T1036.004 Masquerade Task or Service
Sub-technique of T1036 Masquerading
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Operation Wocao Activityhightest · windows
- Operation Wocao Activity - Securityhightest · windows
- Scheduled Task Creation Masquerading as System Processeshighexperimental · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.