Procedure examples

Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.

Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

ComRAT has used a task name associated with Windows SQM Consolidator.

VIRTUALPITA has utilized VMware service names and ports to masquerade as legitimate services.

Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.

KillDisk registers as a service under the Plug-And-Play Support name.

Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.

POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.

DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.

SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.

CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.

IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.

CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.