Detect Masquerade Task or Service in IBM QRadar
Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones, such as 'Windows Update Security', 'Google Chrome Security Update', or 'Microsoft Network Realtime Inspection Service'.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1036 Masquerading
- Sub-technique
- T1036.004 Masquerade Task or Service
- Canonical reference
- https://attack.mitre.org/techniques/T1036/004/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
LOGSOURCENAME(logsourceid) AS log_source,
QIDNAME(qid) AS event_name,
"ServiceName",
"ServiceFileName",
"ServiceType",
"ServiceStartType",
payload
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 13, 45)
AND (
(eventid = 7045 AND (
LOWER("ServiceName") MATCHES '(windows update security|microsoft network realtime|windows advanced task|google chrome security|windows video service|windows power efficiency|system authorization|windows management help|microsoft support|windows user service)'
OR LOWER("ServiceName") MATCHES '(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)'
))
OR
(eventid = 4697 AND (
LOWER("ServiceName") MATCHES '(windows update security|microsoft network realtime|windows advanced task|google chrome security|windows video service|windows power efficiency|system authorization|windows management help|microsoft support|windows user service)'
OR LOWER("ServiceName") MATCHES '(svchost|update|security|microsoft|google|chrome|adobe).*(service|task|helper|agent)'
))
)
AND DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') > DATEADD('hour', -24, NOW())
ORDER BY starttime DESC
LIMIT 1000AQL query against QRadar SIEM targeting Windows System event log (Event ID 7045 - Service Installed) and Security log (Event ID 4697 - Service Installed) to detect services with names mimicking legitimate software. Filters on known suspicious name patterns and generic mimic patterns.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate enterprise patch management tools that register update services under names resembling Microsoft or Google services
- Corporate antivirus or EDR solutions that install security-related services with names that match the generic mimic pattern
- Custom internal tooling deployed by IT that creates services referencing vendor names in their service identifiers
Other platforms for T1036.004
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Masquerading Windows Service
Expected signal: Windows System Event ID 7045: A service was installed with ServiceName=WindowsUpdateSecurity and DisplayName='Windows Update Security Patches'. Sysmon Event ID 12/13: Registry key creation under HKLM\SYSTEM\CurrentControlSet\Services\WindowsUpdateSecurity.
- Test 2Create Masquerading Scheduled Task
Expected signal: Security Event ID 4698: A scheduled task was created with TaskName=AdobeFlashSync. Sysmon Event ID 1: schtasks.exe process creation with /create command line.
- Test 3Create Masquerading Systemd Service (Linux)
Expected signal: File creation event for /etc/systemd/system/dbus-inotifier.service. Process execution of systemctl daemon-reload. Auditd events for write to /etc/systemd/system/.
References (6)
- https://attack.mitre.org/techniques/T1036/004/
- http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
- https://vms.drweb.com/virus/?i=4276269
- https://technet.microsoft.com/en-us/library/bb490996.aspx
- https://www.freedesktop.org/software/systemd/man/systemd.service.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.004/T1036.004.md
Unlock Pro Content
Get the full detection package for T1036.004 including response playbook, investigation guide, and atomic red team tests.