Masquerading: Masquerade Task or Service

Other sub-techniques of Masquerading (6)

ID	Name
T1036.001	Invalid Code Signature
T1036.002	Right-to-Left Override
T1036.003	Rename System Utilities
T1036.004	Masquerade Task or Service
T1036.005	Match Legitimate Name or Location
T1036.006	Space after Filename

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.^[1]^[2] Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.^[3]^[4]

ID: T1036.004

Sub-technique of: T1036

Tactic: Defense Evasion

Platforms: Linux, Windows

Permissions Required: Administrator, SYSTEM, User

Data Sources: Process command-line parameters, Process monitoring, Windows Registry, Windows event logs

Version: 1.0

Created: 10 February 2020

Last Modified: 29 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
APT-C-36	APT-C-36 has disguised its scheduled tasks as those used by Google.^[32]
APT32	APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".^[30]
Attor	Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).^[22]
build_downer	build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.^[25]
Carbanak	Carbanak has copied legitimate service names to use for malicious services.^[31]
Catchamas	Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.^[9]
ComRAT	ComRAT has used a task name associated with Windows SQM Consolidator.^[27]
Exaramel for Windows	The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV" in an apparent attempt to masquerade as a legitimate service.^[18]
FIN6	FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.^[29]
FIN7	FIN7 has created a scheduled task named "AdobeFlashSync" to establish persistence.^[28]
Fysbis	Fysbis has masqueraded as the rsyncd and dbus-inotifier services.^[4]
InnaputRAT	InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.^[20]
Kwampirs	Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.^[5]
Machete	Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.^[21]
Nidiran	Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.^[7]^[8]
Okrum	Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.^[23]
PlugX	In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."^[15]
POWERSTATS	POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.^[14]
RawPOS	New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".^[10]^[11]^[12]
RTM	RTM has named the scheduled task it creates "Windows Update".^[26]
Seasalt	Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.^[19]
Shamoon	Shamoon creates a new service named "ntssrv" that attempts to appear legitimate; the service's display name is "Microsoft Network Realtime Inspection Service" and its description is "Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols." Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."^[3]^[6]
ShimRat	ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.^[24]
Truvasys	To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.^[13]
Volgmer	Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.^[16]^[17]
Wizard Spider	Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.^[33]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Look for changes to tasks and services that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks or services may show up as outlier processes that have not been seen before when compared against historical data. Monitor processes and command-line arguments for actions that could be taken to create tasks or services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Masquerading: Masquerade Task or Service

Other sub-techniques of Masquerading (6)

Procedure Examples

Mitigations

Detection

References