Linux Process Name Masquerading: Analyzing T1036 Obfuscation

Overview of Linux Process Masquerading

Process name masquerading is a common TTP where an adversary changes the name of a malicious process to match that of a legitimate system utility or service. This technique, classified as MITRE ATT&CK T1036, aims to deceive SOC analysts and automated security tools that rely on process lists for threat detection. According to the SANS Internet Storm Center, this method is particularly effective because standard administrative tools like ps or top may display the spoofed name rather than the actual malicious binary.

While more advanced threats like rootkits can hide processes entirely from the operating system’s visibility, masquerading is a lighter, more frequent approach. It allows a threat actor to remain visible but unnoticed by blending into the background of a busy server environment. For instance, a malicious C2 beacon might rename itself to kworker or systemd, which are ubiquitous in Linux process lists.

Technical Execution: How to Detect Linux Process Masquerading

Understanding the underlying mechanics is essential for EDR configuration and manual forensic analysis. On Linux, there are two primary ways an attacker can perform Linux prctl process name obfuscation or argument manipulation.

Overwriting the argv Array

When a process starts, the Linux kernel populates the argv (argument vector) array. The first element, argv[0], typically contains the name of the executable. A malicious program can overwrite its own memory space where argv is stored. Tools like ps read from /proc/[pid]/cmdline, which reflects these modified arguments. If an attacker overwrites this memory with a string like /usr/sbin/sshd, a casual glance at the process list will show a legitimate-looking SSH daemon.

The prctl System Call

Alternatively, an attacker can use the prctl() system call with the PR_SET_NAME option. This modifies the process name as tracked by the kernel for tasks like thread identification. While this primarily changes the name shown in /proc/[pid]/comm (the first 16 characters), it is often used in conjunction with argv manipulation to ensure consistency across different monitoring tools.

Velvet Ant Chinese Group TTPs and Impact

A notable example of this technique in the wild involves the Velvet Ant Chinese group TTPs. This threat actor has been observed using sophisticated masquerading to maintain persistence within high-value targets. By mimicking legitimate system processes, they can bypass basic SIEM alerts that flag unknown process names. Their use of masquerading highlights that APT groups do not always require complex zero-days to succeed; simple obfuscation of existing system metadata is often sufficient to evade detection for extended periods.

Strategies for Identification and Mitigation

Defenders cannot rely solely on process names for verification. To effectively counter these threats, security teams should implement the following technical checks:

• Verify Executable Links: Always check the symbolic link at /proc/[pid]/exe. Even if the process name is spoofed to apache2, the /proc/[pid]/exe link will point to the actual binary on disk. If the binary is deleted or hidden, the link will often show (deleted).
• Cross-Reference Parentage: Legitimate system services have predictable parent-child relationships. For example, a kworker thread should have a Parent Process ID (PPID) of 2 (kthreadd). If a process named kworker has a PPID of a user shell or a web server, it is likely malicious.
• Behavioral Monitoring: Implement EDR rules that alert when a process modifies its own command line memory or uses prctl to change its name shortly after execution.
• Disk-to-Memory Correlation: Use tools that compare the hash of the file on disk with the code currently running in memory to detect hollowed processes or heavily modified executables.

By moving beyond name-based detection and focusing on the underlying process metadata, organizations can significantly increase the difficulty for attackers attempting to hide in plain sight.