Linux Process Name Masquerading, (Wed, Jun 24th)

This technical note demonstrates how malicious processes can masquerade as benign ones by changing the process name on Linux (using prctl and by overwriting the contiguous argv/environ memory to alter /proc/<pid>/cmdline) with a full C proof-of-concept, discusses Windows limitations and PEB/EPROCESS behaviors, and outlines detection options (e.g., eBPF-based Kunai) and defensive considerations.