T1036.008 — Masquerade File Type

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s…

Sub-technique of Masquerading (T1036).

Sigma detection rules (3)

T1036.008 Masquerading: Masquerade File Type

title: "T1036.008 Masquerading: Masquerade File Type"
id: d09f7192-5371-4908-88c1-71121cfd5a8a
description: 'Detection Strategy for Masquerading via File Type Modification. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: benign_extensions, monitored_directories, MagicByteMismatchThreshold, TimeWindow, ParentProcessAnomalyScore.'
references:
  - https://attack.mitre.org/techniques/T1036/008
author: Shahrukh Khan
date: 2026-05-26
license: MIT
tags:
  - attack.stealth
  - attack.t1036.008

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection_base:
    EventID: '11'
  selection_rtlo:
    TargetFilename|contains: '‮'
  selection_double_ext:
    TargetFilename|re: '(?i)\.(pdf|docx?|xlsx?|pptx?|jpg|jpeg|png|txt|zip|gif)\.(exe|scr|com|pif|bat|cmd|vbs|js|jse|ps1|hta)
    
  



  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_base and (selection_rtlo or selection_double_ext) and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate filenames that happen to contain a Unicode override character for display/localization reasons (rare), or archived files with dotted version numbers before an extension.

level: medium

T1036.008 Masquerading: Masquerade File Type

title: "T1036.008 Masquerading: Masquerade File Type"
id: e1eb1bca-29a4-47d8-bc50-c7cddd6d27d4
description: 'Detection Strategy for Masquerading via File Type Modification. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: benign_extensions, HeaderInspectionEnabled, ExecPathScope.'
references:
  - https://attack.mitre.org/techniques/T1036/008
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.stealth
  - attack.t1036.008

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '.jpg'
      - '.png'
      - '.pdf'
      - '.txt'
      - '.gif'
  condition: selection

falsepositives:
  - auditd cannot inspect file headers/magic bytes to confirm a true type mismatch, so this only flags the unusual act of directly executing a file with a non-executable extension, which some legitimate shebang-scripts or misnamed configs may also do.

level: medium

T1036.008 Masquerading: Masquerade File Type

title: "T1036.008 Masquerading: Masquerade File Type"
id: 5276aaff-bcd0-4568-ae83-541f84f3e0ca
description: 'Detection Strategy for Masquerading via File Type Modification. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchAgentScope, SignatureEnforcementLevel, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1036/008
author: Shahrukh Khan
date: 2026-04-24
license: MIT
tags:
  - attack.stealth
  - attack.t1036.008

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|contains: '/Library/LaunchAgents/'
  selection_ext:
    Image|endswith:
      - '.txt'
      - '.pdf'
      - '.docx'
  condition: selection and selection_ext

falsepositives:
  - Misconfigured LaunchAgents referencing document files as arguments rather than as the executable path.

level: medium

Related sub-techniques

Explore