sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Koadic can identify logged in users across the domain and views user sessions.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
The OsInfo function in Komplex collects the current running username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Kwampirs collects registered owner details by using the commands `systeminfo` and `net config workstation`.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
LiteDuke can enumerate the account name on a targeted system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
LitePower can determine if the current user has admin privileges.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Lizar can collect the username from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Lokibot has the ability to discover the username on the infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Lucifer has the ability to identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MacMa can collect the username from the compromised machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Mafalda can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MarkiRAT can retrieve the victim’s username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MechaFlounder has the ability to identify the username and hostname on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Metamorfo has collected the username from the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Micropsia collects the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Milan can identify users registered to a targeted machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MirageFox can gather the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Mis-Type runs tests to determine the privilege level of the compromised user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
MoonWind obtains the victim username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
More_eggs has the capability to gather the username from the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Mosquito runs `whoami` on the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
NBTscan can list active users on the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
NGLite will run the `whoami` command to gather system information and return this to the command and control server.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
NOKKI can collect the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
NanHaiShu collects the username from the victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Neoichor can collect the user name from a victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ObliqueRAT can check for blocklisted usernames on infected endpoints.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Octopus can collect the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Okrum can collect the victim username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
POWERSTATS has the ability to identify the username on the compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
POWRUNER may collect information about the currently logged in user by running `whoami` on a victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
PowerDuke has commands to get the current user's name and SID.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
PowerShower has the ability to identify the current user on the infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
A module in Prikormka collects information from the victim about the current user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
PyDCrypt has probed victim machines with `whoami` and has collected the username from the machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
QUADAGENT gathers the victim username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
QakBot can identify the user name on a compromised system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
QuasarRAT can enumerate the username and account type.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RATANKBA runs the `whoami` and `query user` commands.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RCSession can gather system owner information, including user and administrator privileges.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RGDoor executes the `whoami` on the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ROKRAT can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RTM can obtain the victim username and permissions.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Reaver collects the victim's username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Remsec can obtain information about the current user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Revenge RAT gathers the username from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Rifdoor has the ability to identify the username on the compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Rising Sun can detect the username of the infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
RogueRobin collects the victim’s username and whether that user is an admin.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
S-Type has run tests to determine the privilege level of the compromised user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SDBbot has the ability to identify the user on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SHARPSTATS has the ability to identify the username on the compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can gather a list of logged on users.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SLOTHFULMEDIA has collected the username from a victim machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SMOKEDHAM has used `whoami` commands to identify system owners.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
STARWHALE can gather the username from an infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SUNBURST collected the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SVCReady can collect the username from an infected host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Saint Bot can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ServHelper will attempt to enumerate the username of the victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ShadowPad has collected the username of the victim system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SideTwist can collect the username on a targeted system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Small Sieve can obtain the id of a logged in user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SocGholish can use `whoami` to obtain the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SodaMaster can identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SombRAT can execute `getinfo`  to identify the username on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Spark has run the whoami command and has a built-in command to identify the user logged in.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SpeakUp uses the `whoami` command.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Squirrelwaffle can collect the user name from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SslMM sends the logged-on username to its hard-coded C2.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
StrifeWater can collect the user name from the victim's machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SynAck gathers user names from infected hosts.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Sys10 collects the account name of the logged-in user and sends it to the C2.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
SysUpdate can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
TrickBot can identify the user and groups the user belongs to on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can gather information about the user on a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Turian can retrieve usernames.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
UPPERCUT has the capability to collect the current logged on user’s username from a machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Unknown Logger can obtain information about the victim usernames.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
VERMIN gathers the username from the victim’s machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Valak can gather information regarding the user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
WINDSHIELD can gather the victim user name.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
WINERACK can gather information on the victim username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
WellMail can identify the current username on the victim system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
WellMess can collect the username on the victim machine to send to C2.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Woody RAT can retrieve a list of user accounts and usernames from an infected machine.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
Zebrocy gets the username from the system.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ZxShell can collect the owner and organization information from the target workstation.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
ZxxZ can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
metaMain can collect the username from a compromised host.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
njRAT enumerates the current user during the initial infection.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
yty collects the victim’s username.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
zwShell can obtain the name of the logged-in user on the victim.
Technique: T1033 System Owner/User Discovery, Tactic: TA0007 Discovery
During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
During C0018, AvosLocker was disguised using the victim company name as the filename.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
For Operation Dust Storm, the threat actors disguised some executables as JPG files.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
APT28 has renamed the WinRAR utility to avoid detection.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
LazyScripter has used several different security software icons to disguise executables.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
OilRig has used .doc file extensions to mask malicious executables.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
PLATINUM has renamed rar.exe to avoid detection.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
TA551 has masked malware DLLs as dat and jpg files.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
TeamTNT has disguised their scripts with docker-related file names.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
AppleSeed can disguise JavaScript files as PDFs.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
BoomBox has the ability to mask malicious data strings as PDF files.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
The Dacls Mach-O binary has been disguised as a .nib file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
DarkGate can masquerade as pirated media content for initial delivery to victims.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
DarkTortilla's payload has been renamed `PowerShellInfo.exe`.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
DarkWatchman has used an icon mimicking a text file to mask a malicious executable.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
EnvyScout has used folder icons for malicious files to lure victims into opening them.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Milan has used an executable named `companycatalogue` to appear benign.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
NotPetya drops PsExec with the filename dllhost.dat.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
RCSession has used a file named English.rtf to appear benign on victim hosts.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
RTM has been delivered as archived Windows executable files masquerading as PDF documents.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Ramsay has masqueraded as a JPG image file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Ryuk can create .dll files that actually contain a Rich Text File format document.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
SombRAT can use a legitimate process name to hide itself.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
The TrickBot downloader has used an icon to appear as a Microsoft Word document.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
WindTail has used icons mimicking MS Office files to mask payloads.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and `Info.plist`.
Technique: T1036 Masquerading, Tactic: TA0005 Defense Evasion
APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
Windshift has used revoked certificates to sign malware.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
Gelsemium has used unverified signatures on malicious DLLs.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
The NETWIRE client has been signed by fake and invalid digital certificates.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
PcShare has used an invalid certificate in attempt to appear legitimate.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
WindTail has been incompletely signed with revoked certificates.
Technique: T1036.001 Masquerading: Invalid Code Signature, Tactic: TA0005 Defense Evasion
BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.
Technique: T1036.002 Masquerading: Right-to-Left Override, Tactic: TA0005 Defense Evasion
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.
Technique: T1036.002 Masquerading: Right-to-Left Override, Tactic: TA0005 Defense Evasion
Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.
Technique: T1036.002 Masquerading: Right-to-Left Override, Tactic: TA0005 Defense Evasion
Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.
Technique: T1036.002 Masquerading: Right-to-Left Override, Tactic: TA0005 Defense Evasion
Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.
Technique: T1036.002 Masquerading: Right-to-Left Override, Tactic: TA0005 Defense Evasion
APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
GALLIUM used a renamed cmd.exe file to evade detection.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
Lazarus Group has renamed system utilities such as `wscript.exe` and `mshta.exe`.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the `C:\\` root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.
Technique: T1036.003 Masquerading: Rename System Utilities, Tactic: TA0005 Defense Evasion
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
During C0017, APT41 used `SCHTASKS  /Change` to modify legitimate scheduled tasks to run malicious code.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 named tasks `\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager` in order to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
APT-C-36 has disguised its scheduled tasks as those used by Google.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
APT41 has created services to appear as benign system tools.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
BITTER has disguised malware as a Windows Security update service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Carbanak has copied legitimate service names to use for malicious services.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
FIN13 has used scheduled tasks names such as `acrotyr` and `AppServicesr` to mimic the same names in a compromised network's `C:\Windows` directory.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Higaisa named a shellcode loader binary `svchast.exe` to spoof the legitimate `svchost.exe`.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Kimsuky has disguised services to appear as benign software or related to operating system functions.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Naikon renamed a malicious service `taskmgr` to appear to be a legitimate version of Task Manager.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
PROMETHIUM has named services to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
ZIRCONIUM has created a run key named `Dropbox Update Setup` to mask a persistence mechanism for a malicious binary.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Bazar can create a task named to appear benign.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Black Basta has established persistence by creating a new service named `FAX` after deleting the legitimate service by the same name.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
ComRAT has used a task name associated with Windows SQM Consolidator.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Crutch has established persistence with a scheduled task impersonating the Outlook item finder.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
DCSrv has masqueraded its service as a legitimate svchost.exe process.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
DEADEYE has used `schtasks /change` to modify scheduled tasks including `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility, \Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Egregor has masqueraded the svchost.exe process to exfiltrate data.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
FunnyDream has used a service named `WSearch` for execution.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Fysbis has masqueraded as the rsyncd and dbus-inotifier services.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
GoldMax has impersonated systems management software to avoid detection.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Green Lambert has created a new executable named `Software Update Check` to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Hildegard has disguised itself as a known Linux process.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
KONNI has pretended to be the xmlProv Network Provisioning service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
KillDisk registers as a service under the Plug-And-Play Support name.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Nebulae has created a service named "Windows Update Agent1" to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
NightClub has created a service named `WmdmPmSp` to spoof a Windows Media service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file `com.apple.openssl.plist` which executes OSX_OCEANLOTUS.D from the user's `~/Library/OpenSSL/` folder upon user login.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`,  and `Onedrive` to evade detection.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
RDAT has used Windows Video Service as a name for malicious services.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
RTM has named the scheduled task it creates "Windows Update".
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
SVCReady has named a task `RecoveryExTask` as part of its persistence activity.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
StrongPity has named services to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped  C2 connections.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
TinyTurla has mimicked an existing Windows service by being installed as `Windows Time Service`.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Turian can disguise as a legitimate service to blend into normal operations.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Uroburos has registered a service named `WerFaultSvc`, likely to spoof the legitimate Windows error reporting service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
ZxxZ has been disguised as a Windows security update service.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.
Technique: T1036.004 Masquerading: Masquerade Task or Service, Tactic: TA0005 Defense Evasion
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp  to .upx likely to avoid hunting detections.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
During the SolarWinds Compromise, APT29 renamed software and DLLs with legitimate names to appear benign.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT41 attempted to masquerade their files as popular anti-virus software.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a `KB<digits>.zip` pattern.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
BackdoorDiplomacy has dropped implants in folders named for legitimate software.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
FIN13 has masqueraded WAR files to look like legitimate packages such as, wsexample.war, wsexamples.com, examples.war, and exampl3s.war.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ferocious Kitten has named malicious files `update.exe` and loaded them into the compromise host's “Public” folder.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Gamaredon Group has used legitimate process names to hide malware including `svchosst`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion
Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.
Technique: T1036.005 Masquerading: Match Legitimate Name or Location, Tactic: TA0005 Defense Evasion