T1036.004: Masquerade Task or Service
| View on MITRE ATT&CK | T1036.004 |
|---|---|
| Tactic(s) | Defense Evasion |
| Associated CAPEC Patterns | Task Impersonation (CAPEC-504) |
Data from MITRE ATT&CK®:
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Reporting on this Technique
Evasive Panda leverages Monlam Festival to target Tibetans
This report by researchers at ESET describes a campaign which they attribute to the China-aligned APT Evasive Panda. The report describes a ...
APT40 Advisory - PRC MSS tradecraft in action
This advisory, authored by the Australian Cyber Security Centre and multiple other international cybersecurity agencies, outlines the threat posed ...
How to detect this technique
MITRE ATT&CK Data Components
Service Creation (Service)
Initial construction of a new service/daemon (ex: Windows EID 4697 or /var/log daemon logs)Service Metadata (Service)
Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )Scheduled Job Metadata (Scheduled Job)
Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.Scheduled Job Modification (Scheduled Job)
Changes made to a scheduled job, such as modifications to the execution launch (ex: Windows EID 4702 or /var/log cron logs)Control Validation Tests for this Technique
Use Atomic Red Team tests to test your defenses against this technique.