Applied Cybernetics Group
T1036.008 Masquerade File Type
- Technique
T1036.008- Tactics
- Defense Evasion
- Research, 90 days
- 2
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 1
- Elastic, Splunk
- 7
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1036/008
MITRE description
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of <code>test.gif</code>. A user may not know that a file is malicious due to the benign appearance and file extension. Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-03Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure -
2026-10-08Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
Detection coverage
SigmaHQ community rules
- Non-DLL Extension File Renamed With DLL Extension (threat-hunting)
Elastic and Splunk rules
- Process Started from Process ID (PID) File (elastic)
- Memory Dump File with Unusual Extension (elastic)
- Archive File with Unusual Extension (elastic)
- Executable File with Unusual Extension (elastic)
- Unusual Process Extension (elastic)
- Suspicious Process Executed From Container File (splunk)
- Windows Executable Masquerading as Benign File Types (splunk)