T1036Stealth
Masquerading
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and…
CVEs20
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.7
Reports1
Detections
40 Sigma rules tagged T1036MasqueradingT103640 general rules
- Potential LSASS Process Dump Via Procdumphighstable
- CreateDump Process Dumphightest
- Forfiles.EXE Child Process Masqueradinghightest
- HackTool - XORDump Executionhightest
- Password Protected ZIP File Opened (Suspicious Filenames)hightest
- Potential SysInternals ProcDump Evasionhightest
- Process Execution From A Potentially Suspicious Folderhightest
- Process Memory Dump Via Comsvcs.DLLhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Masquerading
20 CVEs, by priority. Each link shows its badge.- CVE-2018-20250WinRAR Absolute Path Traversal VulnerabilityRARLAB · WinRARKEVRansomwarePublic exploitHigh · 7.8T1204.002Malicious FileT1036Masquerading3 reportsAI mapping from the description · primary impact96.0%Top 0.12%86.2priority
- CVE-2020-0601Microsoft Windows CryptoAPI Spoofing VulnerabilityAI mapping from the description · primary impact89.1%Top 0.22%78.6priority
- CVE-2020-3153Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityCisco · AnyConnect SecureKEVRansomwarePublic exploitMedium · 6.5T1078Valid AccountsT1574.001DLL+1 moreAI mapping from the description · primary impact28.5%Top 1.9%77.2priority
- CVE-2022-26501Veeam Backup & Replication Remote Code Execution VulnerabilityVeeam · Backup & ReplicationKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 moreMITRE CTID mapping of the KEV entry · follow-on activity4.1%Top 9.3%73.0priority
- CVE-2022-26500Veeam Backup & Replication Remote Code Execution VulnerabilityVeeam · Backup & ReplicationKEVRansomwareHigh · 8.8T1078Valid AccountsT1190Exploit Public-Facing Application+3 moreMITRE CTID mapping of the KEV entry · follow-on activity5.8%Top 6.9%72.8priority
- CVE-2026-32202Microsoft Windows Protection Mechanism Failure VulnerabilityAI mapping from the description · primary impact70.9%Top 0.6%70.9priority
- CVE-2024-43573Microsoft Windows MSHTML Platform Spoofing VulnerabilityAI mapping from the description · primary impact46.1%Top 1.2%63.4priority
- CVE-2019-3778Open Redirect in spring-security-oauth2MITRE CTID mapping of the CVE · follow-on activity16.6%Top 3%25.5priority
- CVE-2018-17934NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be…MITRE CTID mapping of the CVE · follow-on activity19.7%Top 2.6%24.5priority
- CVE-2020-5250Possible information disclosure in PrestaShopMITRE CTID mapping of the CVE · primary impact0.9%Top 42%22.0priority
- CVE-2020-1456A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…Microsoft · Microsoft SharePoint Enterprise ServerMedium · 5.4T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity2.2%Top 17%21.0priority
- CVE-2019-1831Cisco Email Security Appliance Content Filter Bypass VulnerabilityMITRE CTID mapping of the CVE · primary impact1.6%Top 24%19.3priority
- CVE-2019-3788UAA redirect-uri allows wildcard in the subdomainMITRE CTID mapping of the CVE · follow-on activity0.8%Top 42%17.6priority
- CVE-2018-5451In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does…Philips · Philips Alice 6 SystemT1036MasqueradingMITRE CTID mapping of the CVE · primary impact2.6%Top 14%17.1priority
- CVE-2018-11067Dell EMC Avamar and Integrated Data Protection Appliance Open Redirection VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.8%Top 21%15.7priority
- CVE-2020-15233OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesMITRE CTID mapping of the CVE · follow-on activity0.8%Top 43%15.6priority
- CVE-2019-1031Microsoft Office SharePoint XSS VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016T1059Command and Scripting InterpreterT1036Masquerading+3 moreMITRE CTID mapping of the CVE · follow-on activity1.7%Top 23%15.3priority
- CVE-2018-8607A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…MITRE CTID mapping of the CVE · follow-on activity1.6%Top 24%15.2priority
- CVE-2020-5270Open redirection when using back parameter of PrestaShopMITRE CTID mapping of the CVE · follow-on activity0.8%Top 42%14.4priority
- CVE-2020-16198Philips Clinical Collaboration Platform Protection Mechanism FailureMITRE CTID mapping of the CVE · primary impact0.6%Top 53%12.9priority
Linked through a sub-technique
1 more- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 more97.3%Top 0.1%69.0priority