Clankerusecase
MITRE ATT&CK detection coverage
← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1036.004

T1036.004Masquerade Task or Service

T1036.004 — Masquerade Task or Service is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 4 detection use cases covering it and 3 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
4Use cases
3Articles
0Sub-techniques
1Tactic

Use cases covering this technique (4)

Linux Kworker Process In Writable Process Path ESCU actions · hunting P [LLM] CoolClient persistence: schtasks onstart SYSTEM task masquerading as 'Windows Defender ATP Service' running defender.exe Bespoke install · alerting DSΣPDDCS [LLM] Stage-2 implant masquerading as node-health-check daemon (/tmp/.kh, /tmp/.ns) Bespoke install · alerting DSΣPDD [LLM] macOS Axios RAT daemon spoof + ad-hoc codesign of hidden /private/tmp binary Bespoke install · alerting DSΣPDDCS

Articles citing this technique (3)