value:  Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service. ;; ComRAT has used a task name associated with Windows SQM Consolidator. ;; Crutch has established persistence with a scheduled task impersonating the Outlook item finder. ;; CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications. ;; Egregor has masqueraded the svchost.exe process to exfiltrate data. ;; The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service. ;; FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service. ;; FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence. ;; Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate. ;; Fysbis has masqueraded as the rsyncd and dbus-inotifier services. ;; GoldMax has impersonated systems management software to avoid detection. ;; Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe. ;; InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService. ;; InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name. ;; IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc. ;; Kimsuky has disguised services to appear as benign software or related to operating system functions. ;; Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service. ;; A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key. ;; Machete renamed task names to masquerade as legitimate Google Chrome Java Dropbox Adobe Reader and Python tasks. ;; Maze operators have created scheduled tasks masquerading as "Windows Update Security" "Windows Update Security Patches" and "Google Chrome Security Update" designed to launch the ransomware. ;; Nidiran can create a new service named msamger (Microsoft Security Accounts Manager) which mimics the legitimate Microsoft database by the same name. ;; Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager. ;; OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents. ;; In one instance menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility." ;; POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence. ;; PROMETHIUM has named services to appear legitimate. ;; New services created by RawPOS are made to appear like legitimate Windows services with names such as "Windows Management Help Service" "Microsoft Support" and "Windows Advanced Task Manager". ;; RDAT has used Windows Video Service as a name for malicious services. ;; RTM has named the scheduled task it creates "Windows Update". ;; Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service. ;; Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service which misspells the word "maintenance." ;; ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems. ;; SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose. ;; StrongPity has named services to appear legitimate. ;; To establish persistence Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager. ;; UNC2452 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate. ;; Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application Background Security and Windows presumably as a way to masquerade as a legitimate service. ;; Wizard Spider has used scheduled tasks to install TrickBot using task names to appear legitimate such as WinDotNet GoogleTask or Sysnetsf. It has also used common document file names for other malware binaries. ;; ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary."
name: Masquerading: Masquerade Task Or Service