Masquerading
Masquerading is like a wolf in sheep's clothing; it is when a malicious file or program disguises itself as something safe or familiar—like a trusted system update or a common app—to trick both people and security software into letting it pass by unnoticed.
Masquerading is an evasion technique where an adversary alters the attributes of an artifact, such as its filename, path, or metadata, to mimic trusted system processes or legitimate software. By aligning the artifact's appearance with expected baseline behavior, the attacker aims to bypass signature-based detection and deceive security analysts during incident response.
Masquerading is a sub-technique of defense evasion involving the intentional manipulation of an artifact's identity—specifically its name, location, or metadata—to induce misclassification by security controls or human operators. This process exploits the reliance of defensive systems on naming conventions and path-based heuristics, effectively lowering the artifact's perceived risk score and facilitating persistence or execution within a target environment.