Masquerading

Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities.

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Adversaries can hide a program's true filetype by changing the extension of a file.

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.

An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID).

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during Create Account, although accounts may also be renamed at a later date.

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.