MITRE ATT&CK Technique
Description
Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attributes like operating system, system language, platform, user-agent string, resolution, time zone, etc. The HTTP User-Agent request header is a string that lets servers and network peers identify the application, operating system, vendor, and/or version of the requesting user agent.(Citation: Mozilla User Agent) Adversaries may gather this information through [System Information Discovery](https://attack.mitre.org/techniques/T1082) or by users navigating to adversary-controlled websites, and then use that information to craft their web traffic to evade defenses.(Citation: Gummy Browsers: Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques)
Supported Platforms
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2025-09-22T20:13:45.616Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Adversaries may attempt to blend in with legitimate traffic '
'by spoofing browser and system attributes like operating '
'system, system language, platform, user-agent string, '
'resolution, time zone, etc. The HTTP\xa0User-Agent\xa0'
'request header\xa0is a string that lets servers and network '
'peers identify the application, operating system, vendor, '
'and/or version of the requesting\xa0user agent.(Citation: '
'Mozilla User Agent)\n'
'\n'
'Adversaries may gather this information through [System '
'Information '
'Discovery](https://attack.mitre.org/techniques/T1082) or by '
'users navigating to adversary-controlled websites, and then '
'use that information to craft their web traffic to evade '
'defenses.(Citation: Gummy Browsers: Targeted Browser Spoofing '
'against State-of-the-Art Fingerprinting Techniques)',
'external_references': [{'external_id': 'T1036.012',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1036/012'},
{'description': 'MDN contributors. (2025, July 4). '
'User-Agent header. Retrieved October '
'19, 2025.',
'source_name': 'Mozilla User Agent',
'url': 'https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/User-Agent'},
{'description': 'Zengrui Liu, Prakash Shrestha, and '
'Nitesh Saxena. (2021, October 19). '
'Retrieved September 22, 2025.',
'source_name': 'Gummy Browsers: Targeted Browser '
'Spoofing against State-of-the-Art '
'Fingerprinting Techniques',
'url': 'https://arxiv.org/pdf/2110.10129'}],
'id': 'attack-pattern--afac5dbc-4383-4fb6-9ba6-45b25d49e530',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'defense-evasion'}],
'modified': '2025-10-19T19:41:22.343Z',
'name': 'Browser Fingerprint',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.3.0',
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_is_subtechnique': True,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['Linux', 'macOS', 'Windows'],
'x_mitre_version': '1.0'}