When a process starts on Windows, security tools often read its command line to decide whether it looks safe. MITRE T1564.010, Process Argument Spoofing, is about making that read return something harmless. It sits under the stealth tactic and applies to Windows.
How attackers use it
Command-line arguments live in the process environment block, or PEB. Sensors that watch process creation can pull the arguments from there at launch.
MITRE describes two orders of operation. An adversary can start a process in a suspended state with benign arguments, wait for the PEB to be initialized and for sensors to log it, overwrite the arguments in memory, then resume the process with malicious ones. Or the adversary can run a process with malicious arguments and then patch the memory with benign ones, which can fool later memory analysis. MITRE notes this can be combined with other tricks such as Parent PID Spoofing.
How to detect it
The core signal is a mismatch between what was logged and what the process does. MITRE points to:
- Processes launched in a suspended state, followed by memory writes that target the PEB before execution resumes.
- Processes whose logged arguments do not line up with their behavior, such as network connections, file writes or registry changes that the logged command line would never cause.
In practice that means keeping process creation logs, for example Sysmon Event ID 1 or Windows Security Event ID 4688 with command-line auditing, and comparing them with what the same process does next.
How to reduce the risk
MITRE lists no specific mitigation for this technique, since it abuses normal process behavior. Defense rests on behavior-based detection: do not trust a single logged command line as proof of intent, and correlate it with later activity from the same process.
Quick check
Why is a logged command line not enough on its own?
Because the arguments can be overwritten in the PEB after they are logged, so the record may show benign arguments for a process that runs with malicious ones.
