T1036 · Masquerading

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1036 · Masquerading · Sunturai

attack-patternenterprise-attackT1036

Masquerading

attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site)

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

12 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

152 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Process Backgrounded by Unusual Parent	Low	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
Cisco NVM - Non-Network Binary Making Network Connection	Informational	Splunk security content	Oct 6, 2026	Apache License 2.0
Masquerading Space After Filename	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
Lure-Themed Internet-Delivered RMM Executable	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Check Point Exposure Management - Argos alerts to incidents	Medium	Microsoft Sentinel analytics	Sep 25, 2026	MIT License
Unusual Parent-Child Relationship	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
UAC Bypass Attempt via Windows Directory Masquerading	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privileged Escalation via SamAccountName Spoofing	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious DLL Loaded for Persistence or Privilege Escalation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Privilege Escalation via InstallerFileTakeOver	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential privilege escalation via CVE-2022-38028	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Expired or Revoked Driver Loaded	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Startup Folder Persistence via Unsigned Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unsigned DLL Loaded by Svchost	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential CVE-2025-33053 Exploitation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Data Exfiltration via Rclone	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Conhost Spawned By Suspicious Parent Process	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Process Execution via Renamed PsExec Executable	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Execution from Unusual Directory - Command Line	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Signed Proxy Execution via MS Work Folders	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Untrusted Driver Loaded	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unsigned DLL Side-Loading from a Suspicious Folder	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Zoom Child Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Renamed Utility Executed with Short Program Name	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
File with Right-to-Left Override Character (RTLO) Created/Executed	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0

Showing 25 of 152

Filter in the catalogue

External references

mitre-attackT1036Open reference

LOLBAS Main SiteOpen reference

Platforms

ContainersESXiLinuxmacOSWindows

Kill chain phases

stealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object