Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process…
Sub-technique of Hide Artifacts (T1564).
T1564.010 Hide Artifacts: Process Argument Spoofing
title: "T1564.010 Hide Artifacts: Process Argument Spoofing"
id: e7dbbd6a-93d8-4f49-a0bf-a0c65439cce3
description: 'Detects ProcessAccess events where a parent process opens a memory-write-capable handle (VM_WRITE/VM_OPERATION, e.g. GrantedAccess 0x1A2A/0x1F0FFF/0x1FFFFF) to a child process it created, the closest Windows-observable proxy for overwriting the child''s Process Environment Block (PEB) to spoof its displayed command-line arguments. Sysmon does not expose the CREATE_SUSPENDED flag or the PEB-write itself, so this rule flags the enabling memory-access pattern rather than the spoofing operation directly. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: SuspendedProcessWindow, SensitiveProcesses, BehavioralCorrelationWindow.'
references:
- https://attack.mitre.org/techniques/T1564/010
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
- attack.stealth
- attack.t1564.010
logsource:
category: process_access
product: windows
service: sysmon
detection:
selection:
EventID: '10'
selection_write_access:
GrantedAccess:
- '0x1A2A'
- '0x1F0FFF'
- '0x1FFFFF'
filter_system_account:
SourceUser|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection and selection_write_access and not filter_system_account
falsepositives:
- Debuggers, installers, and process-launcher utilities that legitimately write into a freshly-spawned child's memory (e.g. injecting startup parameters); tune SensitiveProcesses/BehavioralCorrelationWindow to reduce noise, and corroborate with EDR-level CREATE_SUSPENDED telemetry where available.
level: high