VOID MANTICOREG1055 ↗
Has masqueraded as commonly used programs and services on Windows hosts.1
- Tactic
- Stealth
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 10 February 2020
- Last modified
- 12 May 2026
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.[1][2] Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
23
Threat groupsTop 8%
Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.7
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.63
Tools & malwareTop 6%
Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.4
Detection rules60th pct
Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.Masquerade Task or Service MITRE reference T1036.004
Top 8%of all ATT&CK techniques for number of groups
23 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Storm-0501G1053 ↗
Has utilized Rclone masqueraded as svhost.exe and scvhost.exe.1
UNC3886G1048 ↗
Has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.1
Winter VivernG1035 ↗
Has distributed malicious scripts and executables mimicking virus scanners.1
FIN13G1016 ↗
Has used scheduled tasks names such as acrotyr and AppServicesr to mimic the same names in a compromised network's C:\Windows directory.1
BITTERG1002 ↗
Has disguised malware as a Windows Security update service.1
All 23 groups for this technique · 6 newest in this preview
7 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda masqueraded Registry run keys as legitimate-looking service names such as OneNote Update during RedDelta Modified PlugX Infection Chain Operations.1
APT41 DUSTC0040 ↗
Disguised DUSTPAN as a legitimate Windows binary such as w3wp.exe or conn.exe.1
KV Botnet ActivityC0035 ↗
Installation steps include first identifying, then stopping, any process containing [kworker\/0:1], then renaming its initial installation stage to this process name.1
2022 Ukraine Electric Power AttackC0034 ↗
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.1
C0017C0017 ↗
During C0017, APT41 used SCHTASKS /Change to modify legitimate scheduled tasks to run malicious code.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.1
All 7 campaigns for this technique · 6 newest in this preview
63 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
CanisterWormS9042 ↗
Has masqueraded itself as systemd or as a PostgreSQL utility named pgmon.12
QilinS1242 ↗
Has created a scheduled task named TVInstallRestore to mimic TeamViewer. 1
TONESHELLS1239 ↗
Has masqueraded as the legitimate Windows utility service DISMsrv (Dism Images Servicing Utility Service).1
BOOKWORMS1226 ↗
Has created services that attempt to resemble legitimate services to include a service named Microsoft Windows DeviceSync Service.1
VIRTUALPITAS1217 ↗
Has utilized VMware service names and ports to masquerade as legitimate services.1
SpicaS1140 ↗
Has created a scheduled task named CalendarChecker for persistence on compromised hosts.1
All 63 software entries for this technique · 6 newest in this preview
Offense vs defense T1036.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 7Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1
first rule: 2019 Q4 · 7 of 7 campaigns plottedMasquerade Task or Service detection strategy DET0117
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution
3 platforms
AN0324 · Windows
Creation or modification of Windows services or scheduled tasks with names or descriptions mimicking legitimate entries, followed by anomalous execution of untrusted binaries or LOLBAS.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job CreationDC0001 | WinEventLog:Security | EventCode=4698 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7045 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TaskNameSimilarityThreshold | Similarity threshold for comparing new task/service names to known legitimate names (e.g., Levenshtein distance) |
| BinaryReputationScore | Confidence level required for allowing a binary, often from unsigned or untrusted source |
| ExecutionContext | Whether the execution came from SYSTEM, service accounts, or user contexts |
AN0325 · Linux
Creation or modification of systemd service units or cron jobs using deceptive naming and untrusted command paths, often followed by lateral network activity or privilege escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job MetadataDC0005 | linux:cron | cron activity |
| Scheduled Job ModificationDC0012 | auditd:CONFIG_CHANGE | /var/log/audit/audit.log |
| Service MetadataDC0041 | linux:osquery | scheduled/real-time |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UnitFilePath | Unusual or user-space paths for systemd unit files |
| ServiceNameDeviation | Detect units with names similar to legitimate ones (e.g., networks.service instead of network.service) |
| ExecStartPath | Track uncommon or suspicious binaries in ExecStart= directives |
AN0326 · macOS
Creation of LaunchAgents or LaunchDaemons with names resembling known system services but executing non-Apple signed code or scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job MetadataDC0005 | fs:fileevents | /Library/LaunchDaemons/*.plist, ~/Library/LaunchAgents/*.plist |
| Process CreationDC0032 | macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC |
| Service MetadataDC0041 | macos:unifiedlog | subsystem=com.apple.launchservices |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistLabelSimilarity | Detect plists with labels that closely resemble legitimate ones (e.g., com.apple.updates.plist) |
| UnsignedBinaryExecution | Toggle sensitivity for unsigned binaries or scripts launched by daemons |
| UserContext | Scope detection based on whether LaunchAgent ran in user or system context |
Tests4Executorscmd 2 · sh 2Need elevation3 of 4Have prerequisites1Have cleanup4Platformswindows, linux
Tests from Atomic Red Team (MIT licence) · technique definition