T1036.004 Masquerade Task or Service — Attack Simulation

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Hiding a malicious process with bind mounts
linux automated sh
Procedure ad4b73c2-d6e2-4d8b-9868-4c6f55906e01; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Creating W32Time similar named service using sc
windows automated command_prompt
Procedure b721c6ef-472c-4263-a0d9-37f1f4ecff66; elevation required; cleanup present, not reviewed. Not executed or individually validated.
linux rename /proc/pid/comm using prctl
linux automated sh
Procedure f0e3aaea-5cd9-4db6-a077-631dd19b27a8; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Creating W32Time similar named service using schtasks
windows automated command_prompt
Procedure f9f2fe59-96f7-4a7d-ba9f-a9783200d4c9; elevation required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Linux macOS Windows stealth isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1036.004 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.