Masquerade File Type is ATT&CK T1036.008, a Stealth technique for Linux, macOS and Windows. The attacker changes how a payload looks, through its signature, extension, icon or contents, so it passes for a harmless file type.
How attackers use it
MITRE explains that most file types have a standard format. A file's signature, also called its header or magic bytes, is the first bytes of the file and often identifies the type. For a JPEG, the header begins with 0xFF 0xD8. An adversary can edit the header bytes, the extension, or both, in order to bypass file validation checks and input sanitization.
This matters most when files are moved and stored. MITRE connects it to ingress tool transfer and to uploading malware, since disguising the payload lets it travel without triggering detection. An example on the page is naming a PHP backdoor test.gif. Polyglot files, which function differently depending on which application handles them, are also mentioned.
Procedure examples include executables masqueraded as .txt files, malware delivered as a LNK file disguised as a folder, a payload renamed from package.md to package.json, and configuration files holding encryption keys disguised as PNG files.
How to detect it
The MITRE analytics look for files with non-executable or misleading extensions that are later executed as binaries, based on internal headers or abnormal parent process lineage. That includes polyglot files and malformed magic bytes. On Linux, it names ELF header mismatches and content type inconsistencies on disk. On macOS, it mentions files with non-executable extensions that carry valid Mach-O headers or that run through Terminal or launch services.
Concretely, compare the extension with the detected content type. Process creation logs help too: a process whose image is a file ending in .jpg or .txt is a strong signal.
How to reduce the risk
MITRE lists three mitigations:
- Behavior prevention on endpoint. Use controls such as a host intrusion prevention system to identify and prevent execution of files with mismatching file signatures.
- Antivirus. Automatically quarantine suspicious files.
- Execution prevention. Validate files and sanitize input before execution, keep a strict allow list so only authorized file types are processed, and restrict or block execution of files where headers and extensions do not match.
Check your own environment
On Linux and macOS, the file command reads content, not the extension. Check a folder of uploads or downloads for names that claim one type and contain another:
file --mime-type -b /path/to/upload/* | sort | uniq -c
file -i /path/to/suspect.jpg
If an upload feature in your applications accepts images, confirm that the server checks content type, not only the file extension.
Quick check
Why is checking the file extension alone not enough?
An attacker can rename a payload or alter its header bytes. Validation that reads the real content and enforces an allow list of file types is harder to fool.
