T1036.004 — Masquerade Task or Service

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign…

Sub-technique of Masquerading (T1036).

Sigma detection rules (3)

T1036.004 Masquerading: Masquerade Task or Service

title: "T1036.004 Masquerading: Masquerade Task or Service"
id: faff2a98-ed55-4863-a631-7e089e2efe7a
description: 'Detects a newly installed Windows service whose name mimics a common legitimate/system service name but whose binary path is outside standard installation directories — the naming-masquerade pattern this technique describes. (Retargeted to System log EventID 7045, service install, which carries ServiceName/ImagePath; System EventID 1 has no standard task/service-creation schema.) Tune using: TaskNameSimilarityThreshold, BinaryReputationScore, ExecutionContext.'
references:
  - https://attack.mitre.org/techniques/T1036/004
author: Shahrukh Khan
date: 2026-05-07
license: MIT
tags:
  - attack.stealth
  - attack.t1036.004

logsource:
  product: windows
  service: system

detection:
  selection:
    EventID: '7045'
    ServiceName|contains:
      - 'Windows'
      - 'Microsoft'
      - 'Update'
      - 'Defender'
      - 'Security'
      - 'Support'

  filter_legit_path:
    ImagePath|contains:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'

  condition: selection and not filter_legit_path

falsepositives:
  - Legitimate third-party services whose vendor/product name includes one of these keywords but that install outside standard Program Files paths (e.g. portable agents); tune the ImagePath allowlist per environment. Security EventID 4698 (scheduled task creation, TaskName/Command fields) is a companion source not covered by this rule.

level: medium

T1036.004 Masquerading: Masquerade Task or Service

title: "T1036.004 Masquerading: Masquerade Task or Service"
id: 492a865c-891f-4e0d-8446-f89f6aabd8ca
description: 'Detects creation of systemd unit files whose filename mimics a well-known, trusted system service (sshd, cron, systemd-, network, docker, rsyslog, auditd) but that are written into non-standard, user-writable locations (/tmp, /dev/shm, /var/tmp, /home) rather than the standard systemd unit directories -- combining the naming-deception element of T1036.004 with a location anomaly that auditd PATH records can actually observe. Auditd cannot read ExecStart file content, so exact ExecStart-path masquerading inside a unit placed in a standard directory is not observable with this telemetry.'
references:
  - https://attack.mitre.org/techniques/T1036/004
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.stealth
  - attack.t1036.004

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_unit_file:
    type: PATH
    name|endswith: '.service'
    nametype: CREATE
  selection_legit_name:
    name|contains:
      - 'sshd'
      - 'cron'
      - 'systemd-'
      - 'network'
      - 'docker'
      - 'rsyslog'
      - 'auditd'
  selection_nonstandard_path:
    name|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/home/'
  condition: all of selection_*

falsepositives:
  - Developers testing systemd units from their home directory or /tmp before installing them properly; legitimate low-volume activity that should be rare on production hosts.

level: high

T1036.004 Masquerading: Masquerade Task or Service

title: "T1036.004 Masquerading: Masquerade Task or Service"
id: efa72661-7653-4891-bc42-28e2e7794667
description: 'Detection of Masqueraded Tasks or Services with Suspicious Naming and Execution. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistLabelSimilarity, UnsignedBinaryExecution, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1036/004
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.stealth
  - attack.t1036.004

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|endswith: '.plist'
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - '/Library/LaunchDaemons/'
  selection_label:
    TargetFilename|contains: 'com.apple.'
  filter_apple:
    TargetFilename|startswith: '/System/Library/LaunchDaemons/'
  condition: selection and selection_path and selection_label and not filter_apple

falsepositives:
  - Third-party software that legitimately, though confusingly, prefixes its LaunchAgent label with a reverse-DNS name resembling Apple naming conventions.

level: high

Related sub-techniques

Explore