Home/ MITRE Matrix/ Defense Evasion/ T1036.004

T1036.004Masquerade Task or Service

T1036.004 — Masquerade Task or Service is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 5 detection use cases covering it and 4 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

5Use cases

4Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1036 · Masquerading

Use cases covering this technique (5)

Linux Kworker Process In Writable Process Path ESCU actions · hunting P [LLM] Tengu guardian process masquerading as kernel thread [kworker/0:0] Bespoke install · hunting DSΣPDDCS [LLM] Process Ghosting: executable created then deleted while backing a live process Bespoke install · hunting DSPCS [LLM] Stage-2 implant masquerading as node-health-check daemon (/tmp/.kh, /tmp/.ns) Bespoke install · alerting DSΣPDD [LLM] macOS Axios RAT daemon spoof + ad-hoc codesign of hidden /private/tmp binary Bespoke install · alerting DSΣPDDCS

Articles citing this technique (4)

high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43

crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65

high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489

high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542