Procedure examples

SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.

Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.

DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.

Egregor has masqueraded the svchost.exe process to exfiltrate data.

build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.

Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.

Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

ComRAT has used a task name associated with Windows SQM Consolidator.

VIRTUALPITA has utilized VMware service names and ports to masquerade as legitimate services.

Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.

KillDisk registers as a service under the Plug-And-Play Support name.

Qilin has created a scheduled task named TVInstallRestore to mimic TeamViewer.

POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.

DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.

SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.

CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.

IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.

CanisterWorm has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.

During RedPenguin, UNC3886 created multiple strains of malware using names to mimic legitimate binaries such as appid, to, irad, lmpad, jdosd, and oemd.

During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.

During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.

In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.

During the J-magic Campaign, threat actors used the name “JunoscriptService” to masquerade malware as the Junos automation scripting service.

During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.

During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.

During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.

During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.

During the 2025 Poland Wiper Attacks, the adversaries created rules that mimicked the name of an institution already present in the network device configuration to avoid detection.

During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.

During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.

During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.

Mustard Tempest has used the filename `AutoUpdater.js` to mimic legitimate update files and has also used the Cyrillic homoglyph characters С `(0xd0a1)` and а `(0xd0b0)`, to produce the filename `Сhrome.Updаte.zip`.

Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service.

admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe

Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

APT41 attempted to masquerade their files as popular anti-virus software.

menuPass has been seen changing malicious files to appear legitimate.

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.

Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.

Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.

FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.