T1036 Masquerading — Attack Simulation

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

• PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
• Sysmon process events: Interpreter launch and parent context, not full script content.
• Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

• Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
• Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
• On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

DC0059 collection page — Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: path, size_bytes, sha256, owner_uid.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0059",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "/opt/lab/demo.txt",
    "size_bytes": 64,
    "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "owner_uid": 1000
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: path, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0061",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "attribute": "content_hash",
    "before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0028 collection page — Collect authorized cloud VM image inventory with stable image IDs and observation time; this component is not container registry metadata.

Providers and collection configuration

• AWS CloudTrail: Management-plane API activity; supported resource/data events require separate selectors.
• Azure Monitor Activity Log: Azure resource control-plane operations; resource data-plane logs are separate.
• Google Cloud Audit Logs: Admin Activity and other categories; configure Data Access where required.

• In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.
• Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.
• Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies.

Required normalized fields: image_id, owner, state, platform, public.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0028",
  "collector": "illustrative-lab-collector",
  "observation": {
    "image_id": "image-lab-1",
    "owner": "lab-account",
    "state": "available",
    "platform": "Linux",
    "public": false
  }
}

Visibility limits: AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: process_id, image, owner_uid, started_at.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0034",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image": "/usr/bin/sleep",
    "owner_uid": 1000,
    "started_at": "2026-09-27T11:59:00Z"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

DC0060 collection page — Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: service, action, executable, actor.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0060",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "LabService",
    "action": "install",
    "executable": "C:\\Lab\\service.exe",
    "actor": "lab-admin"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

DC0041 collection page — Inventory service name, executable, startup mode, owner and status using supported OS APIs; compare successive snapshots.

Providers and collection configuration

• osquery: Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.
• Linux Audit plus inventory snapshots: Events explain changes; snapshots describe state at collection time.

• Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.
• Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.
• Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset.

Required normalized fields: service, executable, start_mode, state.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0041",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "LabService",
    "executable": "C:\\Lab\\service.exe",
    "start_mode": "manual",
    "state": "stopped"
  }
}

Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.

MITRE detection strategy

38 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Potentially Suspicious Execution From Tmp Folder — test; product: linux; category: process_creation.
• Interactive Bash Suspicious Children — test; product: linux; category: process_creation.
• New or Renamed User Account with '$' Character — test; product: windows; service: security.
• Password Protected ZIP File Opened (Suspicious Filenames) — test; product: windows; service: security.
• Windows Binaries Write Suspicious Extensions — test; category: file_event; product: windows.
• Potential Homoglyph Attack Using Lookalike Characters in Filename — test; category: file_event; product: windows.
• Suspicious Calculator Usage — test; category: process_creation; product: windows.
• Suspicious CodePage Switch Via CHCP — test; category: process_creation; product: windows.
• CreateDump Process Dump — test; category: process_creation; product: windows.
• DumpMinitool Execution — test; category: process_creation; product: windows.
• Suspicious DumpMinitool Execution — test; category: process_creation; product: windows.
• Explorer Process Tree Break — test; category: process_creation; product: windows.
• Findstr Launching .lnk File — test; category: process_creation; product: windows.
• Forfiles.EXE Child Process Masquerading — test; category: process_creation; product: windows.
• HackTool - XORDump Execution — test; category: process_creation; product: windows.
• Potential Fake Instance Of Hxtsr.EXE Executed — test; product: windows; category: process_creation.
• CodePage Modification Via MODE.COM To Russian Language — test; category: process_creation; product: windows.
• Suspicious MSDT Parent Process — test; category: process_creation; product: windows.
• PUA - Potential PE Metadata Tamper Using Rcedit — test; category: process_creation; product: windows.
• Renamed CreateDump Utility Execution — test; category: process_creation; product: windows.
• Renamed ZOHO Dctask64 Execution — test; category: process_creation; product: windows.
• Renamed Plink Execution — test; category: process_creation; product: windows.
• Process Memory Dump Via Comsvcs.DLL — test; category: process_creation; product: windows.
• Suspicious Process Start Locations — test; category: process_creation; product: windows.
• Sdiagnhost Calling Suspicious Child Process — test; category: process_creation; product: windows.
• Potential Command Line Path Traversal Evasion Attempt — test; category: process_creation; product: windows.
• Process Execution From A Potentially Suspicious Folder — test; category: process_creation; product: windows.
• Potential Homoglyph Attack Using Lookalike Characters — test; category: process_creation; product: windows.
• Suspicious Process Parents — test; category: process_creation; product: windows.
• System File Execution Location Anomaly — test; category: process_creation; product: windows.
• Procdump Execution — test; category: process_creation; product: windows.
• Potential SysInternals ProcDump Evasion — test; category: process_creation; product: windows.
• Potential LSASS Process Dump Via Procdump — stable; category: process_creation; product: windows.
• Taskmgr as LOCAL_SYSTEM — test; category: process_creation; product: windows.
• New Process Created Via Taskmgr.EXE — test; category: process_creation; product: windows.
• Potential ReflectDebugger Content Execution Via WerFault.EXE — test; product: windows; category: process_creation.
• Suspicious Child Process Of Wermgr.EXE — test; category: process_creation; product: windows.
• Suspicious Windows Update Agent Empty Cmdline — test; category: process_creation; product: windows.

• S0148 RTM — malware.

  RTM has been delivered as archived Windows executable files masquerading as PDF documents.[Unit42 Redaman January 2019]

  Exact relationship: relationship--f981c633-9333-4c7d-a168-7bea28f64d52
• S0266 TrickBot — malware.

  The TrickBot downloader has used an icon to appear as a Microsoft Word document.[Cyberreason Anchor December 2019]

  Exact relationship: relationship--a8126b8d-8dd7-4e12-a384-96dabb975725
• S0268 Bisonal — malware.

  Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.[Talos Bisonal Mar 2020]

  Exact relationship: relationship--ffff35dc-3741-4fba-9680-f0fbe321c0b0
• S0368 NotPetya — malware.

  NotPetya drops PsExec with the filename dllhost.dat.[Talos Nyetya June 2017]

  Exact relationship: relationship--ab372993-3d63-4ca3-a064-e4b5820d8970
• S0446 Ryuk — malware.

  Ryuk can create .dll files that actually contain a Rich Text File format document.[ANSSI RYUK RANSOMWARE]

  Exact relationship: relationship--df3548d1-800d-4d18-8566-3a5fe925a2ef
• S0453 Pony — malware.

  Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.[Malwarebytes Pony April 2016]

  Exact relationship: relationship--237cd65a-e30e-4f8a-9822-f50b818e1491
• S0458 Ramsay — malware.

  Ramsay has masqueraded as a JPG image file.[Eset Ramsay May 2020]

  Exact relationship: relationship--a38af2cc-ccc7-41aa-936c-fe15a13ddafa
• S0466 WindTail — malware.

  WindTail has used icons mimicking MS Office files to mask payloads.[objective-see windtail1 dec 2018]

  Exact relationship: relationship--81603db2-a657-4716-a7ca-e6562799e98e
• S0497 Dacls — malware.

  The Dacls Mach-O binary has been disguised as a .nib file.[SentinelOne Lazarus macOS July 2020]

  Exact relationship: relationship--ebfa89db-b37b-4b66-a820-b863bd012b80
• S0565 Raindrop — malware.

  Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.[Symantec RAINDROP January 2021][Microsoft Deep Dive Solorigate January 2021]

  Exact relationship: relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f
• S0615 SombRAT — malware.

  SombRAT can use a legitimate process name to hide itself.[CISA AR21-126A FIVEHANDS May 2021]

  Exact relationship: relationship--f40170e7-5246-442e-95ad-1b810107b8b8
• S0622 AppleSeed — malware.

  AppleSeed can disguise JavaScript files as PDFs.[Malwarebytes Kimsuky June 2021]

  Exact relationship: relationship--2f249959-a448-454d-85ab-f71c8c5ff277
• S0634 EnvyScout — malware.

  EnvyScout has used folder icons for malicious files to lure victims into opening them.[MSTIC Nobelium Toolset May 2021]

  Exact relationship: relationship--f09c9f4a-345f-4352-aaba-7b0b0a24085c
• S0635 BoomBox — malware.

  BoomBox has the ability to mask malicious data strings as PDF files.[MSTIC Nobelium Toolset May 2021]

  Exact relationship: relationship--84be9d61-ec20-4066-8c99-b99d9127fce2
• S0637 NativeZone — malware.

  NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.[SentinelOne NobleBaron June 2021]

  Exact relationship: relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d
• S0658 XCSSET — malware.

  XCSSET installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.[trendmicro xcsset xcode project 2020][Microsoft March 2025 XCSSET]

  Exact relationship: relationship--51650560-9aff-460b-9766-14c83bdb2198
• S0661 FoggyWeb — malware.

  FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.[MSTIC FoggyWeb September 2021]

  Exact relationship: relationship--6c0510e4-a642-4dfe-9632-dff6f97e09de
• S0662 RCSession — malware.

  RCSession has used a file named English.rtf to appear benign on victim hosts.[Secureworks BRONZE PRESIDENT December 2019][Trend Micro DRBControl February 2020]

  Exact relationship: relationship--ea99ff52-af1e-49af-9cfe-b224c9a9eea4
• S0673 DarkWatchman — malware.

  DarkWatchman has used an icon mimicking a text file to mask a malicious executable.[Prevailion DarkWatchman 2021]

  Exact relationship: relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b
• S0682 TrailBlazer — malware.

  TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.[CrowdStrike StellarParticle January 2022]

  Exact relationship: relationship--eca68811-ebe9-4ee0-8fb0-afa5975eb938
• S0689 WhisperGate — malware.

  WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.[Medium S2W WhisperGate January 2022]

  Exact relationship: relationship--d4e0558a-83e2-4d99-bc80-aff1bb367724
• S0696 Flagpro — malware.

  Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.[NTT Security Flagpro new December 2021]

  Exact relationship: relationship--702c674e-110e-4f6d-9117-be1803d84e88
• S1015 Milan — malware.

  Milan has used an executable named `companycatalogue` to appear benign.[ClearSky Siamesekitten August 2021]

  Exact relationship: relationship--7b43c9ba-49bc-4966-a987-2f991d0f44a2
• S1018 Saint Bot — malware.

  Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.[Malwarebytes Saint Bot April 2021][Palo Alto Unit 42 OutSteel SaintBot February 2022 ]

  Exact relationship: relationship--37e3dbd7-9ecc-4e3a-9fa3-488e3a910f55
• S1046 PowGoop — malware.

  PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).[DHS CISA AA22-055A MuddyWater February 2022]

  Exact relationship: relationship--757e8e47-b89d-4a70-a785-deefe6468006
• S1066 DarkTortilla — malware.

  DarkTortilla's payload has been renamed `PowerShellInfo.exe`.[Secureworks DarkTortilla Aug 2022]

  Exact relationship: relationship--5c6230da-a47d-435f-9836-49648f03e76e
• S1111 DarkGate — malware.

  DarkGate can masquerade as pirated media content for initial delivery to victims.[Ensilo Darkgate 2018]

  Exact relationship: relationship--fd094102-e496-4dcf-bbf1-1630a762019d
• S1164 UPSTYLE — malware.

  UPSTYLE has masqueraded filenames using examples such as `update.py`.[Volexity UPSTYLE 2024]

  Exact relationship: relationship--99bc173b-a825-483c-969e-868356209ff6
• S1183 StrelaStealer — malware.

  StrelaStealer PE executable payloads have used uncommon but legitimate extensions such as `.com` instead of `.exe`.[IBM StrelaStealer 2024]

  Exact relationship: relationship--7c0d0a39-3a59-450b-8101-3e79792cd37f
• S1240 RedLine Stealer — malware.

  RedLine Stealer malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.[Kroll RedLine Stealer August 2024]

  Exact relationship: relationship--5cd22798-0d6e-4bed-b139-c46a4cfa87a5
• S1246 BeaverTail — malware.

  BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.[PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024]

  Exact relationship: relationship--cb88a1a6-33a4-4c1a-a6ad-10b4b5f827dd
• S9010 GlassWorm — malware.

  GlassWorm has masqueraded as legitimate VSCode extensions.[Aikido GlassWorm October 2025][Koi GlassWorm Rust December 2025] GlassWorm has also impersonated Github projects.[Aikido GlassWorm October 2025]

  Exact relationship: relationship--61f793e5-6b95-46db-a54d-74745747a3d5
• S9038 DynoWiper — malware.

  DynoWiper has been named after well-known files schtask.exe, schtask2.exe, and <redacted>_update.exe.[CERT Polska][ESET DynoWiper Update JAN 2026]

  Exact relationship: relationship--c5fe3e1e-775e-4fe6-8a70-0a7e70835081

When the file is unzipped and the README.cmd file opened, it executes and changes the .pdf to .dll and executes the dll. This is a BazaLoader technique as reported here

Pinned Atomic procedure · 4449c89b-ec82-43a4-89c1-91e2f1abeecc · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• url: Location of zip file (type url; source default https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1036/bin/T1036.zip)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Zip file must be present.

It may be suspicious seeing a file copy of an EXE in System32 or SysWOW64 to a non-system directory or executing from a non-system directory.

Pinned Atomic procedure · 51005ac7-52e2-45e0-bdab-d17c6d4916cd · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

• M1017 User Training

  Train users not to open email attachments or click unknown links (URLs). Such training fosters more secure habits within your organization and will limit many of the risks.

• M1018 User Account Management

  Consider defining and enforcing a naming convention for user accounts to more easily spot generic account names that do not fit the typical schema.

• M1022 Restrict File and Directory Permissions

  Use file system access controls to protect folders such as C:\\Windows\\System32.

• M1038 Execution Prevention

  Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

• M1040 Behavior Prevention on Endpoint

  Implement security controls on the endpoint, such as a Host Intrusion Prevention System (HIPS), to identify and prevent execution of potentially malicious files (such as those with mismatching file signatures).

• M1045 Code Signing

  Require signed binaries.

• M1047 Audit

  Audit user accounts to ensure that each one has a defined purpose.

• M1049 Antivirus/Antimalware

  Anti-virus can be used to automatically quarantine suspicious files.