Techniques › T1036.008 › AN0630
AN0630 Analytic 0630
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects behavior where files with non-executable or misleading extensions (e.g., .jpg, .txt) are created or modified but subsequently executed as binaries based on internal file headers or abnormal parent process lineage. This includes identifying polyglot files or malformed magic bytes indicative of masquerading attempts.</p>
- Detects
- T1036.008 Masquerade File Type
- Part of
- DET0226 Detection Strategy for Masquerading via File Type Modification
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
benign_extensions | List of non-executable file types commonly used to mask payloads (.jpg, .txt, .gif) |
monitored_directories | Targeted directories for initial access and downloads (e.g., %TEMP%, Downloads, AppData) |
MagicByteMismatchThreshold | Detection tolerance for mismatches between extension and file signature (magic bytes) |
TimeWindow | Time range between file creation and first execution |
ParentProcessAnomalyScore | Anomaly score threshold for suspicious parent-child process combinations |