1200KM / simulation
T1036 Masquerading — Attack Simulation
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming…
Technique description
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Malware Masquerading and Execution from Zip File
Procedure 4449c89b-ec82-43a4-89c1-91e2f1abeecc; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- System File Copied to Unusual Location
Procedure 51005ac7-52e2-45e0-bdab-d17c6d4916cd; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
- APT28 · G0007
- Sandworm Team · G0034
- menuPass · G0045
- OilRig · G0049
- APT32 · G0050
- BRONZE BUTLER · G0060
- PLATINUM · G0068
- Windshift · G0112
- TA551 · G0127
- ZIRCONIUM · G0128
- Nomadic Octopus · G0133
- TeamTNT · G0139
- LazyScripter · G0140
- Ember Bear · G1003
- Aoqin Dragon · G1007
- FIN13 · G1016
- Agrius · G1030
- Winter Vivern · G1035
- Storm-1811 · G1046
- Contagious Interview · G1052
Existing research
Connected anomaly research
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.