BIOC
Informational
✕
Windows process masquerading by an unsigned process
A process is trying to disguise itself as a legitimate Windows process, but is unsigned. This usually indicates malicious activity.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Masquerading (T1036)
Indicator:
Process action type = execution AND target process name = explorer.exe , svchost.exe , winlogon.exe , csrss.exe , lsass.exe , smss.exe , lsm.exe , taskhost.exe , rundll32.exe , dwm.exe , dllhost.exe , services.exe , Taskmgr.exe , wininit.exe AND process execution signer != Microsoft Corporation Host host os = windows
Preventable: yes