T1036 — Masquerading

# T1036 - Masquerading

## SOC Recommendation
Investigate Masquerading activity in the context of Stealth: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| System Call Analysis | Detect | Monitor for System Call Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| System Call Filtering | Isolate | Apply System Call Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Kill the masquerading process via MDE Live Response | Low | No | Yes |
| Delete the malicious binary | Low | No | Yes |
| Block SHA256 in MDE custom indicators | Medium | No | Yes |

## KQL
```kql
let LegitPaths = dynamic([
    "c:\\windows\\system32\\", "c:\\windows\\syswow64\\",
    "c:\\windows\\", "c:\\program files\\", "c:\\program files (x86)\\"
]);
let SystemBinaries = dynamic([
    "svchost.exe", "lsass.exe", "services.exe", "csrss.exe", "winlogon.exe",
    "wininit.exe", "explorer.exe", "taskhostw.exe", "taskhost.exe", "spoolsv.exe",
    "dllhost.exe", "mmc.exe", "searchindexer.exe", "lsm.exe", "smss.exe", "conhost.exe"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(5m)
| where FileName in~ (SystemBinaries)
| where isnotempty(FolderPath)
| where not(FolderPath has_any (LegitPaths))
| project
    TimeGenerated,
    DeviceName,
    AccountName,
    FileName,
    FolderPath,
    ProcessCommandLine,
    SHA256,
    InitiatingProcessFileName
| extend timestamp = TimeGenerated,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by TimeGenerated desc
```
```kql
let lb_period = 14d;
let q_time = 1h;
let inet_access_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType =~ 'DetectAccessInternet'
| where isnotempty(ActingProcessFileInternalName)
| summarize makeset(ActingProcessFileInternalName);
CyberArkEPM
| where TimeGenerated > ago(q_time)
| where EventSubType =~ 'DetectAccessInternet'
| where ActingProcessFileInternalName !in (inet_access_proc)
| extend AccountCustomEntity = ActorUsername
```
```kql
CyberArkEPM
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has @'\'
| where ActingProcessName !has ActingProcessFileInternalName
| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName
| extend AccountCustomEntity = ActorUsername
```

## Escalation Criteria
- Masquerading activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1036.json
• /api/recommendations/T1036.json
• /api/d3fend/T1036.json
• /api/mappings/T1036.json
• /api/confluence/T1036.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1036.json

Response:

{
  "technique_id": "T1036",
  "name": "Masquerading",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Stealth"
  ],
  "platforms": [
    "Containers",
    "ESXi",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names...",
  "soc_recommendation": "Investigate Masquerading activity in the context of Stealth: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-SCA",
      "name": "System Call Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for System Call Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SCF",
      "name": "System Call Filtering",
      "relationship": "isolate",
      "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed masquerading activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Process Masquerading\" -- Flags a process sharing the name of a legitimate Windows system binary but running from a non-standard, user-writable directory."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Kill the masquerading process via MDE Live Response",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    },
    {
      "name": "Delete the malicious binary",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Block SHA256 in MDE custom indicators",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-DE-004 — Process Masquerading",
        "description": "Flags a process sharing the name of a legitimate Windows system binary but running from a non-standard, user-writable directory. (Source: Bell Integration baseline detection library, mapped via sub-technique T1036.005.)",
        "query": "let LegitPaths = dynamic([\n    \"c:\\\\windows\\\\system32\\\\\", \"c:\\\\windows\\\\syswow64\\\\\",\n    \"c:\\\\windows\\\\\", \"c:\\\\program files\\\\\", \"c:\\\\program files (x86)\\\\\"\n]);\nlet SystemBinaries = dynamic([\n    \"svchost.exe\", \"lsass.exe\", \"services.exe\", \"csrss.exe\", \"winlogon.exe\",\n    \"wininit.exe\", \"explorer.exe\", \"taskhostw.exe\", \"taskhost.exe\", \"spoolsv.exe\",\n    \"dllhost.exe\", \"mmc.exe\", \"searchindexer.exe\", \"lsm.exe\", \"smss.exe\", \"conhost.exe\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(5m)\n| where FileName in~ (SystemBinaries)\n| where isnotempty(FolderPath)\n| where not(FolderPath has_any (LegitPaths))\n| project\n    TimeGenerated,\n    DeviceName,\n    AccountName,\n    FileName,\n    FolderPath,\n    ProcessCommandLine,\n    SHA256,\n    InitiatingProcessFileName\n| extend timestamp = TimeGenerated,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by TimeGenerated desc"
      },
      {
        "name": "9d0d44ab-54dc-472a-9931-53521e888932 — CyberArkEPM - Uncommon process Internet access",
        "description": "Detects access to the Internet by uncommon processes.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let lb_period = 14d;\nlet q_time = 1h;\nlet inet_access_proc = CyberArkEPM\n| where TimeGenerated between (ago(lb_period) .. ago(q_time))\n| where EventSubType =~ 'DetectAccessInternet'\n| where isnotempty(ActingProcessFileInternalName)\n| summarize makeset(ActingProcessFileInternalName);\nCyberArkEPM\n| where TimeGenerated > ago(q_time)\n| where EventSubType =~ 'DetectAccessInternet'\n| where ActingProcessFileInternalName !in (inet_access_proc)\n| extend AccountCustomEntity = ActorUsername"
      },
      {
        "name": "9281b7cc-8f05-45a9-bf10-17fb29492a84 — CyberArkEPM - Renamed Windows binary",
        "description": "Detects renamed windows binaries.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "CyberArkEPM\n| where EventSubType != 'AttackAttempt'\n| where ActingProcessName has @'\\'\n| where ActingProcessName !has ActingProcessFileInternalName\n| project EventEndTime, EventMessage, ActorUsername, ActingProcessFileInternalName\n| extend AccountCustomEntity = ActorUsername"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "493834ca-f861-414c-8602-150d5505b777 — Agent Spoofing - Multiple Hosts Using Same Agent",
        "description": "(ESQL) Detects when multiple hosts are using the same agent ID. This could occur in the event of an agent being taken over and used to inject illegitimate documents into an instance as an attempt to spoof events in order to masquerade actual activity to evade detection. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-endpoint.*  metadata _id\n| where event.agent_id_status is not null and agent.id is not null\n| stats Esql.count_distinct_host_ids = count_distinct(host.id), Esql.host_id_values = values(host.id), Esql.user_id_values_user_id = values(user.id) by agent.id\n| where Esql.count_distinct_host_ids >= 2\n| keep Esql.count_distinct_host_ids, Esql.host_id_values, Esql.user_id_values_user_id, agent.id"
      },
      {
        "name": "32f95776-6498-4f3c-a90c-d4f6083e3901 — Potential Masquerading as Svchost",
        "description": "(ESQL) Identifies attempts to masquerade as the Service Host process `svchost.exe` to evade detection and blend in with normal system activity. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "FROM logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-* metadata _id, _version, _index\n| where event.category == \"process\" and event.type == \"start\" and\n  match(process.name, \"svchost.exe\", { \"fuzziness\": 1, \"max_expansions\": 10 }) and\n  not to_lower(process.executable) in (\"c:\\\\windows\\\\syswow64\\\\svchost.exe\", \"c:\\\\windows\\\\system32\\\\svchost.exe\") and\n  not to_lower(process.executable) like \"\"\"\\\\device\\\\harddiskvolume*\\\\windows\\\\system32\\\\svchost.exe\"\"\" and\n  not to_lower(process.executable) like \"\"\"\\\\device\\\\harddiskvolume*\\\\windows\\\\syswow64\\\\svchost.exe\"\"\" \n| keep *"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Masquerading activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1036 - Masquerading Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}