On Linux, tools like ps and top build their view of running processes from /proc. MITRE T1564.013, Bind Mounts, describes tampering with that view. It is a stealth technique that applies to Linux.
How attackers use it
A bind mount maps a directory or file from one place in the filesystem to another, a bit like a shortcut on Windows. It is common with containers and chroot environments, and it requires sudo access.
MITRE describes mapping an empty directory, or the /proc directory of a benign process, onto a malicious process's /proc directory. Using mount with -o bind or -B, the kernel then follows the bind mount, so utilities such as ps and top show information that appears to belong to the benign process. The real metadata and executable path of the malicious process are hidden from those tools.
How to detect it
MITRE's behavior chain has three parts: a mount run with the bind flags, /proc entries changed in a way that does not fit the expected process lineage, and later odd activity from a process whose metadata no longer matches how it was started.
A read-only check on Linux is to list mounts that sit on top of process directories:
grep ' /proc/[0-9]' /proc/self/mountinfo
On a healthy host this normally returns nothing. Also audit calls to the mount syscall with auditd and review them.
How to reduce the risk
MITRE lists no specific mitigation. The technique needs sudo, so tight control of who can escalate privileges limits who can do it. Auditing mount operations covers the rest.
Quick check
Why does a bind mount over /proc fool ps and top?
Those tools read process details from /proc, and the kernel follows the bind mount, so they show the contents of the benign directory.
