Masquerading: Masquerade File Type T1036.008

Tactic: Stealth

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 8 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (13 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
event.type3eq 3start, creation
file.Ext.header_bytes3starts_with 31F8B, 377ABCAF271C, 4d444d50, 4d534346, 4d5a
EventType2ne 2deletion
Image2match 1, starts_with 1/var/run/\w+\.(pid|lock|reboot), ?
file.extension2eq 23gp, avi, bmp
All_Email.file_name1eq 1*
CommandLine1in 1, regex_match 1(?i).*(ZIP|ISO|IMG|CAB|TAR|GZ|RAR|7Z)\\\\.+\.(BAT|BIN|CAB..., *.7Z\\*, *.CAB\\*
EventID1eq 129
event_action1eq 1allowed
host.os.type1eq 1
process_id1ne 14
space_ratio1ge 10.1
user.id1eq 10

Top indicator values (63 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventTypene
deletion
211
event.typeeq
start
2606
file.extensioneq
3gp
22
file.extensioneq
avi
22
file.extensioneq
bmp
22
file.extensioneq
doc
22
file.extensioneq
docx
22
file.extensioneq
emf
22
file.extensioneq
eps
22
file.extensioneq
flv
22
file.extensioneq
fpx
22
file.extensioneq
gif
22
file.extensioneq
inf
22
file.extensioneq
jpeg
22
file.extensioneq
jpg
22
file.extensioneq
mov
22
file.extensioneq
mp3
22
file.extensioneq
mp4
22
file.extensioneq
mpeg
22
file.extensioneq
png
22
file.extensioneq
ppt
22
file.extensioneq
pptx
22
file.extensioneq
rtf
22
file.extensioneq
tiff
22
file.extensioneq
wav
22
file.extensioneq
wma
22
file.extensioneq
wmv
22
file.extensioneq
xls
22
file.extensioneq
xlsx
22
All_Email.file_nameeq
*
12

Exclusions (67 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
Imageeq
?:\program files (x86)\trend micro\client server security agent\ntrtscan.exe
1
Imageeq
?:\program files\endgame\esensor.exe
1
Imageeq
?:\windows\system32\inetsrv\w3wp.exe
1
Imagewildcard
?:\djjapplications\medicalrecords\bin\select.html.dep
1
Imagewildcard
?:\program files (x86)\encase applications\examiner service\encase64\enhkey.dll
1
Imagewildcard
?:\program files (x86)\johnson controls\licenseactivator\crp32002.ngn
1
Imagewildcard
?:\program files (x86)\panda security\wac\psnaeinj64.dll
1
Imagewildcard
?:\program files\dell\supportassistagent\*.p5x
1
Imagewildcard
?:\program files\docker\docker\com.docker.service
1
Imagewildcard
?:\programdata\software management\select.html.dep
1
Imagewildcard
?:\users\*\appdata\local\intel\ags\libs\agsrunner.bin
1
Imagewildcard
\device\mup\*\software management\select.html.dep
1
Imagewildcard
memcompression
1
Imagewildcard
registry
1
Imagewildcard
vmmem
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Elastic 5 rules

Splunk 3 rules