Masquerading
Technique · ATTACK:ics:T0849
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0849",
"title": "Masquerading",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0849",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61",
"external_id": "T0849",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:34.261Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"evasion"
],
"source_references": [
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S0603 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e29f62d-4ffc-47ec-9623-72f874fbe905
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:ics:S1009 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--350814da-5c36-42f9-8e58-8f9534e6ce0a
FireEye TRITON · DHS CISA February 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e099568-fb5c-4f58-af7e-4e1b7a9d1128
Tom Fakterman August 2019ATTACK:ics:M0945 → mitigates → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9e82422-b072-494f-99c1-fcab07b90133
ATTACK:ics:S0605 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c347b69c-e3f6-4eca-ba57-0781c7dc8eac
Dragos Threat Intelligence February 2020ATTACK:ics:M0938 → mitigates → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cca191a1-3c50-4d4f-8f79-4247e58af610
ATTACK:ics:C0025 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e156609f-c30b-4bf5-8a1b-9689ba778a14
Dragos Crashoverride 2018ATTACK:ics:M0922 → mitigates → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f703f8b2-b6b9-41f3-a551-6bb3647c45cc