T1036.004: T1036.004

Search IOCs, vulnerabilities, APT…

216.73.217.86

← Back to attack patterns

View on MITRE ATT&CK The MITRE Corporation · Published 10/02/2020 21:30 · Modified 27/03/2026 01:10

Essential information

MITRE technique ID: T1036.004
Confidence: 100/100
Revoked: No
Published: 10/02/2020 21:30
Modified: 27/03/2026 01:10
Author / Source: The MITRE Corporation

Aliases

Masquerade Task or Service

Platforms

windows macos linux

Description

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones. Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)

Kill chain phases

Kill chain	Phase
mitre-attack	defense-evasion

Marking (TLP)

External references

TechNet Schtasks
mitre-attack (T1036.004)
Fysbis Dr Web Analysis
Systemd Service Units
Palo Alto Shamoon Nov 2016

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.

Intrusion sets (APT) (54)

DPRK (North Korea) related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Daggerfly related BRONZE HIGHLANDEvasive Panda

The MITRE Corporation Confidence 100

[Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and…

First seen 01/01/1970 · Last seen 16/11/5138 ·
FIN6 related Magecart Group 6ITG08

The MITRE Corporation Confidence 100

[FIN6](https://attack.mitre.org/groups/G0037) is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Fox Kitten related UNC757Parisite

The MITRE Corporation Confidence 100

[Fox Kitten](https://attack.mitre.org/groups/G0117) is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Higaisa related

The MITRE Corporation Confidence 100

[Higaisa](https://attack.mitre.org/groups/G0126) is a threat group suspected to have South Korean origins. [Higaisa](https://attack.mitre.org/groups/G0126) has targeted government, public, and trade organizations in North Korea; however, they have also carried out…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Magic Hound related COBALT ILLUSIONITG18

The MITRE Corporation Confidence 100

[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European,…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Naikon related

The MITRE Corporation Confidence 100

[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover…

First seen 01/01/1970 · Last seen 16/11/5138 ·
PCPJack related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
PROMETHIUM related StrongPity

The MITRE Corporation Confidence 100

[PROMETHIUM](https://attack.mitre.org/groups/G0056) is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Phoenix Hyena related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SLOW#TEMPEST related

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
STARDUST CHOLLIMA related NICKEL GLADSTONEBeagleBoyz

The MITRE Corporation Confidence 100

[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020)…

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 5

37–48 of 54

GoldMax uses

Family The MITRE Corporation Confidence 100

[GoldMax](https://attack.mitre.org/software/S0588) is a second-stage C2 backdoor written in Go with Windows and Linux variants that are nearly identical in functionality. [GoldMax](https://attack.mitre.org/software/S0588) was discovered in early 2021 during the…

First seen 01/01/1970 · Last seen 16/11/5138 ·
BOOKWORM uses

Family The MITRE Corporation Confidence 100

[BOOKWORM](https://attack.mitre.org/software/S1226) is a modular trojan known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2015. [BOOKWORM](https://attack.mitre.org/software/S1226) was later updated in late 2021 and the…

First seen 01/01/1970 · Last seen 16/11/5138 ·
ZoomClutch uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Chinotto uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
SLOTHFULMEDIA uses

Family The MITRE Corporation Confidence 100

[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) is a remote access Trojan written in C++ that has been used by an unidentified "sophisticated cyber actor" since at least January 2017.(Citation: CISA MAR SLOTHFULMEDIA October…

First seen 01/01/1970 · Last seen 16/11/5138 ·
AgentTesla uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
OtterCookie uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
DEADWOOD uses

Family The MITRE Corporation Confidence 100

[DEADWOOD](https://attack.mitre.org/software/S1134) is wiper malware written in C++ using Boost libraries. [DEADWOOD](https://attack.mitre.org/software/S1134) was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been…

First seen 01/01/1970 · Last seen 16/11/5138 ·
Heyoka Backdoor uses

Family The MITRE Corporation Confidence 100

[Heyoka Backdoor](https://attack.mitre.org/software/S1027) is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by [Aoqin Dragon](https://attack.mitre.org/groups/G1007) since at least 2013.(Citation: SentinelOne Aoqin Dragon June 2022)(Citation:…

First seen 01/01/1970 · Last seen 16/11/5138 ·
PureHVNC uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
MedusaLocker uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
MiniJunk V2 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

← Previous

Page / 7

61–72 of 73

How WP-SHELLSTORM Exposed 1.4M WordPress Sites related

AlienVault Confidence 100 13 CVEs 20 MITREs 4 Malwares 6 IOCs 5 Observables 1 APT
Ukraine's UAV Supply Chain Targeted With Besomar-Themed Malware … related

AlienVault Confidence 100 20 MITREs 1 Malware 3 IOCs 1 APT
From Fake Amazon Security Alert to HarborWatch Agent: … related

20 MITREs 1 Malware 6 Observables
PCPJack Hijacked 230 AWS, GCP, and Azure Servers … related

1 CVE 12 MITREs 2 Malwares 2 Observables 1 APT
FSB’s matryoshka #2/3 – Gamaredon’s gifts that keeps … related

19 MITREs 5 Malwares 1 Observable 1 APT
RemotePE: The Lazarus RAT that lives in memory related

20 MITREs 6 Malwares 10 Observables 1 APT
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns related

AlienVault Confidence 100 20 MITREs 4 Malwares 13 IOCs 13 Observables 1 APT
Honeypot reveals botnet exploiting scriptText to launch DDoS … related

1 CVE 18 MITREs 2 Malwares 8 Observables
Operation Silent Rotor: Rust-Based Malware Targets Eurasian Unmanned … related

15 MITREs 9 Observables
Komari Red: The Monitoring Tool with a Built-in … related

AlienVault Confidence 100 19 MITREs 1 Malware 2 IOCs 2 Observables
Analysis of Attack Activities Using SSH+TOR Tunnels to … related

AlienVault Confidence 100 20 MITREs 7 IOCs 7 Observables 1 APT
The Gentlemen & SystemBC: A Sneak Peek Behind … related

46 MITREs 6 Malwares 27 Observables 1 APT

← Previous

Page / 5

1–12 of 50

Vulnerabilities (CVE) (40)

CVE-2025-53770 KEV targets

9.8 Critical

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware …

Attack vector: Network
Published: 20/07/2025
Modified: 21/12/2025

Analyzed

CVE-2026-1969 targets

5.3 Medium

The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to …

Attack vector: NETWORK
Complexity: LOW
EPSS: 0.0005 (P15.8%)
Published: 23/03/2026
Modified: 13/07/2026

CWE-434 Awaiting Analysis

CVE-2024-6473 targets

7.8 High

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

Attack vector: LOCAL
Published: 03/09/2024
Modified: 21/12/2025

Analyzed

CVE-2025-22457 KEV targets

9.0 Critical

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before …

Attack vector: Network
Published: 04/04/2025
Modified: 21/12/2025

Received

← Previous

Page / 4

37–40 of 40

T1036 subtechnique-of

Masquerading MITRE

Tool (2)

CSPY Downloader uses

The MITRE Corporation Confidence 100

[CSPY Downloader](https://attack.mitre.org/software/S0527) is a tool designed to evade analysis and download additional payloads used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Cybereason Kimsuky November 2020)
IronNetInjector uses

The MITRE Corporation Confidence 100

[IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including [ComRAT](https://attack.mitre.org/software/S0126).(Citation: Unit…

Campaign (1)

KV Botnet Activity uses

Contact About Legal notice Privacy policy Terms of use