MITRE ATT&CKsub-technique

T1036.004 Masquerade Task or Service

Published 2020-02-10 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-02-10

Description

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1036 Masquerading technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (95)

  • G1059 NIMBUS MANTICORE group
  • S9051 The Gentlemen Ransomware software (malware)
  • S9042 CanisterWorm software (malware)
  • G1055 VOID MANTICORE group
  • G1053 Storm-0501 group
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1226 BOOKWORM software (malware)
  • S1217 VIRTUALPITA software (malware)
  • G1048 UNC3886 group
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • C0040 APT41 DUST campaign
  • G1035 Winter Vivern group
  • S1140 Spica software (malware)
  • C0035 KV Botnet Activity campaign
  • S1134 DEADWOOD software (malware)
  • S1130 Raspberry Robin software (malware)
  • C0034 2022 Ukraine Electric Power Attack campaign
  • S1090 NightClub software (malware)
  • G1016 FIN13 group
  • C0024 SolarWinds Compromise campaign
  • S1070 Black Basta software (malware)
  • S1064 SVCReady software (malware)
  • S1052 DEADEYE software (malware)
  • C0017 C0017 campaign
  • S1044 FunnyDream software (malware)
  • S1042 SUGARDUMP software (malware)
  • C0001 Frankenstein campaign
  • S1033 DCSrv software (malware)
  • S1031 PingPull software (malware)
Show all 95 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-504 Task Impersonation attack pattern

References