H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Masquerade Task or Service

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

95 recorded

Relationships

mapped-to
from Task Impersonation
Technique
subtechnique-of
to Masquerading
Technique
uses
from 2022 Ukraine Electric Power Attack
Campaign
uses
from APT32
Group
uses
from APT41
Group
uses
from APT41 DUST
Campaign
uses
from APT-C-36
Group
uses
from Aquatic Panda
Group
uses
from Attor
Malware
uses
from BackdoorDiplomacy
Group
uses
from Bazar
Malware
uses
from BITTER
Group
uses
from Black Basta
Malware
uses
from BOOKWORM
Malware
uses
from build_downer
Malware
uses
from C0017
Campaign
uses
from CanisterWorm
Malware
uses
from Carbanak
Group
uses
from Catchamas
Malware
uses
from ComRAT
Malware
uses
from Crutch
Malware
uses
from CSPY Downloader
Tool
uses
from DCSrv
Malware
uses
from DEADEYE
Malware
uses
from DEADWOOD
Malware
uses
from Egregor
Malware
uses
from Emotet
Malware
uses
from Exaramel for Windows
Malware
uses
from FIN13
Group
uses
from FIN6
Group
uses
from FIN7
Group
uses
from Fox Kitten
Group
uses
from Frankenstein
Campaign
uses
from FunnyDream
Malware
uses
from Fysbis
Malware
uses
from GoldMax
Malware
uses
from Green Lambert
Malware
uses
from Heyoka Backdoor
Malware
uses
from Higaisa
Group
uses
from Hildegard
Malware
uses
from InnaputRAT
Malware
uses
from InvisiMole
Malware
uses
from IronNetInjector
Tool
uses
from KillDisk
Malware
uses
from Kimsuky
Group
uses
from KONNI
Malware
uses
from KV Botnet Activity
Campaign
uses
from Kwampirs
Malware
uses
from Lazarus Group
Group
uses
from Machete
Malware
uses
from Magic Hound
Group
uses
from Maze
Malware
uses
from Meteor
Malware
uses
from Naikon
Group
uses
from Nebulae
Malware
uses
from Nidiran
Malware
uses
from NightClub
Malware
uses
from Okrum
Malware
uses
from OSX_OCEANLOTUS.D
Malware
uses
from PingPull
Malware
uses
from PlugX
Malware
uses
from POWERSTATS
Malware
uses
from PROMETHIUM
Group
uses
from Qilin
Malware
uses
from RainyDay
Malware
uses
from Raspberry Robin
Malware
uses
from RawPOS
Malware
uses
from RDAT
Malware
uses
from RedDelta Modified PlugX Infection Chain Operations
Campaign
uses
from RTM
Malware
uses
from Seasalt
Malware
uses
from Shamoon
Malware
uses
from ShimRat
Malware
uses
from SLOTHFULMEDIA
Malware
uses
from SolarWinds Compromise
Campaign
uses
from Spica
Malware
uses
from Storm-0501
Group
uses
from StrongPity
Malware
uses
from SUGARDUMP
Malware
uses
from SVCReady
Malware
uses
from SysUpdate
Malware
uses
from Tarrask
Malware
uses
from TinyTurla
Malware
uses
from TONESHELL
Malware
uses
from Truvasys
Malware
uses
from Turian
Malware
uses
from UNC3886
Group
uses
from Uroburos
Malware
uses
from VIRTUALPITA
Malware
uses
from VOID MANTICORE
Group
uses
from Volgmer
Malware
uses
from Winter Vivern
Group
uses
from Wizard Spider
Group
uses
from ZIRCONIUM
Group
uses
from ZxxZ
Malware
5 external

References

mitre-attack
T1036.004
open
Fysbis Dr Web Analysis
https://vms.drweb.com/virus/?i=4276269
open
Palo Alto Shamoon Nov 2016
http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
open
Systemd Service Units
https://www.freedesktop.org/software/systemd/man/systemd.service.html
open
TechNet Schtasks
https://technet.microsoft.com/en-us/library/bb490996.aspx
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance