Compliance Node Overview
MITRE ATT&CK T1036.011 (Overwrite Process Arguments) is an Enterprise Stealth technique. Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc//cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges. During runtime, adversari... Affected platforms: Linux. Sub-technique of ATT&CK T1036.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1036/011/
SHA-256 integrity: 4825e5efd8e5c9ca2653a09fb4e4ef0adb5b63598fd4aeecf5b2934d3f8a2b51
Primary Citations — 4 traced to source
- MITRE ATT&CK Technique T1036.011: Overwrite Process Arguments (https://attack.mitre.org/techniques/T1036/011/)
- MITRE ATT&CK Tactic TA0005: Stealth (https://attack.mitre.org/tactics/TA0005/)
+ 2 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.