Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Masquerading

Sub-techniques (10)

ID	Name
.001	Invalid Code Signature
.002	Right-to-Left Override
.003	Rename System Utilities
.004	Masquerade Task or Service
.005	Match Legitimate Name or Location
.006	Space after Filename
.007	Double File Extension
.008	Masquerade File Type
.009	Break Process Trees
.010	Masquerade Account Name

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names. Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.(Citation: LOLBAS Main Site)

ID: T1036

Sub-techniques: .001 .002 .003 .004 .005 .006 .007 .008 .009 .010

Tactic(s): Defense Evasion

Platforms: Containers, Linux, macOS, Windows

Data Sources: Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata, User Account: User Account Creation

Version: 1.7

Created: 31 May 2017

Last Modified: 16 Oct 2024

Name	Description
Procedure Examples
menuPass	menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.(Citation: FireEye APT10 Sept 2018)
APT32	APT32 has disguised a Cobalt Strike beacon as a Flash Installer.(Citation: Cybereason Cobalt Kitty 2017)
FatDuke	FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.(Citation: ESET Dukes October 2019)
Raindrop	Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
BRONZE BUTLER	BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.(Citation: Trend Micro Tick November 2019)
AppleSeed	AppleSeed can disguise JavaScript files as PDFs.(Citation: Malwarebytes Kimsuky June 2021)
OilRig	OilRig has used .doc file extensions to mask malicious executables.(Citation: Check Point APT34 April 2021)
Ember Bear	Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as `dump64.exe` to evade detection.(Citation: Cadet Blizzard emerges as novel threat actor)
Sandworm Team	Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.(Citation: Leonard TAG 2023)
Saint Bot	Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Nomadic Octopus	Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.(Citation: Securelist Octopus Oct 2018)
APT29	APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.(Citation: FireEye SUNBURST Backdoor December 2020)
TRITON	TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.(Citation: FireEye TRITON 2017)
XCSSET	XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and `Info.plist`. (Citation: trendmicro xcsset xcode project 2020)
Dragonfly 2.0	Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
DarkTortilla	DarkTortilla's payload has been renamed `PowerShellInfo.exe`.(Citation: Secureworks DarkTortilla Aug 2022)
FoggyWeb	FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.(Citation: MSTIC FoggyWeb September 2021)
Flagpro	Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.(Citation: NTT Security Flagpro new December 2021)
Mustang Panda	Mustang Panda has used an additional filename extension to hide the true file type.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)
Agrius	Agrius used the Plink tool for tunneling and connections to remote machines, renaming it `systems.exe` in some instances.(Citation: Unit42 Agrius 2023)
PowGoop	PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Milan	Milan has used an executable named `companycatalogue` to appear benign.(Citation: ClearSky Siamesekitten August 2021)
WindTail	WindTail has used icons mimicking MS Office files to mask payloads.(Citation: objective-see windtail1 dec 2018)
BoomBox	BoomBox has the ability to mask malicious data strings as PDF files.(Citation: MSTIC Nobelium Toolset May 2021)
Kimsuky	Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.(Citation: KISA Operation Muzabi)
TeamTNT	TeamTNT has disguised their scripts with docker-related file names.(Citation: Cisco Talos Intelligence Group)
LazyScripter	LazyScripter has used several different security software icons to disguise executables.(Citation: MalwareBytes LazyScripter Feb 2021)
APT28	APT28 has renamed the WinRAR utility to avoid detection.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
Ramsay	Ramsay has masqueraded as a JPG image file.(Citation: Eset Ramsay May 2020)
ZIRCONIUM	ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)
FIN13	FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
	KV Botnet Activity involves changing process filename to `pr_set_mm_exe_file` and process name to `pr_set_name` during later infection stages.(Citation: Lumen KVBotnet 2023)
TrickBot	The TrickBot downloader has used an icon to appear as a Microsoft Word document.(Citation: Cyberreason Anchor December 2019)
NotPetya	NotPetya drops PsExec with the filename dllhost.dat.(Citation: Talos Nyetya June 2017)
	For Operation Dust Storm, the threat actors disguised some executables as JPG files.(Citation: Cylance Dust Storm)
UNC2452	UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.(Citation: FireEye SUNBURST Backdoor December 2020)
Windshift	Windshift has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018) Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)
NativeZone	NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.(Citation: SentinelOne NobleBaron June 2021)
Winter Vivern	Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.(Citation: SentinelOne WinterVivern 2023)
WhisperGate	WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.(Citation: Medium S2W WhisperGate January 2022)
Ryuk	Ryuk can create .dll files that actually contain a Rich Text File format document.(Citation: ANSSI RYUK RANSOMWARE)
Lazarus Group	Lazarus Group has disguised malicious template files as JPEG files to avoid detection.(Citation: McAfee Lazarus Jul 2020)
DarkWatchman	DarkWatchman has used an icon mimicking a text file to mask a malicious executable.(Citation: Prevailion DarkWatchman 2021)
RCSession	RCSession has used a file named English.rtf to appear benign on victim hosts.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Trend Micro DRBControl February 2020)
Dacls	The Dacls Mach-O binary has been disguised as a .nib file.(Citation: SentinelOne Lazarus macOS July 2020)
TrailBlazer	TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.(Citation: CrowdStrike StellarParticle January 2022)
	During C0018, AvosLocker was disguised using the victim company name as the filename.(Citation: Cisco Talos Avos Jun 2022)
EnvyScout	EnvyScout has used folder icons for malicious files to lure victims into opening them.(Citation: MSTIC Nobelium Toolset May 2021)
	During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.(Citation: DFIR Conti Bazar Nov 2021)
TA551	TA551 has masked malware DLLs as dat and jpg files.(Citation: Unit 42 TA551 Jan 2021)
PLATINUM	PLATINUM has renamed rar.exe to avoid detection.(Citation: Twitter ItsReallyNick Platinum Masquerade)
SombRAT	SombRAT can use a legitimate process name to hide itself.(Citation: CISA AR21-126A FIVEHANDS May 2021)
RTM	RTM has been delivered as archived Windows executable files masquerading as PDF documents.(Citation: Unit42 Redaman January 2019)
DarkGate	DarkGate can masquerade as pirated media content for initial delivery to victims.(Citation: Ensilo Darkgate 2018)
	During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.(Citation: McAfee Honeybee)
Bisonal	Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.(Citation: Talos Bisonal Mar 2020)

Mitigation	Description
Mitigations
Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
Code Signing	Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
Behavior Prevention on Endpoint	Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior.
Masquerading Mitigation	When creating security rules, avoid exclusions based on file name or file path. Require signed binaries. Use file system access controls to protect folders such as C:\Windows\System32. Use tools that restrict program execution via whitelisting by attributes other than file name. Identify potentially malicious software that may look like a legitimate program based on name and location, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools like AppLocker (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Antivirus/Antimalware	Use signatures or heuristics to detect malicious software.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.

Detection

Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.