T1036.004: Masquerade Task or Service — MITRE ATT&CK Technique

Description

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

Platforms

LinuxmacOSWindows

Threat Groups (23)

ID	Group	Context
G0094	Kimsuky	[Kimsuky](https://attack.mitre.org/groups/G0094) has disguised services to appear as benign software or related to operating system functions.(Citatio...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)
G0050	APT32	[APT32](https://attack.mitre.org/groups/G0050) has used hidden or non-printing characters to help masquerade service names, such as appending a Unicod...
G0019	Naikon	[Naikon](https://attack.mitre.org/groups/G0019) renamed a malicious service <code>taskmgr</code> to appear to be a legitimate version of Task Manager....
G0037	FIN6	[FIN6](https://attack.mitre.org/groups/G0037) has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation...
G0046	FIN7	[FIN7](https://attack.mitre.org/groups/G0046) has created a scheduled task named “AdobeFlashSync” to establish persistence.(Citation: Morphisec FIN7 J...
G0128	ZIRCONIUM	[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has created a run key named <code>Dropbox Update Setup</code> to mask a persistence mechanism for a...
G1048	UNC3886	[UNC3886](https://attack.mitre.org/groups/G1048) has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilita...
G0126	Higaisa	[Higaisa](https://attack.mitre.org/groups/G0126) named a shellcode loader binary <code>svchast.exe</code> to spoof the legitimate <code>svchost.exe</c...
G0008	Carbanak	[Carbanak](https://attack.mitre.org/groups/G0008) has copied legitimate service names to use for malicious services.(Citation: Kaspersky Carbanak)
G0143	Aquatic Panda	[Aquatic Panda](https://attack.mitre.org/groups/G0143) created new, malicious services using names such as <code>Windows User Service</code> to attemp...
G1035	Winter Vivern	[Winter Vivern](https://attack.mitre.org/groups/G1035) has distributed malicious scripts and executables mimicking virus scanners.(Citation: SentinelO...
G1053	Storm-0501	[Storm-0501](https://attack.mitre.org/groups/G1053) has utilized [Rclone](https://attack.mitre.org/software/S1040) masqueraded as svhost.exe and scvho...
G1002	BITTER	[BITTER](https://attack.mitre.org/groups/G1002) has disguised malware as a Windows Security update service.(Citation: Cisco Talos Bitter Bangladesh Ma...
G0135	BackdoorDiplomacy	[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has disguised their backdoor droppers with naming conventions designed to blend into normal...
G0117	Fox Kitten	[Fox Kitten](https://attack.mitre.org/groups/G0117) has named the task for a reverse proxy lpupdate to appear legitimate.(Citation: CISA AA20-259A Ira...
G0099	APT-C-36	[APT-C-36](https://attack.mitre.org/groups/G0099) has disguised its scheduled tasks as those used by Google.(Citation: QiAnXin APT-C-36 Feb2019)
G0032	Lazarus Group	[Lazarus Group](https://attack.mitre.org/groups/G0032) has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.(Citation: ...
G0102	Wizard Spider	[Wizard Spider](https://attack.mitre.org/groups/G0102) has used scheduled tasks to install [TrickBot](https://attack.mitre.org/software/S0266), using ...
G1055	VOID MANTICORE	[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has masqueraded as commonly used programs and services on Windows hosts.(Citation: FBI IC3 Fla...

Associated Software (63)

ID	Name	Type	Context
S0343	Exaramel for Windows	Malware	The [Exaramel for Windows](https://attack.mitre.org/software/S0343) dropper creates and starts a Windows service named wsmprovav with the description ...
S0491	StrongPity	Malware	[StrongPity](https://attack.mitre.org/software/S0491) has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefe...
S0630	Nebulae	Malware	[Nebulae](https://attack.mitre.org/software/S0630) has created a service named "Windows Update Agent1" to appear legitimate.(Citation: Bitdefender Nai...
S1239	TONESHELL	Malware	[TONESHELL](https://attack.mitre.org/software/S1239) has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility ...
S0629	RainyDay	Malware	[RainyDay](https://attack.mitre.org/software/S0629) has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate....
S0668	TinyTurla	Malware	[TinyTurla](https://attack.mitre.org/software/S0668) has mimicked an existing Windows service by being installed as <code>Windows Time Service</code>....
S1226	BOOKWORM	Malware	[BOOKWORM](https://attack.mitre.org/software/S1226) has created services that attempt to resemble legitimate services to include a service named `Micr...
S0367	Emotet	Malware	[Emotet](https://attack.mitre.org/software/S0367) has installed itself as a new service with the service name `Windows Defender System Service` and di...
S0647	Turian	Malware	[Turian](https://attack.mitre.org/software/S0647) can disguise as a legitimate service to blend into normal operations.(Citation: ESET BackdoorDiploma...
S0409	Machete	Malware	[Machete](https://attack.mitre.org/software/S0409) renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Pytho...
S1031	PingPull	Malware	[PingPull](https://attack.mitre.org/software/S1031) can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and ...
S0601	Hildegard	Malware	[Hildegard](https://attack.mitre.org/software/S0601) has disguised itself as a known Linux process.(Citation: Unit 42 Hildegard Malware)
S0260	InvisiMole	Malware	[InvisiMole](https://attack.mitre.org/software/S0260) has attempted to disguise itself by registering under a seemingly legitimate service name.(Citat...
S0180	Volgmer	Malware	Some [Volgmer](https://attack.mitre.org/software/S0180) variants add new services with display names generated by a list of hard-coded strings such as...
S0495	RDAT	Malware	[RDAT](https://attack.mitre.org/software/S0495) has used Windows Video Service as a name for malicious services.(Citation: Unit42 RDAT July 2020)
S0439	Okrum	Malware	[Okrum](https://attack.mitre.org/software/S0439) can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to ...
S1130	Raspberry Robin	Malware	[Raspberry Robin](https://attack.mitre.org/software/S1130) will execute its payload prior to initializing command and control traffic by impersonating...
S0410	Fysbis	Malware	[Fysbis](https://attack.mitre.org/software/S0410) has masqueraded as the rsyncd and dbus-inotifier services.(Citation: Fysbis Dr Web Analysis)
S1033	DCSrv	Malware	[DCSrv](https://attack.mitre.org/software/S1033) has masqueraded its service as a legitimate svchost.exe process.(Citation: Checkpoint MosesStaff Nov ...
S0444	ShimRat	Malware	[ShimRat](https://attack.mitre.org/software/S0444) can impersonate Windows services and antivirus products to avoid detection on compromised systems.(...

References

Frequently Asked Questions

What is T1036.004 (Masquerade Task or Service)?

T1036.004 is a MITRE ATT&CK technique named 'Masquerade Task or Service'. It belongs to the Stealth tactic(s). Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/...

How can T1036.004 be detected?

Detection of T1036.004 (Masquerade Task or Service) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1036.004?

Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.

Which threat groups use T1036.004?

Known threat groups using T1036.004 include: Kimsuky, APT41, APT32, Naikon, FIN6, FIN7, ZIRCONIUM, UNC3886.