Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions.
Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment.
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team transferred executable files as .txt and then renamed them to .exe, likely to avoid detection through extension tracking.[1] |
| S0605 | EKANS |
EKANS masquerades itself as a valid executable with the filename update.exe. Many valid programs use the process name update.exe to perform background software updates. [2] |
| S0496 | REvil |
REvil searches for whether the Ahnlab autoup.exe service is running on the target system and injects its payload into this existing process. [3] |
| S0603 | Stuxnet |
Stuxnet renames s7otbxdx.dll, a dll responsible for handling communications with a PLC. It replaces this dll file with its own version that allows it to intercept any calls that are made to access the PLC. [4] |
| S1009 | Triton |
Triton's injector, inject.bin, masquerades as a standard compiled PowerPC program for the Tricon. [5] Triton was configured to masquerade as trilog.exe, which is the Triconex software for analyzing SIS logs.[6] |
| ID | Asset |
|---|---|
| A0008 | Application Server |
| A0007 | Control Server |
| A0009 | Data Gateway |
| A0006 | Data Historian |
| A0002 | Human-Machine Interface (HMI) |
| A0012 | Jump Host |
| A0001 | Workstation |
| ID | Mitigation | Description |
|---|---|---|
| M0945 | Code Signing |
Require signed binaries. |
| M0938 | Execution Prevention |
Use tools that restrict program execution via application control by attributes other than file name for common system and application utilities. |
| M0922 | Restrict File and Directory Permissions |
Use file system access controls to protect system and application folders. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0725 | Detection of Masquerading | AN1858 |
Real-time monitoring identifies a process or scheduled task whose displayed name matches a known Industrial Control System (ICS) vendor application but whose on-disk binary hash or file path does not match the vendor-signed baseline. The mismatch -- name says one thing, binary integrity says another -- is the defining signal. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |
| AN2123 |
Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |
||
| AN2231 |
Real-time monitoring identifies an ICS device presenting protocol identity attributes (for example vendor, product, model, or capability identifiers) that conflict with the identity and capabilities recorded for that network address/device in the authorized asset inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |
||
| AN2287 |
Real-time monitoring identifies traffic on an Industrial Control System (ICS) protocol port (e.g., 502, 20000, 44818, etc.) with payload content that does not conform to the expected protocol structure for that port, suggesting non-ICS traffic tunneled over ICS port numbers to evade port-based filtering or blend with expected traffic patterns. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |