ATT&CK technique
View on MITRE ATT&CK →
T1036.004
Masquerade Task or Service
Stealth
9 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score | deprecated | 2026-10-23 |
| elastic | Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score | production | 2026-10-19 |
| elastic | Network Activity Detected via Kworker | production | 2026-09-18 |
| elastic | Executable Masquerading as Kernel Process | production | 2026-09-18 |
| elastic | Suspicious Kworker UID Elevation | production | 2026-09-18 |
| splunk | Linux Kworker Process In Writable Process Path | production | 2026-05-13 |
| sigma | Scheduled Task Creation Masquerading as System Processes | experimental | 2025-02-05 |
| sigma | Operation Wocao Activity - Security | test | 2022-11-27 |
| sigma | Operation Wocao Activity | test | 2022-10-09 |