T1036

Official Description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)

Tactics: Stealth
Platforms: Containers, ESXi, Linux, macOS, Windows
MITRE Version: 2.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Sub-techniques (12)

T1036.001 · Invalid Code SignatureT1036.002 · Right-to-Left OverrideT1036.003 · Rename Legitimate UtilitiesT1036.004 · Masquerade Task or ServiceT1036.005 · Match Legitimate Resource Name or LocationT1036.006 · Space after FilenameT1036.007 · Double File ExtensionT1036.008 · Masquerade File TypeT1036.009 · Break Process TreesT1036.010 · Masquerade Account Name

Reported Context (278)

The installer is a shell script posing as a cwpsrv version update. XLab Details CWP Backdoor That Executes Commands Without Access Logs
The infection script posed as an updater while replacing cwpsrv. CWPdoor Backdoor Hides in Trojanized CWP Web Server
Backdoor.Lindnor used filenames and folders resembling Chrome components and VMware files; gbbsym.exe and symgooq.exe masqueraded as Symantec software. Anubis Ransomware Attack Used Lindnor Backdoor and BYOVD Tools, but Encryption Was Blocked
Fake installers used names and branding associated with cracked commercial software and unofficial software bundles. Microsoft Details Fake-Download Campaign Using Trojanized Installers for Monetization
The signed program presents itself as a Windows Utility Suite while its embedded code downloads and runs GodRAT. Signed Windows Utility Loader Delivers GodRAT Through Process Injection

CVE (93)

Malware (412)

People (114)

Threat Actors (240)

MITRE ATT&CK (328)

Vendors (234)

Products (722)

Tools (384)

Industries (111)

Countries (73)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.