Procedure examples

XCSSET installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.

APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”

Windshift has used revoked certificates to sign malware.

WindTail has been incompletely signed with revoked certificates.

The NETWIRE client has been signed by fake and invalid digital certificates.

Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.

BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.

Gelsemium has used unverified signatures on malicious DLLs.

SplatCloak has used a revoked certificate to exploit Windows driver execution policy where certificates issued before a specific date could still load.

PcShare has used an invalid certificate in attempt to appear legitimate.

Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.

BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.

Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.

GALLIUM used a renamed cmd.exe file to evade detection.

menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.

APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.

Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.

Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.

DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location.

StrelaStealer has used a renamed, legitimate `msinfo32.exe` executable to sideload the StrelaStealer payload during initial installation.

PHASEJAM has renamed the file `/home/bin/remotedebug` to `remotedebug.bak`, allowing the threats actors to write a malicious `/home/bin/remotedebug` shell script.

The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.

Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.

KV Botnet Activity installation steps include first identifying, then stopping, any process containing [kworker\/0:1], then renaming its initial installation stage to this process name.

During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.

Mustang Panda masqueraded Registry run keys as legitimate-looking service names such as `OneNote Update` during RedDelta Modified PlugX Infection Chain Operations.

During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.

APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.

During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.

Kimsuky has disguised services to appear as benign software or related to operating system functions.

APT41 has created services to appear as benign system tools.

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.

ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.

UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Carbanak has copied legitimate service names to use for malicious services.

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.

Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.

Storm-0501 has utilized Rclone masqueraded as svhost.exe and scvhost.exe.

BITTER has disguised malware as a Windows Security update service.

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.

APT-C-36 has disguised its scheduled tasks as those used by Google.