attack_technique: T1036.004
display_name: 'Masquerading: Masquerade Task or Service'
atomic_tests:
- name: Creating W32Time similar named service using schtasks
  auto_generated_guid: f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9
  description: Creating W32Time similar named service (win32times) using schtasks just like threat actor dubbed "Operation Wocao"
  supported_platforms:
  - windows
  executor:
    command: |
      schtasks /create /ru system /sc daily /tr "cmd /c powershell.exe -ep bypass -file c:\T1036.004_NonExistingScript.ps1" /tn win32times /f
      schtasks /query /tn win32times
    cleanup_command: |
      schtasks /tn win32times /delete /f
    name: command_prompt
    elevation_required: true
- name: Creating W32Time similar named service using sc
  auto_generated_guid: b721c6ef-472c-4263-a0d9-37f1f4ecff66
  description: Creating W32Time similar named service (win32times) using sc just like threat actor dubbed "Operation Wocao"
  supported_platforms:
  - windows
  executor:
    command: |
      sc create win32times binPath= "cmd /c start c:\T1036.004_NonExistingScript.ps1"
      sc qc win32times
    cleanup_command: |
      sc delete win32times
    name: command_prompt
    elevation_required: true
