Skip to content
Threat Feed
Subscribe

Tag

Process-Masquerading

4 briefs RSS
medium advisory

Uncommon Svchost Parent Process Execution

This detection identifies instances where svchost.exe is spawned by an atypical parent process, potentially indicating process masquerading or injection techniques.

stealth process-masquerading windows endpoint-security
1r 1t
high advisory

Suspicious WSL Binary Masquerading

Adversaries are masquerading malicious payloads as wsl.exe to evade process-based detection and exploit security team trust in the legitimate Windows Subsystem for Linux binary.

stealth process-masquerading windows
1r 1t
high advisory

Suspicious Process Masquerading as SvcHost.exe

Adversaries are masquerading malicious processes as 'svchost.exe' by naming their binaries 'svchost.exe' and executing them from uncommon locations to evade detection.

Windows process-masquerading defense-evasion svchost
2r 1t
medium threat

Flax Typhoon Masquerading SoftEther VPN as Legitimate Windows Binaries

The Flax Typhoon group uses SoftEther VPN, masquerading the VPN client as legitimate Windows binaries like conhost.exe and dllhost.exe, to obfuscate their network activity within compromised Taiwanese organizations.

SoftEther VPN +3 Flax Typhoon +1 flax-typhoon defense-evasion lateral-movement vpn process-masquerading
2r 2t