Hiding in plain sight: Techniques and defenses against `/proc` filesystem manipulation in Linux

This report explains how attackers can hide processes on Linux systems by bind-mounting an empty directory over /proc, demonstrates that direct removal of /proc entries is prevented but bind-mounting can mask processes from standard tools (ps, ss), and recommends mitigations including enabling SELinux/AppArmor and routinely checking the mount table to detect such evasions.