1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T0849 Masquerading — Attack Simulation

Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the…

Complete technique description

Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions.

Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment.

Official technique definition · Open in the interactive matrix

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

File Metadata · source-mapped

DC0059 collection page — Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.

Providers and collection configuration

  • osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
  • Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
  • Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
  • Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
  • Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: path, size_bytes, sha256, owner_uid.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0059",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "/opt/lab/demo.txt",
    "size_bytes": 64,
    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "owner_uid": 1000
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

Network Traffic Content · source-mapped

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

  • Zeek: Connection and protocol metadata from traffic visible to the sensor.
  • Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
  • Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
  • Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
  • Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

Process Metadata · source-mapped

DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.

Providers and collection configuration

  • osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
  • Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.
  • Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
  • Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
  • Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: process_id, image, owner_uid, started_at.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0034",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image": "/usr/bin/sleep",
    "owner_uid": 1000,
    "started_at": "2026-09-27T11:59:00Z"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

Scheduled Job Creation · source-mapped

DC0001 collection page — Enable Audit Other Object Access Events for Windows task creation (4698); retain task XML. For cron/systemd timers, collect scheduler definitions and change events separately.

Providers and collection configuration

  • Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
  • For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
  • Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: task_name, action, principal, schedule, program.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0001",
  "collector": "illustrative-lab-collector",
  "observation": {
    "task_name": "LabDailyCheck",
    "action": "create",
    "principal": "lab-user",
    "schedule": "daily",
    "program": "lab-check.exe"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

Service Creation · source-mapped

DC0060 collection page — Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.

Providers and collection configuration

  • Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
  • For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
  • Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: service, action, executable, actor.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0060",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "LabService",
    "action": "install",
    "executable": "C:\\Lab\\service.exe",
    "actor": "lab-admin"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0725 Detection of Masquerading

MITRE detection strategy

AN1858 Analytic 1858

Real-time monitoring identifies a process or scheduled task whose displayed name matches a known Industrial Control System (ICS) vendor application but whose on-disk binary hash or file path does not match the vendor-signed baseline. The mismatch -- name says one thing, binary integrity says another -- is the defining signal. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Platforms: Windows.

  • Scheduled Job Creation — WinEventLog:Security; channel Windows Security Event ID 4698/4702: EventCode=4698 referencing Industrial Control Systems (ICS) vendor binary name from unauthorized process.
  • File Metadata — WinEventLog:Sysmon; channel EventCode=11 matching Industrial Control Systems (ICS) vendor binary name in a path outside vendor install paths.
  • Process Metadata — WinEventLog:Sysmon; channel EventCode=1 where image filename matches Industrial Control Systems (ICS) vendor process names but hash not in vendor hash baseline or current directory outside vendor install paths.
  • Service Creation — WinEventLog:System; channel EventCode=7045 where ServiceName/ImagePath references Industrial Control Systems (ICS) vendor application with hash/path mismatch.

AN2123 Analytic 2123

Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Platforms: Linux.

  • Process Metadata — auditd:SYSCALL; channel Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve where exe basename matches Industrial Control Systems (ICS) daemon names but path outside vendor install paths.
  • File Metadata — linux:pkgintegrity; channel rpm -V/dpkg --verify checksum mismatch for installed Industrial Control Systems (ICS) package binary.

AN2231 Analytic 2231

Real-time monitoring identifies an ICS device presenting protocol identity attributes (for example vendor, product, model, or capability identifiers) that conflict with the identity and capabilities recorded for that network address/device in the authorized asset inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Platforms: Embedded.

  • Network Traffic Content — NSM:Content; channel GetIdentity/Identity Object response vendor/product string does not match enrolled asset inventory for device_ip.

AN2287 Analytic 2287

Real-time monitoring identifies traffic on an Industrial Control System (ICS) protocol port (e.g., 502, 20000, 44818, etc.) with payload content that does not conform to the expected protocol structure for that port, suggesting non-ICS traffic tunneled over ICS port numbers to evade port-based filtering or blend with expected traffic patterns. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Platforms: Network Devices.

  • Network Traffic Content — otids:ProtocolDecoder; channel Protocol decoder/IDS transaction/signature: exploit-relevant request against ICS remote service from unexpected source, correlated with subsequent endpoint/device anomaly.
Source rule directory and observation requirements

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

Before treating a rule as coverage

  1. Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
  2. Map native sensor fields, parse times and identities, then compile for the selected backend.
  3. Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
  4. Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T0849 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

  • Host state and inventory: Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion.
  • Network and protocol telemetry: Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects.
  • Windows and directory audit: Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance.
  1. Define an entity/peer group and feature; exclude the evaluation period from baseline training.
  2. Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
  3. Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
  4. Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

4 source-documented software associations
  • S0496 REvil — malware.

    REvil searches for whether the Ahnlab autoup.exe service is running on the target system and injects its payload into this existing process. [Tom Fakterman August 2019]

    Exact relationship: relationship--5e099568-fb5c-4f58-af7e-4e1b7a9d1128
  • S0603 Stuxnet — malware.

    Stuxnet renames s7otbxdx.dll, a dll responsible for handling communications with a PLC. It replaces this dll file with its own version that allows it to intercept any calls that are made to access the PLC. [Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

    Exact relationship: relationship--0e29f62d-4ffc-47ec-9623-72f874fbe905
  • S0605 EKANS — malware.

    EKANS masquerades itself as a valid executable with the filename update.exe. Many valid programs use the process name update.exe to perform background software updates. [Dragos Threat Intelligence February 2020]

    Exact relationship: relationship--c347b69c-e3f6-4eca-ba57-0781c7dc8eac
  • S1009 Triton — malware.

    Triton's injector, inject.bin, masquerades as a standard compiled PowerPC program for the Tricon. [DHS CISA February 2019]

    Triton was configured to masquerade as trilog.exe, which is the Triconex software for analyzing SIS logs.[FireEye TRITON]

    Exact relationship: relationship--350814da-5c36-42f9-8e58-8f9534e6ce0a

Simulation design and documented procedures

Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.

Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.

No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.

Technique-specific experiment contract

  1. Choose one procedure implementing T0849 Masquerading; identify the observable behavior in the source definition, not just its tactic.
  2. Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
  3. Enable the collection sources above and verify a benign baseline reaches the detector.
  4. Run only the approved isolated scenario; capture native events and an independent behavior observable.
  5. Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.

Synthetic logs and offline contract check

Download synthetic collection fixture (JSON) · Download the complete engineering workbook

This fixture exercises the listed collection fields. It does not reproduce Masquerading, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.

Not run in this browser. No network scan or attack command is executed by this control.

Validation status and remaining work

Source identity
Joined by exact technique/object IDs against hash-pinned sources.
Collection fixture
Available for offline schema exercises; not attack emulation.
Native telemetry / backend / real attack
Not validated for these imported procedures. Source fidelity and page tests cannot establish sensor or detector effectiveness.

All-page audit and evidence inventory · This page’s machine-readable workbook

Sources and evidence boundaries

Pinned MITRE STIX source · SHA-256 c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.

Source-linked mitigations

Connected ecosystem references

Linked tags

icscloud-hosted-endpointics-otnetwork-infrastructureonpremEmbeddedWindowsLinuxNetwork Devicesevasionisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requiredot_fixture_and_process_safety_review
No Atomic candidate in snapshottechniquesource_mapped

Detection and collection

T0849 detection workspace

No reviewed association in this snapshot.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.