Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.[1]
Procedure Examples
| Name | Description |
|---|---|
| APT32 |
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.[9] |
| BRONZE BUTLER |
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.[8] |
| Dragonfly 2.0 |
Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.[5][6] |
| menuPass |
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.[7] |
| Ramsay | |
| RTM |
RTM has been delivered as archived Windows executable files masquerading as PDF documents.[3] |
| Windshift |
Windshift has used icons mimicking MS Office files to mask malicious executables.[4] |
| WindTail |
WindTail has used icons mimicking MS Office files to mask payloads.[4] |
Mitigations
| Mitigation | Description |
|---|---|
| Code Signing |
Require signed binaries. |
| Execution Prevention |
Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed. |
| Restrict File and Directory Permissions |
Use file system access controls to protect folders such as C:\Windows\System32. |
Detection
Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. [10] Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.[11]
Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".
References
- LOLBAS. (n.d.). Living Off The Land Binaries and Scripts (and also Libraries). Retrieved February 10, 2020.
- Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
- Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.
- Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.
- US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
- US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
- Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.
- Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
- Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016.
- Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019.