File masquerading, formally cataloged as MITRE ATT&CK technique T1036, involves adversaries giving malicious files names (and sometimes icons, paths, or extensions) that closely resemble legitimate, trusted system files or processes—such as naming malware to look like a core Windows binary. This exploits the visual trust end users place in familiar file names, causing them to overlook or dismiss the file as benign, thereby evading manual/end-user detection. This is distinct from macro code obfuscation, digital certificate abuse, or Base64 encoding, which are separate evasion techniques.
Community Discussion