Process-name spoofing is a disguise technique in which malware presents itself with a name that resembles a trusted system or application process. The goal is to make the malicious process look routine in task lists, process monitors, logs, and security dashboards. Attackers often choose names that are close to legitimate ones, differ by only a character or two, or copy names commonly seen on the target platform.
This matters because defenders often rely on process names for quick triage and hunting. A spoofed name can delay investigation, hide a backdoor among normal activity, or make an unfamiliar payload seem harmless. In real attacks, the tactic may appear alongside persistence, reverse shells, or command-and-control traffic to reduce suspicion. Defenders counter it by checking the executable path, digital signature, parent and child process relationships, command-line arguments, and unusual behavior such as network access or privilege changes. Name alone is never enough; context is what reveals the deception.