value:  APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications closely mimicking a legitimate McAfee file mfevtps.exe. 
name: Masquerading: Match Legitimate Name Or Location