Masquerading: Masquerade Task or Service

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.^[5]

APT-C-36 has disguised its scheduled tasks as those used by Google.^[6]

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".^[7]

APT41 has created services to appear as benign system tools.^[8]

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as w3wp.exe or conn.exe.^[9]

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.^[10]

Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).^[11]

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.^[12]

Bazar can create a task named to appear benign.^[13]

BITTER has disguised malware as a Windows Security update service.^[14]

Black Basta has established persistence by creating a new service named FAX after deleting the legitimate service by the same name.^[15][16][17]

build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.^[18]

During C0017, APT41 used SCHTASKS /Change to modify legitimate scheduled tasks to run malicious code.^[19]

Carbanak has copied legitimate service names to use for malicious services.^[20]

Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.^[21]

ComRAT has used a task name associated with Windows SQM Consolidator.^[22]

Crutch has established persistence with a scheduled task impersonating the Outlook item finder.^[23]

CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.^[24]

DCSrv has masqueraded its service as a legitimate svchost.exe process.^[25]

DEADEYE has used schtasks /change to modify scheduled tasks including \Microsoft\Windows\PLA\Server Manager Performance Monitor, \Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults, and \Microsoft\Windows\WDI\USOShared.^[19]

DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.^[26]

Egregor has masqueraded the svchost.exe process to exfiltrate data.^[27]

Emotet has installed itself as a new service with the service name Windows Defender System Service and display name WinDefService.^[28]

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV" in an apparent attempt to masquerade as a legitimate service.^[29]

FIN13 has used scheduled tasks names such as acrotyr and AppServicesr to mimic the same names in a compromised network's C:\Windows directory.^[30]

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.^[31]

FIN7 has created a scheduled task named "AdobeFlashSync" to establish persistence.^[32]

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.^[33]

During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.^[34]

FunnyDream has used a service named WSearch for execution.^[35]

Fysbis has masqueraded as the rsyncd and dbus-inotifier services.^[4]

GoldMax has impersonated systems management software to avoid detection.^[36]

Green Lambert has created a new executable named Software Update Check to appear legitimate.^[37][38]

Heyoka Backdoor has been named srvdll.dll to appear as a legitimate service.^[39]

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.^[40][41]

Hildegard has disguised itself as a known Linux process.^[42]

InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.^[43]

InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.^[44]

IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.^[45]

KillDisk registers as a service under the Plug-And-Play Support name.^[46]

Kimsuky has disguised services to appear as benign software or related to operating system functions.^[47]

KONNI has pretended to be the xmlProv Network Provisioning service.^[48]

KV Botnet Activity installation steps include first identifying, then stopping, any process containing [kworker\/0:1], then renaming its initial installation stage to this process name.^[49]

Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.^[50]

Lazarus Group has used a scheduled task named SRCheck to mask the execution of a malicious .dll.^[51]

Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.^[52]

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.^[53]

Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.^[54]

Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.^[55]

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.^[56]

Nebulae has created a service named "Windows Update Agent1" to appear legitimate.^[56]

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.^[57][58]

NightClub has created a service named WmdmPmSp to spoof a Windows Media service.^[59]

Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.^[60]

OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file com.apple.openssl.plist which executes