067df14516e4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b8fd0e93-ff58-4cbd-8f48-1c114e342e62","title":"Windows Binaries Write Suspicious Extensions","status":"test","level":"high","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/b8fd0e93-ff58-4cbd-8f48-1c114e342e62.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6","title":"Potential Homoglyph Attack Using Lookalike Characters in Filename","status":"test","level":"medium","logsource":{"category":"file_event","product":"windows"},"data_path":"data/detection-rules/4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml","author":"Micah Babinski, @micahbabinski","kind":"sigma"},{"id":"737e618a-a410-49b5-bec3-9e55ff7fbc15","title":"Suspicious Calculator Usage","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/737e618a-a410-49b5-bec3-9e55ff7fbc15.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"c7942406-33dd-4377-a564-0f62db0593a3","title":"Suspicious CodePage Switch Via CHCP","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c7942406-33dd-4377-a564-0f62db0593a3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48","title":"CreateDump Process Dump","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"dee0a7a3-f200-4112-a99b-952196d81e42","title":"DumpMinitool Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/dee0a7a3-f200-4112-a99b-952196d81e42.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"eb1c4225-1c23-4241-8dd4-051389fde4ce","title":"Suspicious DumpMinitool Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/eb1c4225-1c23-4241-8dd4-051389fde4ce.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"949f1ffb-6e85-4f00-ae1e-c3c5b190d605","title":"Explorer Process Tree Break","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/949f1ffb-6e85-4f00-ae1e-c3c5b190d605.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber","kind":"sigma"},{"id":"33339be3-148b-4e16-af56-ad16ec6c7e7b","title":"Findstr Launching .lnk File","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/33339be3-148b-4e16-af56-ad16ec6c7e7b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_findstr_lnk.yml","author":"Trent Liffick","kind":"sigma"},{"id":"f53714ec-5077-420e-ad20-907ff9bb2958","title":"Forfiles.EXE Child Process Masquerading","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f53714ec-5077-420e-ad20-907ff9bb2958.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml","author":"Nasreddine Bencherchali (Nextron Systems), Anish Bogati","kind":"sigma"},{"id":"66e563f9-1cbd-4a22-a957-d8b7c0f44372","title":"HackTool - XORDump Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/66e563f9-1cbd-4a22-a957-d8b7c0f44372.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_xordump.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"4e762605-34a8-406d-b72e-c1a089313320","title":"Potential Fake Instance Of Hxtsr.EXE Executed","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/4e762605-34a8-406d-b72e-c1a089313320.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml","author":"Sreeman","kind":"sigma"},{"id":"12fbff88-16b5-4b42-9754-cd001a789fb3","title":"CodePage Modification Via MODE.COM To Russian Language","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/12fbff88-16b5-4b42-9754-cd001a789fb3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mode_codepage_russian.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"7a74da6b-ea76-47db-92cc-874ad90df734","title":"Suspicious MSDT Parent Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7a74da6b-ea76-47db-92cc-874ad90df734.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml","author":"Nextron Systems","kind":"sigma"},{"id":"0c92f2e6-f08f-4b73-9216-ecb0ca634689","title":"PUA - Potential PE Metadata Tamper Using Rcedit","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0c92f2e6-f08f-4b73-9216-ecb0ca634689.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml","author":"Micah Babinski","kind":"sigma"},{"id":"1a1ed54a-2ba4-4221-94d5-01dee560d71e","title":"Renamed CreateDump Utility Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1a1ed54a-2ba4-4221-94d5-01dee560d71e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/340a090b-c4e9-412e-bb36-b4b16fe96f9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"1c12727d-02bf-45ff-a9f3-d49806a3cf43","title":"Renamed Plink Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1c12727d-02bf-45ff-a9f3-d49806a3cf43.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_plink.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"646ea171-dded-4578-8a4d-65e9822892e3","title":"Process Memory Dump Via Comsvcs.DLL","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/646ea171-dded-4578-8a4d-65e9822892e3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml","author":"Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"15b75071-74cc-47e0-b4c6-b43744a62a2b","title":"Suspicious Process Start Locations","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/15b75071-74cc-47e0-b4c6-b43744a62a2b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_run_locations.yml","author":"juju4, Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"f3d39c45-de1a-4486-a687-ab126124f744","title":"Sdiagnhost Calling Suspicious Child Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f3d39c45-de1a-4486-a687-ab126124f744.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml","author":"Nextron Systems, @Kostastsale","kind":"sigma"},{"id":"1327381e-6ab0-4f38-b583-4c1b8346a56b","title":"Potential Command Line Path Traversal Evasion Attempt","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/1327381e-6ab0-4f38-b583-4c1b8346a56b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"3dfd06d2-eaf4-4532-9555-68aca59f57c4","title":"Process Execution From A Potentially Suspicious Folder","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3dfd06d2-eaf4-4532-9555-68aca59f57c4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml","author":"Florian Roth (Nextron Systems), Tim Shelton","kind":"sigma"},{"id":"32e280f1-8ad4-46ef-9e80-910657611fbc","title":"Potential Homoglyph Attack Using Lookalike Characters","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/32e280f1-8ad4-46ef-9e80-910657611fbc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml","author":"Micah Babinski, @micahbabinski","kind":"sigma"},{"id":"cbec226f-63d9-4eca-9f52-dfb6652f24df","title":"Suspicious Process Parents","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/cbec226f-63d9-4eca-9f52-dfb6652f24df.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_parents.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"e4a6b256-3e47-40fc-89d2-7a477edd6915","title":"System File Execution Location Anomaly","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e4a6b256-3e47-40fc-89d2-7a477edd6915.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml","author":"Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"2e65275c-8288-4ab4-aeb7-6274f58b6b20","title":"Procdump Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/2e65275c-8288-4ab4-aeb7-6274f58b6b20.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"79b06761-465f-4f88-9ef2-150e24d3d737","title":"Potential SysInternals ProcDump Evasion","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/79b06761-465f-4f88-9ef2-150e24d3d737.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5afee48e-67dd-4e03-a783-f74259dcf998","title":"Potential LSASS Process Dump Via Procdump","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5afee48e-67dd-4e03-a783-f74259dcf998.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"9fff585c-c33e-4a86-b3cd-39312079a65f","title":"Taskmgr as LOCAL_SYSTEM","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9fff585c-c33e-4a86-b3cd-39312079a65f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"3d7679bd-0c00-440c-97b0-3f204273e6c7","title":"New Process Created Via Taskmgr.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/3d7679bd-0c00-440c-97b0-3f204273e6c7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd","title":"Potential ReflectDebugger Content Execution Via WerFault.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml","author":"X__Junior (Nextron Systems)","kind":"sigma"},{"id":"396f6630-f3ac-44e3-bfc8-1b161bc00c4e","title":"Suspicious Child Process Of Wermgr.EXE","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/396f6630-f3ac-44e3-bfc8-1b161bc00c4e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"52d097e2-063e-4c9c-8fbb-855c8948d135","title":"Suspicious Windows Update Agent Empty Cmdline","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/52d097e2-063e-4c9c-8fbb-855c8948d135.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1036-1","technique_id":"T1036","title":"T1036 Masquerading","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#defense-evasion","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":96,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L96","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"2cb2dac0b7c0b62ae8dec8917d8d944786671467b134548adf4fdbc46a7843a5","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(filename_or_service_name IN trusted_names) AND hash_or_path_or_publisher NOT_IN approved_values -> ALERT","log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Application-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#19-application-control-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1036-1","technique_id":"T1036","title":"Object renamed to resemble trusted object — T1036 Masquerading","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#masquerading","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":66,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L66","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"36c5ec3bbdf2319b44c3e862e77be319a7b3d6d10963e293db7598970d62ffe9","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"name-path-hash-publisher combination.","expected_behavior":"trusted names correspond to stable paths, hashes, and publishers.","deviation":"common name appears in an improbable feature combination.","anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"}],"log_sources":[{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"},{"title":"Application-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#19-application-control-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Category-Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#86-category-combination-anomaly"},{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"}],"strategies":[{"id":"DET0127","name":"Behavioral Detection of Masquerading Across Platforms via Metadata and Execution Discrepancy","url":"https://attack.mitre.org/detectionstrategies/DET0127","stix_id":"x-mitre-detection-strategy--408aedab-4a23-41ad-809d-fe9c3805b7f6","relationship_id":"relationship--f6da021e-aaec-4010-baa9-1a02d9e40f9b","description":"","analytics":[{"id":"AN0355","name":"Analytic 0355","guidance":"Adversary renames LOLBINs or deploys binaries with spoofed file names, internal PE metadata, or misleading icons to appear legitimate. File creation is followed by execution or service registration inconsistent with known usage.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0355","platforms":["Windows"],"tuning":[{"field":"OriginalFilenameMismatch","description":"Compare executable file name with PE metadata OriginalFilename field"},{"field":"KnownSystemUtilityPaths","description":"Tune based on expected installation directories for signed binaries"},{"field":"TimeWindow","description":"Correlation window between file creation and service/process execution"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0355","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0355","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7045","platforms":["Windows"],"analytic_id":"AN0355","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0355","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"}]},{"id":"AN0356","name":"Analytic 0356","guidance":"Adversary drops renamed binaries in uncommon directories (e.g., /tmp, /dev/shm) or uses special characters in names (e.g., trailing space, Unicode RLO). Execution or cronjob registration follows shortly after file drop.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0356","platforms":["Linux"],"tuning":[{"field":"DropLocationPattern","description":"Directories where new binaries are suspicious (e.g., /tmp)"},{"field":"FilenameAnomalies","description":"Regex for Unicode/RLO/space abuse in filenames"},{"field":"ExecutionDelayWindow","description":"Time range between file write and execution used for joining"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0356","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0356","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"linux:syslog","channel":"rename","platforms":["Linux"],"analytic_id":"AN0356","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0356","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0059","component":"File Metadata","name":"linux:osquery","channel":"file_events","platforms":["Linux"],"analytic_id":"AN0356","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0356","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN0357","name":"Analytic 0357","guidance":"Adversary creates disguised launch daemons or apps with misleading names and bundle metadata (e.g., Info.plist values inconsistent with binary path or icon). Launch is correlated with user logon or persistence setup.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0357","platforms":["macOS"],"tuning":[{"field":"InfoPlistDiscrepancy","description":"Mismatch between bundle metadata and file system path/name"},{"field":"LaunchAgentPath","description":"Unusual LaunchDaemon/LaunchAgent paths can be tuned per org"},{"field":"ExecutionTrigger","description":"Window between install and first execution (e.g., at user login)"}],"log_sources":[{"component_id":"DC0034","component":"Process Metadata","name":"macos:unifiedlog","channel":"process","platforms":["macOS"],"analytic_id":"AN0357","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0357","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0034/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","platforms":["macOS"],"analytic_id":"AN0357","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0357","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0059","component":"File Metadata","name":"fs:fileevents","channel":"/var/log/install.log","platforms":["macOS"],"analytic_id":"AN0357","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0357","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN0358","name":"Analytic 0358","guidance":"Adversary uses renamed container images, injects files into containers with misleading names or metadata (e.g., renamed system binaries), and executes them during startup or scheduled jobs.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0358","platforms":["Containers"],"tuning":[{"field":"ImageLabelMismatch","description":"Tune detection based on mismatch between image name and labels"},{"field":"StartupScriptLocation","description":"Detect binaries added or modified in startup path (e.g., /entrypoint.sh)"},{"field":"ProcessNamePattern","description":"Allow tuning based on suspicious binary naming inside containers"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"containerd:runtime","channel":"/var/log/containers/*.log","platforms":["Containers"],"analytic_id":"AN0358","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0358","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0028","component":"Image Metadata","name":"docker:events","channel":"docker.events.json","platforms":["Containers"],"analytic_id":"AN0358","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0358","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0028/"},{"component_id":"DC0061","component":"File Modification","name":"ebpf:syscalls","channel":"file_write","platforms":["Containers"],"analytic_id":"AN0358","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0358","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0359","name":"Analytic 0359","guidance":"Adversary places scripts or binaries with misleading names in /etc/rc.local.d or /var/spool/cron, or registers services with legitimate-sounding names not present in default ESXi builds.","url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0359","platforms":["ESXi"],"tuning":[{"field":"ServiceNameBaseline","description":"Tune based on default service names vs. suspicious new entries"},{"field":"ScriptFilePath","description":"Watch for new binaries/scripts in boot or cron folders"},{"field":"ExecutionContext","description":"Determine if execution happens at boot or scheduled interval"}],"log_sources":[{"component_id":"DC0041","component":"Service Metadata","name":"esxi:hostd","channel":"registers services with legitimate-sounding names","platforms":["ESXi"],"analytic_id":"AN0359","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0359","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0041/"},{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"scripts or binaries with misleading names","platforms":["ESXi"],"analytic_id":"AN0359","source_url":"https://attack.mitre.org/detectionstrategies/DET0127#AN0359","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0028","name":"Image Metadata","tag":"Image Metadata","page":"telemetry/DC0028/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0034","name":"Process Metadata","tag":"Process Metadata","page":"telemetry/DC0034/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"},{"id":"DC0041","name":"Service Metadata","tag":"Service Metadata","page":"telemetry/DC0041/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) has been delivered as archived Windows executable files masquerading as PDF documents.(Citation: Unit42 Redaman January 2019)\t","relationship_id":"relationship--f981c633-9333-4c7d-a168-7bea28f64d52","references":[{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"The [TrickBot](https://attack.mitre.org/software/S0266) downloader has used an icon to appear as a Microsoft Word document.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--a8126b8d-8dd7-4e12-a384-96dabb975725","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":" [Bisonal](https://attack.mitre.org/software/S0268) dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.(Citation: Talos Bisonal Mar 2020) ","relationship_id":"relationship--ffff35dc-3741-4fba-9680-f0fbe321c0b0","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0368","name":"NotPetya","url":"https://attack.mitre.org/software/S0368","kind":"malware","description":"[NotPetya](https://attack.mitre.org/software/S0368) drops [PsExec](https://attack.mitre.org/software/S0029) with the filename dllhost.dat.(Citation: Talos Nyetya June 2017)","relationship_id":"relationship--ab372993-3d63-4ca3-a064-e4b5820d8970","references":[{"source_name":"Talos Nyetya June 2017","description":"Chiu, A. (2016, June 27). New Ransomware Variant \"Nyetya\" Compromises Systems Worldwide. Retrieved March 26, 2019.","url":"https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) can create .dll files that actually contain a Rich Text File format document.(Citation: ANSSI RYUK RANSOMWARE)","relationship_id":"relationship--df3548d1-800d-4d18-8566-3a5fe925a2ef","references":[{"source_name":"ANSSI RYUK RANSOMWARE","description":"ANSSI. (2021, February 25). RYUK RANSOMWARE. Retrieved March 29, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf"}]},{"id":"S0453","name":"Pony","url":"https://attack.mitre.org/software/S0453","kind":"malware","description":"[Pony](https://attack.mitre.org/software/S0453) has used the Adobe Reader icon for the downloaded file to look more trustworthy.(Citation: Malwarebytes Pony April 2016)\t","relationship_id":"relationship--237cd65a-e30e-4f8a-9822-f50b818e1491","references":[{"source_name":"Malwarebytes Pony April 2016","description":"hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) has masqueraded as a JPG image file.(Citation: Eset Ramsay May 2020)","relationship_id":"relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0466","name":"WindTail","url":"https://attack.mitre.org/software/S0466","kind":"malware","description":"[WindTail](https://attack.mitre.org/software/S0466) has used icons mimicking MS Office files to mask payloads.(Citation: objective-see windtail1 dec 2018)","relationship_id":"relationship--81603db2-a657-4716-a7ca-e6562799e98e","references":[{"source_name":"objective-see windtail1 dec 2018","description":"Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3B.html"}]},{"id":"S0497","name":"Dacls","url":"https://attack.mitre.org/software/S0497","kind":"malware","description":"The [Dacls](https://attack.mitre.org/software/S0497) Mach-O binary has been disguised as a .nib file.(Citation: SentinelOne Lazarus macOS July 2020)","relationship_id":"relationship--ebfa89db-b37b-4b66-a820-b863bd012b80","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"S0565","name":"Raindrop","url":"https://attack.mitre.org/software/S0565","kind":"malware","description":"[Raindrop](https://attack.mitre.org/software/S0565) was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f","references":[{"source_name":"Symantec RAINDROP January 2021","description":"Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can use a legitimate process name to hide itself.(Citation: CISA AR21-126A FIVEHANDS May 2021)","relationship_id":"relationship--f40170e7-5246-442e-95ad-1b810107b8b8","references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can disguise JavaScript files as PDFs.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--2f249959-a448-454d-85ab-f71c8c5ff277","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0634","name":"EnvyScout","url":"https://attack.mitre.org/software/S0634","kind":"malware","description":"[EnvyScout](https://attack.mitre.org/software/S0634) has used folder icons for malicious files to lure victims into opening them.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--f09c9f4a-345f-4352-aaba-7b0b0a24085c","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) has the ability to mask malicious data strings as PDF files.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--84be9d61-ec20-4066-8c99-b99d9127fce2","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0637","name":"NativeZone","url":"https://attack.mitre.org/software/S0637","kind":"malware","description":"[NativeZone](https://attack.mitre.org/software/S0637) has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.(Citation: SentinelOne NobleBaron June 2021)","relationship_id":"relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d","references":[{"source_name":"SentinelOne NobleBaron June 2021","description":"Guerrero-Saade, J. (2021, June 1). NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks. Retrieved August 4, 2021.","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.(Citation: trendmicro xcsset xcode project 2020)(Citation: Microsoft March 2025 XCSSET)","relationship_id":"relationship--51650560-9aff-460b-9766-14c83bdb2198","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"},{"source_name":"Microsoft March 2025 XCSSET","description":"Microsoft Threat Intelligence. (2025, March 11). New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects. Retrieved April 2, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661) can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--6c0510e4-a642-4dfe-9632-dff6f97e09de","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) has used a file named English.rtf to appear benign on victim hosts.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4","references":[{"source_name":"Secureworks BRONZE PRESIDENT December 2019","description":"Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) has used an icon mimicking a text file to mask a malicious executable.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0682","name":"TrailBlazer","url":"https://attack.mitre.org/software/S0682","kind":"malware","description":"[TrailBlazer](https://attack.mitre.org/software/S0682) has used filenames that match the name of the compromised system in attempt to avoid detection.(Citation: CrowdStrike StellarParticle January 2022)","relationship_id":"relationship--eca68811-ebe9-4ee0-8fb0-afa5975eb938","references":[{"source_name":"CrowdStrike StellarParticle January 2022","description":"CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) has been disguised as a JPG extension to avoid detection as a malicious PE file.(Citation: Medium S2W WhisperGate January 2022)","relationship_id":"relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724","references":[{"source_name":"Medium S2W WhisperGate January 2022","description":"S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) can download malicious files with a .tmp extension and append them with .exe prior to execution.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--702c674e-110e-4f6d-9117-be1803d84e88","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) has used an executable named `companycatalogue` to appear benign.(Citation: ClearSky Siamesekitten August 2021)","relationship_id":"relationship--7b43c9ba-49bc-4966-a987-2f991d0f44a2","references":[{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--37e3dbd7-9ecc-4e3a-9fa3-488e3a910f55","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1046","name":"PowGoop","url":"https://attack.mitre.org/software/S1046","kind":"malware","description":"[PowGoop](https://attack.mitre.org/software/S1046) has disguised a PowerShell script as a .dat file (goopdate.dat).(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--757e8e47-b89d-4a70-a785-deefe6468006","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066)'s payload has been renamed `PowerShellInfo.exe`.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--5c6230da-a47d-435f-9836-49648f03e76e","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) can masquerade as pirated media content for initial delivery to victims.(Citation: Ensilo Darkgate 2018)","relationship_id":"relationship--fd094102-e496-4dcf-bbf1-1630a762019d","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1164","name":"UPSTYLE","url":"https://attack.mitre.org/software/S1164","kind":"malware","description":"[UPSTYLE](https://attack.mitre.org/software/S1164) has masqueraded filenames using examples such as `update.py`.(Citation: Volexity UPSTYLE 2024)","relationship_id":"relationship--99bc173b-a825-483c-969e-868356209ff6","references":[{"source_name":"Volexity UPSTYLE 2024","description":"Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024.","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) PE executable payloads have used uncommon but legitimate extensions such as `.com` instead of `.exe`.(Citation: IBM StrelaStealer 2024)","relationship_id":"relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f","references":[{"source_name":"IBM StrelaStealer 2024","description":"Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) malware has masqueraded as legitimate software such as \"PDF Converter Software\" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.(Citation: Kroll RedLine Stealer August 2024)","relationship_id":"relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5","references":[{"source_name":"Kroll RedLine Stealer August 2024","description":"George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)","relationship_id":"relationship--cb88a1a6-33a4-4c1a-a6ad-10b4b5f827dd","references":[{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","description":"Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has masqueraded as legitimate VSCode extensions.(Citation: Aikido GlassWorm October 2025)(Citation: Koi GlassWorm Rust December 2025)  [GlassWorm](https://attack.mitre.org/software/S9010) has also impersonated Github projects.(Citation: Aikido GlassWorm October 2025)","relationship_id":"relationship--61f793e5-6b95-46db-a54d-74745747a3d5","references":[{"source_name":"Aikido GlassWorm October 2025","description":"Ilyas Makari. (2025, October 31). The Return of the Invisible Threat: Hidden PUA Unicode Hits GitHub repositorties. Retrieved April 10, 2026.","url":"https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties"},{"source_name":"Koi GlassWorm Rust December 2025","description":"Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has been named after well-known files schtask.exe, schtask2.exe, and <redacted>_update.exe.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)","relationship_id":"relationship--c5fe3e1e-775e-4fe6-8a70-0a7e70835081","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"},{"source_name":"ESET DynoWiper Update JAN 2026","description":"ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.","url":"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has renamed the WinRAR utility to avoid detection.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--a292f2c5-a071-424e-b8b8-03d195c466ad","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.(Citation: Leonard TAG 2023)","relationship_id":"relationship--34371a06-bc30-47c0-89c7-cae8bb7a6f22","references":[{"source_name":"Leonard TAG 2023","description":"Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has used [esentutl](https://attack.mitre.org/software/S0404) to change file extensions to their true type that were masquerading as .txt files.(Citation: FireEye APT10 Sept 2018) ","relationship_id":"relationship--06b18704-e29e-4bf9-900f-44aa719df0c6","references":[{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used .doc file extensions to mask malicious executables.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--2ffc25c4-3939-40df-841c-91059c6879d4","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) has disguised a Cobalt Strike beacon as a Flash Installer.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--0d7c99f4-b1af-4278-b8bf-3bb04cce166d","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has masked executables with document file icons including Word and Adobe PDF.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--2f2432b0-d985-41d8-bc47-e4aa1dbf8372","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"G0068","name":"PLATINUM","url":"https://attack.mitre.org/groups/G0068","kind":"intrusion-set","description":"[PLATINUM](https://attack.mitre.org/groups/G0068) has renamed rar.exe to avoid detection.(Citation: Twitter ItsReallyNick Platinum Masquerade)","relationship_id":"relationship--f3b19f07-d8a9-4aca-a649-039024997a4f","references":[{"source_name":"Twitter ItsReallyNick Platinum Masquerade","description":"Carr, N.. (2018, October 25). Nick Carr Status Update. Retrieved September 12, 2024.","url":"https://x.com/ItsReallyNick/status/1055321868641689600"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018) [Windshift](https://attack.mitre.org/groups/G0112) has also attempted to hide executables by changing the file extension to \".scr\" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--ad880548-e776-4e7b-995d-ce6fdc91e865","references":[{"source_name":"objective-see windtail1 dec 2018","description":"Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3B.html"},{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"id":"G0127","name":"TA551","url":"https://attack.mitre.org/groups/G0127","kind":"intrusion-set","description":"[TA551](https://attack.mitre.org/groups/G0127) has masked malware DLLs as dat and jpg files.(Citation: Unit 42 TA551 Jan 2021)","relationship_id":"relationship--f2e075b3-1125-4259-bf0b-1ff90c738354","references":[{"source_name":"Unit 42 TA551 Jan 2021","description":"Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)","relationship_id":"relationship--a3990ec1-b4bb-43dd-b7d8-51bd3cb7e1c7","references":[{"source_name":"Google Election Threats October 2020","description":"Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source_name":"Zscaler APT31 Covid-19 October 2020","description":"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"id":"G0133","name":"Nomadic Octopus","url":"https://attack.mitre.org/groups/G0133","kind":"intrusion-set","description":"[Nomadic Octopus](https://attack.mitre.org/groups/G0133) attempted to make [Octopus](https://attack.mitre.org/software/S0340) appear as a  Telegram Messenger with a Russian interface.(Citation: Securelist Octopus Oct 2018)","relationship_id":"relationship--3cc1b62f-5059-4fb1-be06-72bb13498002","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has disguised their scripts with docker-related file names.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--970e9eb2-51d7-4986-9480-d8a3b59c3006","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0140","name":"LazyScripter","url":"https://attack.mitre.org/groups/G0140","kind":"intrusion-set","description":"[LazyScripter](https://attack.mitre.org/groups/G0140) has used several different security software icons to disguise executables.(Citation: MalwareBytes LazyScripter Feb 2021) ","relationship_id":"relationship--99717cce-1987-4ca1-8df2-c6ec6ce17cf5","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has renamed the legitimate Sysinternals tool procdump to alternative names such as <code>dump64.exe</code> to evade detection.(Citation: Cadet Blizzard emerges as novel threat actor)","relationship_id":"relationship--33134dd2-7bc5-47a1-a06a-101f3ecf2878","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"id":"G1007","name":"Aoqin Dragon","url":"https://attack.mitre.org/groups/G1007","kind":"intrusion-set","description":"[Aoqin Dragon](https://attack.mitre.org/groups/G1007) has used fake icons including antivirus and external drives to disguise malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--945ebd48-f638-469c-a106-113ab8bbf408","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has masqueraded staged data by using the Windows [certutil](https://attack.mitre.org/software/S0160) utility to generate fake Base64 encoded certificates with the input file.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--a53879ca-2185-42ea-84de-823878fb871d","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) used the Plink tool for tunneling and connections to remote machines, renaming it <code>systems.exe</code> in some instances.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--73952ccb-9ad7-405d-94f4-ad75fdfb8507","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.(Citation: SentinelOne WinterVivern 2023)","relationship_id":"relationship--c3c1440f-4585-47a6-8864-e5d3a22c2b84","references":[{"source_name":"SentinelOne WinterVivern 2023","description":"Tom Hegel. (2023, March 16). Winter Vivern | Uncovering a Wave of Global Espionage. Retrieved July 29, 2024.","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"id":"G1046","name":"Storm-1811","url":"https://attack.mitre.org/groups/G1046","kind":"intrusion-set","description":"[Storm-1811](https://attack.mitre.org/groups/G1046) has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.(Citation: rapid7-email-bombing)","relationship_id":"relationship--b771894c-366a-4e73-af67-d6d43d2c9881","references":[{"source_name":"rapid7-email-bombing","description":"Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has delivered [BeaverTail](https://attack.mitre.org/software/S1246) malware masquerading as legitimate software or applications.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024) [Contagious Interview](https://attack.mitre.org/groups/G1052) has also delivered malicious payloads masquerading as legitimate software drivers.(Citation: Sekoia ClickFake 2025)","relationship_id":"relationship--18ff6d49-0bcb-4878-8a01-821ad1091ef0","references":[{"source_name":"Sekoia ClickFake 2025","description":"Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","description":"Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) has fabricated the version information of payload files to evade detection.(Citation: SoučekESET_Gentlemen_Jun2026)","relationship_id":"relationship--4f2f6d11-519c-4489-9104-e3d3b72ef3a8","references":[{"source_name":"SoučekESET_Gentlemen_Jun2026","description":"Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.  ","relationship_id":"relationship--2c595799-aebe-40f3-baa1-0e52cacee8b5","references":[]},{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.","relationship_id":"relationship--25207694-a0db-46df-bbe8-f700aeb80418","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Use file system access controls to protect folders such as C:\\\\Windows\\\\System32.","relationship_id":"relationship--72de6e56-e5d1-4a3f-aa85-d7155f7ff42c","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.","relationship_id":"relationship--eb5ade8c-73e9-4b69-9dea-c8a8206dec25","references":[]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).","relationship_id":"relationship--5566a165-9435-4683-9461-870f15450fd3","references":[]},{"id":"M1045","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M1045","kind":"course-of-action","description":"Require signed binaries.","relationship_id":"relationship--4fd3ec25-00ed-48c1-af72-e2523959860e","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Audit user accounts to ensure that each one has a defined purpose.","relationship_id":"relationship--0446f0ed-4214-4294-ba65-962b4fe08b08","references":[]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Anti-virus can be used to automatically quarantine suspicious files.","relationship_id":"relationship--dc595175-bd4d-4409-829b-43c42b762647","references":[]}],"candidates":[{"id":"4449c89b-ec82-43a4-89c1-91e2f1abeecc","name":"Malware Masquerading and Execution from Zip File","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036/T1036.yaml","description":"When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique [as reported here](https://twitter.com/ffforward/status/1481672378639912960)","inputs":{"url":{"description":"Location of zip file","type":"url","default":"https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036/bin/T1036.zip"}},"dependencies":[{"description":"Zip file must be present."}],"source_definition_sha256":"83b180cd78db858d4939ab080dfb3efe2f21a0cbf3b27ffd75b95752188d5017"},{"id":"51005ac7-52e2-45e0-bdab-d17c6d4916cd","name":"System File Copied to Unusual Location","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1036/T1036.yaml","description":"It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.","inputs":{},"dependencies":[],"source_definition_sha256":"4dbfaf83b6aabc45882e270120f46b0fdfa02596cea72ed83dcd515544ae1ebc"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1036":"/ttp-simulation/techniques/enterprise/T1036/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1036","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0028","collector":"illustrative-lab-collector","observation":{"image_id":"image-lab-1","owner":"lab-account","state":"available","platform":"Linux","public":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0034","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image":"/usr/bin/sleep","owner_uid":1000,"started_at":"2026-09-27T11:59:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0041","collector":"illustrative-lab-collector","observation":{"service":"LabService","executable":"C:\\Lab\\service.exe","start_mode":"manual","state":"stopped"}}]}}