Masquerading

What is Masquerading?

“Masquerading is documented as technique T1036 in MITRE ATT&CK® v19.1 under the Defense Evasion tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Masquerading activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for processes running from unusual filesystem paths using names that match legitimate Windows system binaries, as system processes like svchost.exe should only run from C:\Windows\System32 and should have specific parent processes.

2. 2

   Verify digital signatures of processes running with names matching known system binaries, as legitimate Microsoft system files are always digitally signed while masquerading malware typically lacks valid signatures.

3. 3

   Alert on processes with double file extensions or executable files with non-executable extension icons, which are commonly used to trick users into executing malware disguised as documents or images.

4. 4

   Track processes executing from non-standard locations such as user profile directories, temporary folders, or recycle bin paths, as legitimate applications rarely execute from these locations.

5. 5

   Correlate masquerading attempts with other suspicious activity including network connections, registry modifications, and file creation events to build a complete picture of the attack chain.

Example Alerts

These realistic alert examples show what Masquerading looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Masquerading?

Detection centers on XDR, SIEM telemetry for the defense evasion phase of the attack. Monitor for processes running from unusual filesystem paths using names that match legitimate Windows system binaries, as system processes like svchost.exe should only run from C:\Windows\System32 and should have specific parent processes. Verify digital signatures of processes running with names matching known system binaries, as legitimate Microsoft system files are always digitally signed while masquerading malware typically lacks valid signatures.

What does a Masquerading alert look like?

A representative XDR detection is "Legitimate Process Name Used by Malware" (high severity): Process "svchost.exe" detected executing from C:\Users\jdoe\AppData\Roaming\Microsoft\svchost.exe. Legitimate svchost.exe processes run exclusively from C:\Windows\System32. The file is not digitally signed and its behavior profile shows network scanning activity and credential harvesting techniques consistent with a post-exploitation framework.

Which tools detect Masquerading, and how can I practice?

Masquerading (T1036) is best surfaced with XDR, SIEM telemetry, which exposes the defense evasion signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.