Process Masquerading

A defensive-evasion technique in which malware names its running process to imitate a legitimate system process, such as a kernel worker thread or a font or time-sync daemon, so it blends into normal process listings. The StyleSmuggler implant used kworker, fc-cache and chronyd disguises.