Masquerading: Masquerade Account Name T1036.010
Tactic: Stealth
Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date. This may also coincide with Account Access Removal if the actor first deletes an account before re-creating one with the same name.
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4781 | The name of an account was changed. |
Authoring guide
These 1 rule share fields, values, and exclusions.
Fields filtered most (2 distinct)
These fields appear most often in rule filters.
Top indicator values (3 distinct)
These values appear most often in rule predicates.
Rules under this technique
These vendors publish rules tagged with this technique.
Platform: Windows
Domain: Endpoint