T1036 Masquerading

Technique: T1036
Tactics: Defense Evasion
Research, 90 days: 13
KEV CVEs mapped: 2
SigmaHQ rules: 40
Elastic, Splunk: 94
thrunt rules: 1
Upstream: https://attack.mitre.org/techniques/T1036

MITRE description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-03 Microsoft Threat Intelligence: Fake-download campaign uses trojanized installers to deliver monetization payloads
2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
2026-10-30 Microsoft Threat Intelligence: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-27 Socket: Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets
2026-10-26 Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack
2026-10-26 Arctic Wolf: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-10-06 AhnLab ASEC: Q3 2026 Attack Techniques Trend Report
2026-09-29 Microsoft Threat Intelligence: Phishing Abuses RMM Tools for Persistent Access

Showing the 10 most recent of 13.

Detection coverage

thrunt rules

t1059-peoplesoft-psemhub-payload-execution

SigmaHQ community rules

Suspicious Computer Account Name Change CVE-2021-42287 (emerging-threats)
CodePage Modification Via MODE.COM (threat-hunting)
Potentially Suspicious Execution From Tmp Folder (core)
Interactive Bash Suspicious Children (core)
New or Renamed User Account with '$' Character (core)
Password Protected ZIP File Opened (Suspicious Filenames) (core)
Windows Binaries Write Suspicious Extensions (core)
Potential Homoglyph Attack Using Lookalike Characters in Filename (core)
Suspicious Calculator Usage (core)
Suspicious CodePage Switch Via CHCP (core)
CreateDump Process Dump (core)
DumpMinitool Execution (core)
Suspicious DumpMinitool Execution (core)
Explorer Process Tree Break (core)
Findstr Launching .lnk File (core)
Forfiles.EXE Child Process Masquerading (core)
HackTool - XORDump Execution (core)
Potential Fake Instance Of Hxtsr.EXE Executed (core)
CodePage Modification Via MODE.COM To Russian Language (core)
Suspicious MSDT Parent Process (core)
PUA - Potential PE Metadata Tamper Using Rcedit (core)
Renamed CreateDump Utility Execution (core)
Renamed ZOHO Dctask64 Execution (core)
Renamed Plink Execution (core)
Process Memory Dump Via Comsvcs.DLL (core)

Showing 25 of 40 community rules. the full set is tagged attack.t1036 in SigmaHQ.

Elastic and Splunk rules

Agent Spoofing - Multiple Hosts Using Same Agent (elastic)
Masquerading Space After Filename (elastic)
Potential Kubectl Masquerading via Unexpected Process (elastic)
Processes with Trailing Spaces (elastic)
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners (elastic)
System Path File Creation and Execution Detected via Defend for Containers (elastic)
Unusual Process Spawned by a Parent Process (elastic)
Unusual Process Spawned by a User (elastic)
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score (elastic)
Host Detected with Suspicious Windows Process(es) (elastic)
Parent Process Detected with Suspicious Windows Process(es) (elastic)
User Detected with Suspicious Windows Process(es) (elastic)
Network Activity Detected via Kworker (elastic)
System Binary Moved or Copied (elastic)
Directory Creation in /bin directory (elastic)
ELF Binary Created in System Directory by Suspicious Process (elastic)
Potential Fileless Execution via O_TMPFILE (elastic)
Executable Masquerading as Kernel Process (elastic)
Potential Process Name Stomping with Prctl (elastic)
Suspicious Renaming of ESXI Files (elastic)
Abnormal Process ID or Lock File Created (elastic)
Process Backgrounded by Unusual Parent (elastic)
Process Started from Process ID (PID) File (elastic)
Binary Executed from Shared Memory Directory (elastic)
Direct Process Execution via Background Utility (elastic)

Showing 25 of 94.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.