Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Masquerading: Имитация задачи или службы

Other sub-techniques of Masquerading (10)

ID	Название
.001	Недействительная подпись кода
.002	Использование символа RLO
.003	Переименование системных утилит
.004	Имитация задачи или службы
.005	Подбор легитимного имени или расположения
.006	Пробел после имени файла
.007	Двойное расширение файла
.008	Masquerade File Type
.009	Break Process Trees
.010	Masquerade Account Name

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

ID: T1036.004

Относится к технике: T1036

Тактика(-и): Defense Evasion

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata

Версия: 1.2

Дата создания: 10 Feb 2020

Последнее изменение: 29 Sep 2023

Название	Описание
Примеры процедур
DCSrv	DCSrv has masqueraded its service as a legitimate svchost.exe process.(Citation: Checkpoint MosesStaff Nov 2021)
APT29	APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)
PlugX	In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."(Citation: FireEye APT10 April 2017)
Aquatic Panda	Aquatic Panda created new, malicious services using names such as `Windows User Service` to attempt to blend in with legitimate items on victim systems.(Citation: Crowdstrike HuntReport 2022)
SVCReady	SVCReady has named a task `RecoveryExTask` as part of its persistence activity.(Citation: HP SVCReady Jun 2022)
	During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.(Citation: Mandiant-Sandworm-Ukraine-2022)
	During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.(Citation: Mandiant APT41)
Attor	Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).(Citation: ESET Attor Oct 2019)
Maze	Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.(Citation: Sophos Maze VM September 2020)
RDAT	RDAT has used Windows Video Service as a name for malicious services.(Citation: Unit42 RDAT July 2020)
Kimsuky	Kimsuky has disguised services to appear as benign software or related to operating system functions.(Citation: CISA AA20-301A Kimsuky)
Carbanak	Carbanak has copied legitimate service names to use for malicious services.(Citation: Kaspersky Carbanak)
SUGARDUMP	SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.(Citation: Mandiant UNC3890 Aug 2022)
POWERSTATS	POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.(Citation: ClearSky MuddyWater Nov 2018)
Fysbis	Fysbis has masqueraded as the rsyncd and dbus-inotifier services.(Citation: Fysbis Dr Web Analysis)
BPFDoor	BPFDoor overwrites the `argv[0]` value used by the Linux `/proc` filesystem to determine the command line and command name to display for each process. BPFDoor selects a name from 10 hardcoded names that resemble Linux system daemons, such as; `/sbin/udevd -d`, `dbus-daemon --system`, `avahi-daemon: chroot helper`, `/sbin/auditd -n`, and `/usr/lib/systemd/systemd-journald`.(Citation: Sandfly BPFDoor 2022)
Meteor	Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.(Citation: Check Point Meteor Aug 2021)
RawPOS	New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".(Citation: Kroll RawPOS Jan 2017)(Citation: TrendMicro RawPOS April 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)
FIN7	FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.(Citation: Morphisec FIN7 June 2017)
RainyDay	RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."(Citation: Bitdefender Naikon April 2021)
Shamoon	Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."(Citation: Palo Alto Shamoon Nov 2016)(Citation: McAfee Shamoon December 2018)
ZxxZ	ZxxZ has been disguised as a Windows security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Raspberry Robin	Raspberry Robin will execute its payload prior to initializing command and control traffic by impersonating one of several legitimate program names such as dllhost.exe, regsvr32.exe, or rundll32.exe.(Citation: TrendMicro RaspberryRobin 2022)
build_downer	build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.(Citation: Trend Micro Tick November 2019)
PingPull	PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and `Onedrive` to evade detection.(Citation: Unit 42 PingPull Jun 2022)
StrongPity	StrongPity has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
Seasalt	Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.(Citation: Mandiant APT1 Appendix)
KONNI	KONNI has pretended to be the xmlProv Network Provisioning service.(Citation: Malwarebytes Konni Aug 2021)
SLOTHFULMEDIA	SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
FIN13	FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.(Citation: Mandiant FIN13 Aug 2022)
APT-C-36	APT-C-36 has disguised its scheduled tasks as those used by Google.(Citation: QiAnXin APT-C-36 Feb2019)
FunnyDream	FunnyDream has used a service named `WSearch` for execution.(Citation: Bitdefender FunnyDream Campaign November 2020)
DEADWOOD	DEADWOOD will attempt to masquerade its service execution using benign-looking names such as `ScDeviceEnums`.(Citation: SentinelOne Agrius 2021)
CSPY Downloader	CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.(Citation: Cybereason Kimsuky November 2020)
Okrum	Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.(Citation: ESET Okrum July 2019)
Uroburos	Uroburos has registered a service named `WerFaultSvc`, likely to spoof the legitimate Windows error reporting service.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
ShimRat	ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.(Citation: FOX-IT May 2016 Mofang)
Egregor	Egregor has masqueraded the svchost.exe process to exfiltrate data.(Citation: Intrinsec Egregor Nov 2020)
Machete	Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.(Citation: ESET Machete July 2019)
APT32	APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".(Citation: FireEye APT32 May 2017)
Winter Vivern	Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.(Citation: SentinelOne WinterVivern 2023)
Tarrask	Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped C2 connections.(Citation: Tarrask scheduled task)
Hildegard	Hildegard has disguised itself as a known Linux process.(Citation: Unit 42 Hildegard Malware)
Wizard Spider	Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.(Citation: CrowdStrike Grim Spider May 2019) It has also used common document file names for other malware binaries.(Citation: FireEye KEGTAP SINGLEMALT October 2020)
TinyTurla	TinyTurla has mimicked an existing Windows service by being installed as `Windows Time Service`.(Citation: Talos TinyTurla September 2021)
SysUpdate	SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.(Citation: Lunghi Iron Tiger Linux)
BITTER	BITTER has disguised malware as a Windows Security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)
Truvasys	To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.(Citation: Microsoft Win Defender Truvasys Sep 2017)
RTM	RTM has named the scheduled task it creates "Windows Update".(Citation: Unit42 Redaman January 2019)
FIN6	FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)
Nebulae	Nebulae has created a service named "Windows Update Agent1" to appear legitimate.(Citation: Bitdefender Naikon April 2021)
Naikon	Naikon renamed a malicious service `taskmgr` to appear to be a legitimate version of Task Manager.(Citation: Bitdefender Naikon April 2021)
IronNetInjector	IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.(Citation: Unit 42 IronNetInjector February 2021 )
NightClub	NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.(Citation: MoustachedBouncer ESET August 2023)
	KV Botnet Activity installation steps include first identifying, then stopping, any process containing `[kworker\/0:1]`, then renaming its initial installation stage to this process name.(Citation: Lumen KVBotnet 2023)
Nidiran	Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.(Citation: Symantec Backdoor.Nidiran)(Citation: Microsoft SAM)
Bazar	Bazar can create a task named to appear benign.(Citation: Cybereason Bazar July 2020)
Crutch	Crutch has established persistence with a scheduled task impersonating the Outlook item finder.(Citation: ESET Crutch December 2020)
Emotet	Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.(Citation: Binary Defense Emotes Wi-Fi Spreader)
OSX_OCEANLOTUS.D	OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file `com.apple.openssl.plist` which executes OSX_OCEANLOTUS.D from the user's `~/Library/OpenSSL/` folder upon user login.(Citation: Unit42 OceanLotus 2017)
Fox Kitten	Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
PROMETHIUM	PROMETHIUM has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)
InnaputRAT	InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.(Citation: ASERT InnaputRAT April 2018)
Kwampirs	Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.(Citation: Symantec Orangeworm April 2018)
Lazarus Group	A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.(Citation: F-Secure Lazarus Cryptocurrency Aug 2020)
	APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.(Citation: Google Cloud APT41 2024)
Catchamas	Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.(Citation: Symantec Catchamas April 2018)
	During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.(Citation: Talos Frankenstein June 2019)
DEADEYE	DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.(Citation: Mandiant APT41)
ZIRCONIUM	ZIRCONIUM has created a run key named `Dropbox Update Setup` to mask a persistence mechanism for a malicious binary.(Citation: Zscaler APT31 Covid-19 October 2020)
Green Lambert	Green Lambert has created a new executable named `Software Update Check` to appear legitimate.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)
Spica	Spica has created a scheduled task named `CalendarChecker` for persistence on compromised hosts.(Citation: Google TAG COLDRIVER January 2024)
Magic Hound	Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.(Citation: DFIR Phosphorus November 2021)
KillDisk	KillDisk registers as a service under the Plug-And-Play Support name.(Citation: ESET Telebots Dec 2016)
	During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)
Exaramel for Windows	The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.(Citation: ESET TeleBots Oct 2018)
Higaisa	Higaisa named a shellcode loader binary `svchast.exe` to spoof the legitimate `svchost.exe`.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)
Lazarus Group	Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.(Citation: ESET Twitter Ida Pro Nov 2021)
UNC2452	UNC2452 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.(Citation: Volexity SolarWinds)
Volgmer	Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)
Turian	Turian can disguise as a legitimate service to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)
InvisiMole	InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.(Citation: ESET InvisiMole June 2020)
GoldMax	GoldMax has impersonated systems management software to avoid detection.(Citation: MSTIC NOBELIUM Mar 2021)
ComRAT	ComRAT has used a task name associated with Windows SQM Consolidator.(Citation: ESET ComRAT May 2020)
Heyoka Backdoor	Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.(Citation: SentinelOne Aoqin Dragon June 2022)
BackdoorDiplomacy	BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)
APT41	APT41 has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)
Black Basta	Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)(Citation: Trend Micro Black Basta May 2022)

Обнаружение

Look for changes to tasks and services that do not correlate with known software, patch cycles, etc. Suspicious program execution through scheduled tasks or services may show up as outlier processes that have not been seen before when compared against historical data. Monitor processes and command-line arguments for actions that could be taken to create tasks or services. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.