Cross-source coverage
T1036.008 / ATT&CK
Masquerading: Masquerade File Type
5 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either .JPE, .JPEG or .JPG.
Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., Ingress Tool Transfer) and stored (e.g., Upload Malware) so that adversaries may move their malware without triggering detections.
Common non-executable file types and extensions, such as text files (.txt) and image files (.jpg, .gif, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.
Polyglot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:Sysmonauditd:SYSCALLlinux:osquerymacos:unifiedlog
How MITRE says to detect it DET0226
Detection Strategy for Masquerading via File Type Modification
Windows Analytic 0630
Detects behavior where files with non-executable or misleading extensions (e.g.,.jpg,.txt) are created or modified but subsequently executed as binaries based on internal file headers or abnormal parent process lineage. This includes identifying polyglot files or malformed magic bytes indicative of masquerading attempts.
WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=1
Linux Analytic 0631
Detects when a script or binary is named with misleading or benign-looking extensions (.jpg,.doc) and is then executed via command line or a scheduled task. Includes ELF header mismatches and content-type inconsistencies on disk.
auditd:SYSCALLexecvelinux:osqueryRead headers and detect MIME type mismatch
macOS Analytic 0632
Detects binaries disguised as media or document types through extension-only masquerading or by modifying the file signature. Observes execution of files whose extension is not typically executable (.jpg,.txt), yet have valid Mach-O headers or execute via Terminal or launch services.
macos:unifiedloglaunchservices events for misleading extensions
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| Email Attachments With Lots Of Spaces | Undefined | SPL |
| Suspicious Process Executed From Container File | Undefined | SPL |
| Windows Executable Masquerading as Benign File Types | Undefined | SPL |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Non-DLL Extension File Renamed With DLL Extension | Medium | Sigma |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Process Started from Process ID (PID) File | High | Elastic TOML |