T1036.004sub-technique of T1036 Masquerading

Masquerade Task or Service

Linux · macOS · Windowsnothing on this site yetT1036.004 on attack.mitre.org

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution

Creation or modification of Windows services or scheduled tasks with names or descriptions mimicking legitimate entries, followed by anomalous execution of untrusted binaries or LOLBAS.
Creation or modification of `systemd` service units or cron jobs using deceptive naming and untrusted command paths, often followed by lateral network activity or privilege escalation.
Creation of LaunchAgents or LaunchDaemons with names resembling known system services but executing non-Apple signed code or scripts.

the rest of T1036

T1036.001 Invalid Code Signature · not covered yet
T1036.002 Right-to-Left Override · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.006 Space after Filename · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.008 Masquerade File Type · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.011 Overwrite Process Arguments · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.