MITRE ATT&CK - Техника Подбор легитимного имени или расположения

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Masquerading: Подбор легитимного имени или расположения

Other sub-techniques of Masquerading (7)

ID	Название
.001	Недействительная подпись кода
.002	Использование символа RLO
.003	Переименование системных утилит
.004	Имитация задачи или службы
.005	Подбор легитимного имени или расположения
.006	Пробел после имени файла
.007	Двойное расширение файла

Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous. Adversaries may also use the same icon of the file they are trying to mimic.

ID: T1036.005

Относится к технике: T1036

Тактика(-и): Defense Evasion

Платформы: Containers, Linux, macOS, Windows

Источники данных: File: File Metadata, Image: Image Metadata, Process: Process Metadata

Версия: 1.1

Дата создания: 10 Feb 2020

Последнее изменение: 05 May 2022

Название	Описание
Примеры процедур
Misdat	Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.(Citation: Cylance Dust Storm)(Citation: Microsoft DTC)
RainyDay	RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.(Citation: Bitdefender Naikon April 2021)
TeamTNT	TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.(Citation: Cisco Talos Intelligence Group)
MechaFlounder	MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.(Citation: Unit 42 MechaFlounder March 2019)
PcShare	PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.(Citation: Bitdefender FunnyDream Campaign November 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
Elise	If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.(Citation: Lotus Blossom Jun 2015)
OwaAuth	OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in `%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\`; the malicious file by the same name is saved in `%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\`.(Citation: Dell TG-3390)
Bundlore	Bundlore has disguised a malicious .app file as a Flash Player update.(Citation: MacKeeper Bundlore Apr 2019)
S-Type	S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.(Citation: Cylance Dust Storm)(Citation: Microsoft DTC)
DanBot	DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.(Citation: ClearSky Siamesekitten August 2021)
Cyclops Blink	Cyclops Blink can rename its running process to `[kworker:0/1]` to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.(Citation: NCSC Cyclops Blink February 2022)
Gamaredon Group	Gamaredon Group has used legitimate process names to hide malware including `svchosst`.(Citation: Unit 42 Gamaredon February 2022)
TinyTurla	TinyTurla has been deployed as `w64time.dll` to appear legitimate.(Citation: Talos TinyTurla September 2021)
Carberp	Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".(Citation: Prevx Carberp March 2011)(Citation: Trusteer Carberp October 2010)
BRONZE BUTLER	BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Pony	Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.(Citation: Malwarebytes Pony April 2016)
IceApple	IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.(Citation: CrowdStrike IceApple May 2022)
Felismus	Felismus has masqueraded as legitimate Adobe Content Management System files.(Citation: Forcepoint Felismus Mar 2017)
APT41	APT41 attempted to masquerade their files as popular anti-virus software.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
REvil	REvil can mimic the names of known executables.(Citation: Picus Sodinokibi January 2020)
Grandoreiro	Grandoreiro has named malicious browser extensions and update files to appear legitimate.(Citation: IBM Grandoreiro April 2020)(Citation: ESET Grandoreiro April 2020)
Indrik Spider	Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.(Citation: Crowdstrike Indrik November 2018)
FIN7	FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.(Citation: CrowdStrike Carbon Spider August 2021)
Skidmap	Skidmap has created a fake `rm` binary to replace the legitimate Linux binary.(Citation: Trend Micro Skidmap)
Tarrask	Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.(Citation: Tarrask scheduled task)
OLDBAIT	OLDBAIT installs itself in `%ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe`; the directory name is missing a space and the file name is missing the letter "o."(Citation: FireEye APT28)
Sibot	Sibot has downloaded a DLL to the `C:\windows\system32\drivers\` folder and renamed it with a `.sys` extension.(Citation: MSTIC NOBELIUM Mar 2021)
MuddyWater	MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.(Citation: FireEye MuddyWater Mar 2018)(Citation: Talos MuddyWater May 2019)(Citation: Anomali Static Kitten February 2021)
PyDCrypt	PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.(Citation: Checkpoint MosesStaff Nov 2021)
WIRTE	WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.(Citation: Kaspersky WIRTE November 2021)
Patchwork	Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor."(Citation: Cymmetria Patchwork) They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.(Citation: Volexity Patchwork June 2018)
BLINDINGCAN	BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".(Citation: US-CERT BLINDINGCAN Aug 2020)
HermeticWizard	HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.(Citation: ESET Hermetic Wizard March 2022)
RDAT	RDAT has masqueraded as VMware.exe.(Citation: Unit42 RDAT July 2020)
Remsec	The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)
Raindrop	Raindrop was installed under names that resembled legitimate Windows file and directory names.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Transparent Tribe	Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.(Citation: Kaspersky Transparent Tribe August 2020)
admin@338	admin@338 actors used the following command to rename one of their tools to a benign file name: `ren "%temp%\upload" audiodg.exe`(Citation: FireEye admin@338)
Earth Lusca	Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.(Citation: TrendMicro EarthLusca 2022)
Mis-Type	Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.(Citation: Cylance Dust Storm)(Citation: Microsoft DTC)
BackdoorDiplomacy	BackdoorDiplomacy has dropped implants in folders named for legitimate software.(Citation: ESET BackdoorDiplomacy Jun 2021)
KGH_SPY	KGH_SPY has masqueraded as a legitimate Windows tool.(Citation: Cybereason Kimsuky November 2020)
Bad Rabbit	Bad Rabbit has masqueraded as a Flash Player installer through the executable file `install_flash_player.exe`.(Citation: ESET Bad Rabbit)(Citation: Secure List Bad Rabbit)
Dtrack	One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.(Citation: CyberBit Dtrack)
Ferocious Kitten	Ferocious Kitten has named malicious files `update.exe` and loaded them into the compromise host's “Public” folder.(Citation: Kaspersky Ferocious Kitten Jun 2021)
SUGARDUMP	SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.(Citation: Mandiant UNC3890 Aug 2022)
PUNCHBUGGY	PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Morphisec ShellTea June 2019)
Octopus	Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
Ryuk	Ryuk has constructed legitimate appearing installation folder paths by calling `GetWindowsDirectoryW` and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as `C:\Users\Public`.(Citation: CrowdStrike Ryuk January 2019)
HTTPBrowser	HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.(Citation: ZScaler Hacking Team)
NOKKI	NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.(Citation: Unit 42 NOKKI Sept 2018)
LightNeuron	LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as `winmail.dat`.(Citation: ESET LightNeuron May 2019)
APT29	APT29 renamed software and DLL's with legitimate names to appear benign.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: SentinelOne NobleBaron June 2021)
APT28	APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)
	During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.(Citation: Cybereason OperationCuckooBees May 2022)
Penquin	Penquin has mimicked the Cron binary to hide itself on compromised systems.(Citation: Leonardo Turla Penquin May 2020)
LookBack	LookBack has a C2 proxy tool that masquerades as `GUP.exe`, which is software used by Notepad++.(Citation: Proofpoint LookBack Malware Aug 2019)
GoldenSpy	GoldenSpy's setup file installs initial executables under the folder `%WinDir%\System32\PluginManager`.(Citation: Trustwave GoldenSpy June 2020)
Naikon	Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.(Citation: Bitdefender Naikon April 2021)
AppleSeed	AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.(Citation: Malwarebytes Kimsuky June 2021)
Small Sieve	Small Sieve can use variations of Microsoft and Outlook spellings, such as "Microsift", in its file names to avoid detection.(Citation: NCSC GCHQ Small Sieve Jan 2022)
Ursnif	Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.(Citation: TrendMicro Ursnif Mar 2015)
Machete	Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.(Citation: ESET Machete July 2019)(Citation: Securelist Machete Aug 2014)
Chimera	Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.(Citation: Cycraft Chimera April 2020)
ThiefQuest	ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.(Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)
ShimRatReporter	ShimRatReporter spoofed itself as `AlphaZawgyl_font.exe`, a specialized Unicode font.(Citation: FOX-IT May 2016 Mofang)
Bazar	The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)(Citation: CrowdStrike Wizard Spider October 2020)
TAINTEDSCRIBE	The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
DRATzarus	DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.(Citation: ClearSky Lazarus Aug 2020)
Bumblebee	Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.(Citation: Medium Ali Salem Bumblebee April 2022)
APT32	APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe. (Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)
MCMD	MCMD has been named Readme.txt to appear legitimate.(Citation: Secureworks MCMD July 2019)
StrifeWater	StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.(Citation: Cybereason StrifeWater Feb 2022)
SUNBURST	SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.(Citation: Microsoft Deep Dive Solorigate January 2021)
Ke3chang	Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.(Citation: Microsoft NICKEL December 2021)
QUADAGENT	QUADAGENT used the PowerShell filenames `Office365DCOMCheck.ps1` and `SystemDiskClean.ps1`.(Citation: Unit 42 QUADAGENT July 2018)
Ramsay	Ramsay has masqueraded as a 7zip installer.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Tropic Trooper	Tropic Trooper has hidden payloads in Flash directories and fake installer files.(Citation: TrendMicro Tropic Trooper May 2020)
Magic Hound	Magic Hound has used the name dllhost.exe to mask a malicious tool used in C2.(Citation: DFIR Report APT35 ProxyShell March 2022)
SUPERNOVA	SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.(Citation: Guidepoint SUPERNOVA Dec 2020)(Citation: Unit42 SUPERNOVA Dec 2020)
PlugX	PlugX has been disguised as legitimate Adobe and PotPlayer files.(Citation: Proofpoint TA416 Europe March 2022)
OSX/Shlayer	OSX/Shlayer can masquerade as a Flash Player update.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)
Starloader	Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.(Citation: Symantec Sowbug Nov 2017)
Chaes	Chaes has used an unsigned, crafted DLL module named `hha.dll` that was designed to look like a legitimate 32-bit Windows DLL.(Citation: Cybereason Chaes Nov 2020)
PROMETHIUM	PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Aoqin Dragon	Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.(Citation: SentinelOne Aoqin Dragon June 2022)
Shark	Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.(Citation: ClearSky Siamesekitten August 2021)
FoggyWeb	FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.(Citation: MSTIC FoggyWeb September 2021)
NETWIRE	NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.(Citation: Red Canary NETWIRE January 2020)
USBStealer	USBStealer mimics a legitimate Russian program called USB Disk Security.(Citation: ESET Sednit USBStealer 2014)
MarkiRAT	MarkiRAT can masquerade as `update.exe` and `svehost.exe`; it has also mimicked legitimate Telegram and Chrome files.(Citation: Kaspersky Ferocious Kitten Jun 2021)
	During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.(Citation: FoxIT Wocao December 2019)
HermeticWiper	HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.(Citation: ESET Hermetic Wizard March 2022)
Whitefly	Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.(Citation: Symantec Whitefly March 2019)
Nebulae	Nebulae uses functions named `StartUserModeBrowserInjection` and `StopUserModeBrowserInjection` indicating that it's trying to imitate chrome_frame_helper.dll.(Citation: Bitdefender Naikon April 2021)
TRITON	TRITON disguised itself as the legitimate Triconex Trilog application.(Citation: FireEye TRITON 2017)
UNC2452	UNC2452 renamed a version of AdFind to `sqlceip.exe` or `csrss.exe` in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process, respectively.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Machete	Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.(Citation: 360 Machete Sep 2020)
KOCTOPUS	KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.(Citation: MalwareBytes LazyScripter Feb 2021)
TEARDROP	TEARDROP files had names that resembled legitimate Window file and directory names.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Deep Dive Solorigate January 2021)
TEMP.Veles	TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.(Citation: FireEye TRITON 2019)
Carbanak	Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.(Citation: Kaspersky Carbanak)
	During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.(Citation: McAfee Honeybee)
Lazarus Group	Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)(Citation: ESET Lazarus Jun 2020)(Citation: Qualys LolZarus)
Doki	Doki has disguised a file as a Linux kernel module.(Citation: Intezer Doki July 20)
SUNSPOT	SUNSPOT was identified on disk with a filename of `taskhostsvc.exe` and it created an encrypted log file at `C:\Windows\Temp\vmware-vmdmp.log`.(Citation: CrowdStrike SUNSPOT Implant January 2021)
GoldMax	GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike StellarParticle January 2022)
BADNEWS	BADNEWS attempts to hide its payloads using legitimate filenames.(Citation: PaloAlto Patchwork Mar 2018)
SslMM	To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.(Citation: Baumgartner Naikon 2015)
Darkhotel	Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.(Citation: Microsoft DUBNIUM June 2016)
APT1	The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)
FinFisher	FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Blue Mockingbird	Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.(Citation: RedCanary Mockingbird May 2020)
Sidewinder	Sidewinder has named malicious files `rekeywiz.exe` to match the name of a legitimate Windows executable.(Citation: Rewterz Sidewinder COVID-19 June 2020)
Saint Bot	Saint Bot has been disguised as a legitimate executable, including as Windows SDK.(Citation: Malwarebytes Saint Bot April 2021)
ThreatNeedle	ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.(Citation: Kaspersky ThreatNeedle Feb 2021)
InnaputRAT	InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.(Citation: ASERT InnaputRAT April 2018)
Calisto	Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.(Citation: Securelist Calisto July 2018)
PowGoop	PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.(Citation: DHS CISA AA22-055A MuddyWater February 2022)
Daserf	Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.(Citation: Symantec Tick Apr 2016)
menuPass	menuPass has been seen changing malicious files to appear legitimate.(Citation: District Court of NY APT10 Indictment December 2018)
Metamorfo	Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019)
Sowbug	Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory `CSIDL_APPDATA\microsoft\security`.(Citation: Symantec Sowbug Nov 2017)
Pysa	Pysa has executed a malicious executable by naming it svchost.exe.(Citation: CERT-FR PYSA April 2020)
APT39	APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)
Kimsuky	Kimsuky has renamed malware to legitimate names such as `ESTCommon.dll` or `patch.dll`.(Citation: KISA Operation Muzabi)
Green Lambert	Green Lambert has been disguised as a Growl help file.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
Fysbis	Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.(Citation: Fysbis Dr Web Analysis)
Poseidon Group	Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.(Citation: Kaspersky Poseidon Group)
Silence	Silence has named its backdoor "WINWORD.exe".(Citation: Group IB Silence Sept 2018)
Chinoxy	Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.(Citation: Bitdefender FunnyDream Campaign November 2020)
Fox Kitten	Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
ChChes	ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).(Citation: PWC Cloud Hopper Technical Annex April 2017)
Winnti for Windows	A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.(Citation: Microsoft Winnti Jan 2017)
Goopy	Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.(Citation: Cybereason Cobalt Kitty 2017)
SideCopy	SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.(Citation: MalwareBytes SideCopy Dec 2021)
Bisonal	Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.(Citation: Talos Bisonal Mar 2020)
Ixeshe	Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.(Citation: Trend Micro IXESHE 2012)
BackConfig	BackConfig has hidden malicious payloads in `%USERPROFILE%\Adobe\Driver\dwg\` and mimicked the legitimate DHCP service binary.(Citation: Unit 42 BackConfig May 2020)
Cuba	Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.(Citation: McAfee Cuba April 2021)
PipeMon	PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.(Citation: ESET PipeMon May 2020)
Mustang Panda	Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.(Citation: Recorded Future REDDELTA July 2020)
StrongPity	StrongPity has been bundled with legitimate software installation files for disguise.(Citation: Talos Promethium June 2020)
Gelsemium	Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value `Chrome Update` to appear legitimate.(Citation: ESET Gelsemium June 2021)
KONNI	KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.(Citation: Talos Konni May 2017)
DarkComet	DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.(Citation: TrendMicro DarkComet Sept 2014)
EKANS	EKANS has been disguised as `update.exe` to appear as a valid executable.(Citation: Dragos EKANS)
	During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.(Citation: McAfee Sharpshooter December 2018)
InvisiMole	InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
ZLib	ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.(Citation: Cylance Dust Storm)
Sandworm Team	Sandworm Team has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Rocke	Rocke has used shell scripts which download mining executables and saves them with the filename "java".(Citation: Talos Rocke August 2018)

Контрмера	Описание
Контрмеры
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Execution Prevention	Block execution of code on a system through application control, and/or script blocking.
Code Signing	Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.

Обнаружение

Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.