T1036.007_double-file-extension
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
1.21k repo starsObserved in 1 repos
DevOps & Security
DevOps & Security skills
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
T1036.008_masquerade-file-type
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.009_break-process-trees
An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.010_masquerade-account-name
Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.011_overwrite-process-arguments
Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036.012_browser-fingerprint
Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1036_masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1037.001_logon-script-windows
Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1037.002_login-hook
Adversaries may use a Login Hook to establish persistence executed upon user logon.
1.21k repo starsObserved in 1 repos
DevOps & Security
T1037.003_network-logon-script
Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.
1.21k repo starsObserved in 1 repos
DevOps & Security