Overwrite Process Arguments
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The brief supplies exactly one logsource for AN0466, sigmaLogsource {category: process_creation, product: linux} — the Sysmon-for-Linux-shaped execve vocabulary (Image, CommandLine, ParentImage, ParentCommandLine) already used elsewhere in this corpus (e.g. T1027.015). The technique's observable, however, is a write to a process's own argv memory performed after it is already running, via prctl(PR_SET_MM_ARG_START/END) or ptrace(PTRACE_POKEDATA) against the live process's stack — no execve occurs, so no process_creation event is ever emitted for the overwrite itself. […]
What the technique is
Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the main() function as the argv array. The first element, argv[0], typically contains the process name or path - by default, the command used to actually start the process (e.g., cat /etc/passwd). By default, the Linux /proc filesystem uses this value to represent the process name. The /proc//cmdline file reflects the contents of this memory, and tools like ps use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by argv[0] to mimic a benign command, such as cat resolv.conf. The new command-line string is reflected in /proc//cmdline and displayed by tools like ps.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0466
Detects adversary behavior where the command-line arguments of a running process are overwritten in memory to spoof the process name, typically replacing it with a benign or misleading string. The detection correlates unexpected null byte sequences, discrepancies between /proc//cmdline and process ancestry, and suspicious memory writes shortly after process start.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.