Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions. Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment.

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Control Server
is related to Workstation
is related to Human-Machine Interface (HMI)
is related to Application Server
is related to Data Historian
is related to Data Gateway
is related to Jump Host
is blocked by Code Signing
is blocked by Detection of Masquerading
is blocked by Execution Prevention
is blocked by Restrict File and Directory Permissions
Impressum Deutsch Englisch