Procedure examples

Kimsuky has disguised services to appear as benign software or related to operating system functions.

APT41 has created services to appear as benign system tools.

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.

ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.

UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.

Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Carbanak has copied legitimate service names to use for malicious services.

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.

Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.

Storm-0501 has utilized Rclone masqueraded as svhost.exe and scvhost.exe.

BITTER has disguised malware as a Windows Security update service.

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.

APT-C-36 has disguised its scheduled tasks as those used by Google.

Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.

Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.

VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.

PROMETHIUM has named services to appear legitimate.

Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.

FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.