# Linux Process Name Masquerading: Analyzing T1036 Obfuscation

> Explore the technical methods behind Linux process name masquerading (MITRE ATT&CK T1036) used by actors like Velvet Ant to evade detection.

- Published: 2026-06-24T09:23:19.000Z
- Severity: medium
- Category: Threat Intel
- Tags: T1036, Linux Security, Velvet Ant, Process Masquerading, Obfuscation
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/33102
- Canonical: https://runtimerebel.com/blog/linux-process-name-masquerading-analyzing-t1036-obfuscation

## Key points

- Threat actors use name masquerading to blend malicious Linux processes with legitimate system services, making them invisible to standard monitoring.
- Any Linux-based system is susceptible to process name spoofing via manipulation of the argv array or the prctl system call.
- Defenders should verify process integrity by comparing the process command line against its actual executable path and disk-based metadata.

## Overview of Linux Process Masquerading

Process name masquerading is a common [TTP](/glossary#ttp) where an adversary changes the name of a malicious process to match that of a legitimate system utility or service. This technique, classified as [MITRE ATT&CK](/glossary#mitre-att-ck) [T1036](https://attack.mitre.org/techniques/T1036/), aims to deceive [SOC](/glossary#soc) analysts and automated security tools that rely on process lists for threat detection. According to the [SANS Internet Storm Center](https://isc.sans.edu/diary/rss/33102), this method is particularly effective because standard administrative tools like `ps` or `top` may display the spoofed name rather than the actual malicious binary.

While more advanced threats like rootkits can hide processes entirely from the operating system's visibility, masquerading is a lighter, more frequent approach. It allows a threat actor to remain visible but unnoticed by blending into the background of a busy server environment. For instance, a malicious [C2](/glossary#c2) beacon might rename itself to `kworker` or `systemd`, which are ubiquitous in Linux process lists.

## Technical Execution: How to Detect Linux Process Masquerading

Understanding the underlying mechanics is essential for [EDR](/glossary#edr) configuration and manual forensic analysis. On Linux, there are two primary ways an attacker can perform **Linux prctl process name obfuscation** or argument manipulation.

### Overwriting the argv Array
When a process starts, the Linux kernel populates the `argv` (argument vector) array. The first element, `argv[0]`, typically contains the name of the executable. A malicious program can overwrite its own memory space where `argv` is stored. Tools like `ps` read from `/proc/[pid]/cmdline`, which reflects these modified arguments. If an attacker overwrites this memory with a string like `/usr/sbin/sshd`, a casual glance at the process list will show a legitimate-looking SSH daemon.

### The prctl System Call
Alternatively, an attacker can use the `prctl()` system call with the `PR_SET_NAME` option. This modifies the process name as tracked by the kernel for tasks like thread identification. While this primarily changes the name shown in `/proc/[pid]/comm` (the first 16 characters), it is often used in conjunction with `argv` manipulation to ensure consistency across different monitoring tools.

## Velvet Ant Chinese Group TTPs and Impact

A notable example of this technique in the wild involves the **Velvet Ant Chinese group TTPs**. This threat actor has been observed using sophisticated masquerading to maintain persistence within high-value targets. By mimicking legitimate system processes, they can bypass basic [SIEM](/glossary#siem) alerts that flag unknown process names. Their use of masquerading highlights that [APT](/glossary#apt) groups do not always require complex zero-days to succeed; simple obfuscation of existing system metadata is often sufficient to evade detection for extended periods.

## Strategies for Identification and Mitigation

Defenders cannot rely solely on process names for verification. To effectively counter these threats, security teams should implement the following technical checks:

*   **Verify Executable Links:** Always check the symbolic link at `/proc/[pid]/exe`. Even if the process name is spoofed to `apache2`, the `/proc/[pid]/exe` link will point to the actual binary on disk. If the binary is deleted or hidden, the link will often show `(deleted)`.
*   **Cross-Reference Parentage:** Legitimate system services have predictable parent-child relationships. For example, a `kworker` thread should have a Parent Process ID (PPID) of 2 (kthreadd). If a process named `kworker` has a PPID of a user shell or a web server, it is likely malicious.
*   **Behavioral Monitoring:** Implement [EDR](/glossary#edr) rules that alert when a process modifies its own command line memory or uses `prctl` to change its name shortly after execution.
*   **Disk-to-Memory Correlation:** Use tools that compare the hash of the file on disk with the code currently running in memory to detect hollowed processes or heavily modified executables.

By moving beyond name-based detection and focusing on the underlying process metadata, organizations can significantly increase the difficulty for attackers attempting to hide in plain sight.

**Related:** [Cookie-Controlled PHP Web Shells Evade Detection on Linux Servers](/blog/cookie-controlled-php-web-shells-evade-detection-on-linux-servers), [CVE-2026-31431: CISA Warns of Linux Local Privilege Escalation Exploit](/blog/cve-2026-31431-cisa-warns-of-linux-local-privilege-escalation-exploit)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/linux-process-name-masquerading-analyzing-t1036-obfuscation