Home/ MITRE Matrix/ Defense Evasion/ T1036.009

T1036.009Break Process Trees

T1036.009 — Break Process Trees is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 3 detection use cases covering it and 1 threat-intel article citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1036 · Masquerading

Use cases covering this technique (3)

Windows Svchost.exe Parent Process Anomaly ESCU actions · hunting P Windows Unusual SysWOW64 Process Run System32 Executable ESCU actions · hunting P [LLM] File dropped with invisible Unicode in its name (Hangul Filler U+3164 masquerading) Bespoke weapon · alerting DSΣPDDCS

Articles citing this technique (1)

high Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters art-2597