safemode.space
← ESA SPACE-SHIELD
T2040

Masquerading

Description

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools (Citation: MITRE ATT&CK)

Mapped SPARTA techniques

2 techniques

  • DE-0004MasqueradingST0006
    addresses
    high

    T2040 'Masquerading' is the exact title-and-scope cross-framework counterpart of DE-0004 — both describe attackers manipulating artifact features to make them appear legitimate or benign across RF, protocol, and organizational boundaries.

  • IMP-0001Deception (or Misdirection)ST0009
    addresses
    moderate

    T2040 'Masquerading' covers manipulating artifact features to appear legitimate — addresses IMP-0001's design of attacks that intentionally mimic another threat actor's TTPs and use of allied ground infrastructure as the masqueraded source.

Cite as SafeMode Space, space-shield T2040.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.