Overwrite Process Arguments is ATT&CK T1036.011, a Stealth technique for Linux. A running process changes its own in-memory arguments so it shows up under a benign-looking name.
How attackers use it
MITRE explains how Linux stores this information. Command-line arguments sit in the process stack and are passed to main as the argv array. The first element, argv[0], normally holds the name or path used to start the process. The /proc filesystem uses it as the process name, and tools such as ps read it to display process information. Because the arguments live in user-space memory, changing them does not need elevated privileges.
At runtime, an adversary can wipe the memory used by every argument by overwriting it with null bytes. That removes the evidence of how the process was started. They then write a spoofed string where argv[0] was, for instance something that looks like a harmless cat command. The new text is what ps and the cmdline file in /proc show.
The MITRE procedure example is BPFDoor, which overwrites argv[0] with one of ten hard-coded names that resemble Linux system daemons, such as udevd, dbus-daemon, avahi-daemon, auditd and systemd-journald.
How to detect it
The MITRE analytic correlates three things: unexpected null byte sequences, differences between the cmdline file in /proc and process ancestry, and suspicious memory writes shortly after the process started.
A simple manual comparison is to check whether the executable that a process is really running agrees with the name it displays. The exe link in /proc points at the real binary:
ps -eo pid,ppid,user,args | head -50
ls -l /proc/PID/exe
Replace PID with a process ID from the first command. A process that claims to be a system daemon but whose exe link points into /tmp, /dev/shm or a deleted file deserves attention. System daemons are also started by systemd or init, not by an arbitrary shell, so check parentage.
If you run auditd, record execve events with full arguments at the moment of start, since the original arguments are what the technique erases later.
How to reduce the risk
MITRE lists no dedicated mitigations for this sub-technique. The defensive value comes from recording process start data when it is accurate, comparing the displayed name with the real executable path, and watching the network behavior of processes that pose as system services.
