Masquerading

Matching Legitimate Name or Location

Masquerading is a sophisticated technique employed by adversaries to evade detection by making malicious files or executables appear legitimate. This method leverages the inherent trust placed in certain names, icons, and locations by users and security mechanisms. By closely mimicking the characteristics of trusted entities, malicious actors can blend their activities with normal system operations and reduce the likelihood of their activities being flagged as suspicious.

Core Concepts

Name Mimicry

Adversaries often rename malicious files to match or closely resemble the names of legitimate system files. For instance, a common tactic involves naming a piece of malware "svchost.exe," a legitimate system process in Windows environments. This can confuse users and security software, allowing the malware to operate unnoticed.

Trusted Directory Placement

Placing malicious executables in directories that are commonly trusted by the operating system and security software is another key strategy. Directories such as the System32 folder in Windows are considered secure, and files within these directories are less likely to be scrutinized by security mechanisms. Adversaries exploit this trust by relocating their malicious files to these directories, thereby avoiding detection.

Icon Spoofing

Using the same icon as the legitimate file being mimicked adds another layer of deception. This visual trickery makes it harder for users to distinguish between legitimate and malicious files based on appearance alone. By replicating the icons of trusted programs, adversaries can deceive users into thinking that a malicious file is benign, increasing the likelihood that the user will execute the malicious file.

Metadata Modification

Altering file metadata to match that of legitimate files is a sophisticated method to evade detection tools that scan for anomalies. This includes modifying file size, creation date, and digital signatures. By aligning these metadata properties with those of legitimate files, adversaries can make their malicious files appear authentic to both users and automated security tools, further enhancing their ability to evade detection.

Objectives of Masquerading

Bypassing Security Software

Many security solutions have mechanisms to whitelist or trust files based on their location or name. By exploiting these mechanisms, adversaries can avoid detection and analysis. For example, security software might automatically trust files located in the System32 directory or files with names that match known system processes. By placing their malicious files in these trusted locations or giving them trusted names, adversaries can bypass these security measures.

Social Engineering

Convincing a user to execute a malicious file is much easier if the file appears legitimate. Mimicry in naming, location, and appearance plays into social engineering tactics by reducing suspicion. Users are more likely to open or execute a file if it looks familiar or is located in a trusted directory. This deception is a crucial component of many phishing and spear-phishing attacks, where the success of the attack hinges on the user's willingness to interact with the malicious file.

Maintaining Persistence

For long-term access, malware needs to remain undetected for extended periods. Residing in trusted locations under trusted names increases the chances of malware surviving reboots and routine security checks. By embedding themselves deeply within the system in locations that are rarely scrutinized, and by mimicking trusted system processes, adversaries can ensure that their malicious software persists on the target system for as long as possible.

Detection Strategies

To effectively detect masquerading, organizations must implement a multi-faceted approach that includes monitoring, baselining, and analysis of metadata and behaviors. Specific detection indicators help to identify potential masquerading attempts.

Binary Metadata Monitoring

A critical detection strategy involves comparing the actual file name with the metadata stored within the file. Discrepancies can indicate masquerading. For instance, if the file name is "svchost.exe" but the internal metadata indicates a different program name, this mismatch is a clear indicator of masquerading. Tools like Sysinternals Sigcheck and custom scripts can be used to extract and compare metadata. Specific indicators include:

• Discrepancies between the external file name and internal metadata.

• Mismatches in file extension and file type indicated by metadata.

• Inconsistent product name, company name, or copyright information within the metadata.

File Location Baselines

Establishing expected execution paths for system files and executables is essential. This involves creating baselines for where legitimate files should reside and monitoring directories commonly used by adversaries to hide malicious files, such as user profiles, temporary directories, and less scrutinized system directories. File integrity monitoring (FIM) tools are effective for tracking changes and movements of executables within these directories. Key indicators include:

• Executables in directories not typically associated with legitimate system files.

• Presence of system-like files outside of standard system folders (e.g., Windows folder).

• Unexpected file movements or the presence of executable files in non-standard locations.

Process Ancestry and Command Line Spoofing

Monitoring the lineage of processes can reveal anomalies. For example, a system file like "explorer.exe" should not typically spawn a command prompt or scripting engine. Analyzing command lines for unusual parameters or encodings that legitimate processes would not use is also crucial. Tools like Sysmon can be used to monitor process creation and log parent-child relationships. Specific indicators to monitor include:

• System files spawning unusual child processes (e.g., "explorer.exe" spawning cmd.exe).

• Command lines containing obfuscated or encoded strings.

• Parent-child process relationships that deviate from normal patterns.

File and Network Monitoring

Tracking the creation and modification of executables, especially in sensitive directories or those known for masquerading tactics, is important. Implementing FIM to monitor file creation, deletion, and modification events can help in early detection. Additionally, monitoring network activity originating from processes that should not typically initiate network connections, such as DLLs or renamed executables, can reveal malicious behavior. Key indicators include:

• Creation and modification of executables in sensitive directories.

• Network connections from processes that should not typically initiate such connections.

• Unusual outbound connections from suspicious processes.

• High volumes of outbound traffic from typically quiet system processes.

Common File Names Used in Masquerading

• svchost.exe: This is a legitimate Windows process that hosts multiple services, making it a prime target for attackers to mimic. By using this name, adversaries can exploit the trust that users and security systems place in this essential system process.

• explorer.exe: The Windows graphical shell process, often mimicked to blend in with normal user activity. Malware disguised as "explorer.exe" can operate without raising suspicion, as this process is fundamental to the Windows user interface.

• lsass.exe: The Local Security Authority Subsystem Service, critical for handling security policies, is another common target for masquerading. Malicious actors rename their files to "lsass.exe" to evade detection and perform sensitive operations under the guise of a legitimate process.

• csrss.exe: The Client/Server Runtime Subsystem, a core Windows process, is frequently used in masquerading attempts. By imitating "csrss.exe," attackers can blend their activities with those of legitimate system functions, making it harder for security measures to identify malicious actions.

• winlogon.exe: Manages the user login and logout procedures, essential for user authentication. Attackers rename their malicious files to "winlogon.exe" to take advantage of the process's critical role in user sessions and evade detection.

Common Locations Used in Masquerading

• C:\Windows\System32: The primary system directory trusted by the operating system, frequently targeted to hide malicious executables. Files in this directory are less likely to be scrutinized, allowing malware to evade detection.

• C:\Windows\SysWOW64: A system directory for 32-bit applications on a 64-bit Windows installation, often used to conceal malicious files. This directory's trusted status makes it an attractive target for attackers looking to avoid detection.

• C:\Windows\Temp: A directory for temporary files, commonly exploited for dropping and executing malware. Attackers use this location to temporarily store and run malicious payloads without immediate detection.

• C:\Users[username]\AppData\Roaming: Used by applications to store persistent data, this location is often targeted for maintaining long-term persistence. By placing malicious files here, attackers can ensure their malware survives reboots and routine system maintenance.

• C:\Users[username]\AppData\Local\Temp: A per-user temporary files directory, frequently used by attackers to store and execute malicious payloads. This location is less scrutinized than system directories, making it a common choice for hiding malware.