ATT&CK coverage › Technique

Masquerading T1036

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Events covered

13 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon5Process terminated
Sysmon7Image loaded
Sysmon11FileCreate
Security-Auditing4688A new process has been created.
Security-Auditing4689A process has exited.
Security-Auditing4720A user account was created.
Security-Auditing4768A Kerberos authentication ticket (TGT) was requested.
Security-Auditing4781The name of an account was changed.
Security-Auditing5058Key file operation.
Security-Auditing5059Key migration operation.
Security-Auditing5379Credential Manager credentials were read.
Service-Control-Manager7045A service was installed in the system.

Authoring guide

Patterns shared across the 49 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (30 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Image29ends_with 27, match 8, starts_with 3, is_null 1, eq 1\rundll32.exe, \createdump.exe, \DumpMinitool.arm64.exe, \DumpMinitool.x86.exe, :\Windows\SysWOW64\
CommandLine25match 20, ends_with 5, starts_with 1, in 1, eq 1accepteula, -s, --full , -f , Mini
OriginalFileName12eq 12FX_VER_INTERNALNAME_STR, DumpMinitool.arm64.exe, DumpMinitool.exe, DumpMinitool.x86.exe, COMSVCS.DLL
EventID6eq 65058, 5059, 4768, 4688, 7045
ParentImage6ends_with 6, match 1:\Windows\SysWOW64\, \forfiles.exe, :\Windows\System32\, \taskmgr.exe, \sdiagnhost.exe
TargetFilename5match 2, in 2, ends_with 1, starts_with 1, eq 1А, р, һ, .ps1, .exe
process_name3eq 1, ne 1, in 1rundll32.exe, "explorer.exe", "svchost.exe", "tcc.exe"
EventData2contains 2%%2499, %%2464
Computer2contains 2<YOUR CA MACHINE NAME>
user2eq 1, match 1HomeGroupUser$, AUTORI, AUTHORI
file_name2in 2"*.bat", "*.js", "*.cmd"
event.category1eq 1process
data_stream.dataset1eq 1windows.sysmon_operational
Imphash1eq 1EADBCCBB324829ACB5F2BBE87E5549A8
EventType1eq 1renamed-user-account

Top indicator values (479 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
Imageends_with\rundll32.exe576
Imageends_with\cmd.exe392
Imageends_with\wscript.exe364
Imageends_with\cscript.exe364
Imageends_with\regsvr32.exe357
Imageends_with\pwsh.exe3140
Imageends_with\powershell.exe3143
EventDatacontains%%24992
Computercontains<YOUR CA MACHINE NAME>2
CommandLinematch-s22
CommandLinematch-q22
CommandLinematch-r23
CommandLinematchaccepteula23
CommandLinematch.dmp 22
Imageends_with\createdump.exe22
OriginalFileNameeqFX_VER_INTERNALNAME_STR22
CommandLinematch --full 22
CommandLinematch -f 25
CommandLinematch -u 24
CommandLinematch --name 22

Common exclusions (10 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
CommandLinematchsdelete2
file.nameeqCOMSVCS.DLL1
NewTargetUserNameends_with$1
Computerstarts_withCleanAccount1
Processends_withsdelete.exe1
TargetFilenameeq"*\\__PSScriptPolicyTest_*"1
Imagein"C:\\Program Files\\*"1
Imagein"C:\\Program Files (x86)\\*"1
Imagein"*:\\Windows\\SysWOW64\\*"1
Imagein"*:\\Windows\\System32\\*"1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 36 rules

Elastic 2 rules

Splunk 6 rules

Kusto Query Language 5 rules