Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
ATT&CK knowledge
Loading the current evidence view. Navigation and account controls remain available.
Tactics: stealth
20
known groups
33
software
1,513
corpus matches
about
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
used by actors
20 known groups
corpus indicators tagged T1036
1,513 carry this technique
A shared-technique signal for hunting: each row resolves to its own verdict. Not attribution to any one group.
software
33 malware & tools implement this
showing top 30 by severity of 1,513