Masquerading

Info

ID:
Tactic: Deepening Control

Masquerading

Adversaries may rename files, services, or processes to resemble legitimate components, tricking defenders or automated detection into ignoring them. This could involve using benign or systemlike names for malicious binaries, or placing executables in commonly used directories with expected permissions. By closely mimicking normal environment details, attackers lower their detection profile.

Masquerading extends to container images or ephemeral app services that adopt naming conventions and metadata consistent with official builds. In environments with frequent updates, subtle differences in image tags or version numbers might go unnoticed. Over time, this technique lets malicious processes blend in, particularly if defenders rely on heuristics that trust known file paths or naming schemes.