Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1036_masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
Passed 17 of 22 test cases with the skill, and 8 of 22 without it.
and 10 more in the full report
10 fixed7 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Adversaries often send spearphishing emails containing masqueraded file attachments with double extensions. Which non-technical mitigation addresses this user-targeted delivery vector?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends M1017 User Training to train users against opening unknown email attachments. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.
Platforms: Containers, ESXi, Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.
Supported Platforms: windows
copy-item "$env:windir\System32\cmd.exe" -destination "$env:allusersprofile\cmd.exe"
start-process "$env:allusersprofile\cmd.exe"
sleep -s 5
stop-process -name "cmd" | out-null
test cases passed, vs 8 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.