MITRE ATT&CK - Техника Имитация задачи или службы

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Masquerading: Имитация задачи или службы

Other sub-techniques of Masquerading (7)

ID	Название
.001	Недействительная подпись кода
.002	Использование символа RLO
.003	Переименование системных утилит
.004	Имитация задачи или службы
.005	Подбор легитимного имени или расположения
.006	Пробел после имени файла
.007	Двойное расширение файла

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

ID: T1036.004

Относится к технике: T1036

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Требуемые разрешения: Administrator, SYSTEM, User

Источники данных: Command: Command Execution, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata

Версия: 1.1

Дата создания: 10 Feb 2020

Последнее изменение: 18 Oct 2021

Название	Описание
Примеры процедур
DCSrv	DCSrv has masqueraded its service as a legitimate svchost.exe process.(Citation: Checkpoint MosesStaff Nov 2021)
APT29	APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)
PlugX	In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."(Citation: FireEye APT10 April 2017)
Attor	Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).(Citation: ESET Attor Oct 2019)
Maze	Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.(Citation: Sophos Maze VM September 2020)
RDAT	RDAT has used Windows Video Service as a name for malicious services.(Citation: Unit42 RDAT July 2020)
Kimsuky	Kimsuky has disguised services to appear as benign software or related to operating system functions.(Citation: CISA AA20-301A Kimsuky)
Carbanak	Carbanak has copied legitimate service names to use for malicious services.(Citation: Kaspersky Carbanak)
SUGARDUMP	SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.(Citation: Mandiant UNC3890 Aug 2022)
POWERSTATS	POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.(Citation: ClearSky MuddyWater Nov 2018)
Fysbis	Fysbis has masqueraded as the rsyncd and dbus-inotifier services.(Citation: Fysbis Dr Web Analysis)
Meteor	Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.(Citation: Check Point Meteor Aug 2021)
RawPOS	New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".(Citation: Kroll RawPOS Jan 2017)(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)
FIN7	FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.(Citation: Morphisec FIN7 June 2017)
RainyDay	RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."(Citation: Bitdefender Naikon April 2021)
Shamoon	Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)
ZxxZ	ZxxZ has been disguised as a Windows security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)
build_downer	build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.(Citation: Trend Micro Tick November 2019)
PingPull	PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and `Onedrive` to evade detection.(Citation: Unit 42 PingPull Jun 2022)
StrongPity	StrongPity has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Seasalt	Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.(Citation: Mandiant APT1 Appendix)
KONNI	KONNI has pretended to be the xmlProv Network Provisioning service.(Citation: Malwarebytes Konni Aug 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
APT-C-36	APT-C-36 has disguised its scheduled tasks as those used by Google.(Citation: QiAnXin APT-C-36 Feb2019)
FunnyDream	FunnyDream has used a service named `WSearch` for execution.(Citation: Bitdefender FunnyDream Campaign November 2020)
CSPY Downloader	CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.(Citation: Cybereason Kimsuky November 2020)
Okrum	Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.(Citation: ESET Okrum July 2019)
ShimRat	ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.(Citation: FOX-IT May 2016 Mofang)
Egregor	Egregor has masqueraded the svchost.exe process to exfiltrate data.(Citation: Intrinsec Egregor Nov 2020)
Machete	Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.(Citation: ESET Machete July 2019)
APT32	APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".(Citation: FireEye APT32 May 2017)
Tarrask	Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped C2 connections.(Citation: Tarrask scheduled task)
Hildegard	Hildegard has disguised itself as a known Linux process.(Citation: Unit 42 Hildegard Malware)
Wizard Spider	Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.(Citation: CrowdStrike Grim Spider May 2019) It has also used common document file names for other malware binaries.(Citation: FireEye KEGTAP SINGLEMALT October 2020)
TinyTurla	TinyTurla has mimicked an existing Windows service by being installed as `Windows Time Service`.(Citation: Talos TinyTurla September 2021)
BITTER	BITTER has disguised malware as a Windows Security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Truvasys	To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.(Citation: Microsoft Win Defender Truvasys Sep 2017)
RTM	RTM has named the scheduled task it creates "Windows Update".(Citation: Unit42 Redaman January 2019)
FIN6	FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)
Nebulae	Nebulae has created a service named "Windows Update Agent1" to appear legitimate.(Citation: Bitdefender Naikon April 2021)
Naikon	Naikon renamed a malicious service `taskmgr` to appear to be a legitimate version of Task Manager.(Citation: Bitdefender Naikon April 2021)
IronNetInjector	IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.(Citation: Unit 42 IronNetInjector February 2021 )
Nidiran	Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.(Citation: Symantec Backdoor.Nidiran)(Citation: Microsoft SAM)
Bazar	Bazar can create a task named to appear benign.(Citation: Cybereason Bazar July 2020)
Crutch	Crutch has established persistence with a scheduled task impersonating the Outlook item finder.(Citation: ESET Crutch December 2020)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.(Citation: Trend Micro MacOS Backdoor November 2020)
Fox Kitten	Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
PROMETHIUM	PROMETHIUM has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
InnaputRAT	InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.(Citation: ASERT InnaputRAT April 2018)
Kwampirs	Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.(Citation: Symantec Orangeworm April 2018)
Lazarus Group	A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.(Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
Catchamas	Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.(Citation: Symantec Catchamas April 2018)
	During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.(Citation: Talos Frankenstein June 2019)
ZIRCONIUM	ZIRCONIUM has created a run key named `Dropbox Update Setup` to mask a persistence mechanism for a malicious binary.(Citation: Zscaler APT31 Covid-19 October 2020)
Green Lambert	Green Lambert has created a new executable named `Software Update Check` to appear legitimate.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
KillDisk	KillDisk registers as a service under the Plug-And-Play Support name.(Citation: ESET Telebots Dec 2016)
Exaramel for Windows	The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.(Citation: ESET TeleBots Oct 2018)
Higaisa	Higaisa named a shellcode loader binary `svchast.exe` to spoof the legitimate `svchost.exe`.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
Lazarus Group	Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.(Citation: ESET Twitter Ida Pro Nov 2021)
UNC2452	UNC2452 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)
Volgmer	Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)
Turian	Turian can disguise as a legitimate service to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)
InvisiMole	InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.(Citation: ESET InvisiMole June 2020)
GoldMax	GoldMax has impersonated systems management software to avoid detection.(Citation: MSTIC NOBELIUM Mar 2021)
ComRAT	ComRAT has used a task name associated with Windows SQM Consolidator.(Citation: ESET ComRAT May 2020)
Heyoka Backdoor	Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.(Citation: SentinelOne Aoqin Dragon June 2022)
BackdoorDiplomacy	BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)
APT41	APT41 has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)

Обнаружение

Look for changes to tasks and services that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks or services may show up as outlier processes that have not been seen before when compared against historical data. Monitor processes and command-line arguments for actions that could be taken to create tasks or services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.