T1036.011 — Overwrite Process Arguments

Tactic: Stealth · Platforms: Linux

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element,…

Sub-technique of Masquerading (T1036).

Sigma detection rules (1)

T1036.011 Masquerading: Overwrite Process Arguments

title: "T1036.011 Masquerading: Overwrite Process Arguments"
id: 6af4c337-7f60-4326-a5a3-67c5baf6b20e
description: 'Detection Strategy for Overwritten Process Arguments Masquerading. NOTE: the techniques actual behavior - overwriting argv strings in the processs own stack memory after launch - involves no syscall and leaves no distinguishing trace in a single EXECVE/SYSCALL audit record; true confirmation requires comparing the recorded exec-time argv against a later /proc/<pid>/cmdline snapshot, which this single-event rule cannot express. The prior filter (comm|fieldref:exe) compared the kernel-truncated 15-character comm value against the full exe path for exact equality, which is almost never true, so it flagged nearly every execve. Retargeted to the closest defensible single-event proxy used by real Linux self-hiding tooling (e.g. BPFDoor, XorDdos): execution from a binary thats been deleted from disk after being mapped (exe ending in "(deleted)") or from a world-writable staging directory, both common companions to argv-spoofing malware. Tune using: TimeWindow, AllowedArgvMismatchPatterns, ParentExecutableTrustList.'
references:
  - https://attack.mitre.org/techniques/T1036/011
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.stealth
  - attack.t1036.011

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: execve
  selection_deleted_binary:
    exe|endswith: '(deleted)'
  selection_staging_path:
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'

  condition: selection and (selection_deleted_binary or selection_staging_path)

falsepositives:
  - Package managers and some updaters legitimately leave a short-lived '(deleted)' exe reference while a running process's backing file is replaced; and admin/CI scripts legitimately execute binaries staged in /tmp during deployment. Requires ParentExecutableTrustList/AllowedArgvMismatchPatterns tuning, and definitive confirmation of argv overwriting still requires out-of-band /proc/<pid>/cmdline reconciliation.

level: medium

Related sub-techniques

Explore