Loading story…
A Linux process-hiding technique can make active malware disappear from common process-listing tools by bind-mounting a spoofed directory over /proc/[pid]. In a demonstration against a Sliver beacon, the implant continued running and communicating with its command-and-control server even after its /proc entry was obscured, causing utilities such as ps to lose visibility because they rely on files like /proc/[pid]/stat, /proc/[pid]/status, and /proc/[pid]/cmdline.
The method exploits Linux procfs behavior to interfere with userland inspection rather than stopping the process itself. Defenders can still hunt for artifacts including anomalous entries in /proc/mounts, empty or abnormal contents under /proc/[pid], and unusual writable permissions on a PID directory, while network evidence may remain visible through sources such as /proc/net/tcp, netstat, and nf_conntrack even when direct process attribution disappears.
![Bind-Mount Trick Hides Linux Processes by Spoofing `/proc/[pid]`](/_next/image?url=https%3A%2F%2Fmallory-core-public-images.s3.us-east-2.amazonaws.com%2Fbind-mount-trick-hides-linux-processes-by-spoofing-procpid.png&w=3840&q=75)
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
A DFIR blog post demonstrated a Linux process-hiding technique that bind-mounts a spoofed directory over a live /proc/[pid] entry, causing tools such as ps to stop showing the target process while it continues running. The post used a Sliver beacon as the example and documented forensic indicators including anomalous /proc/mounts entries, abnormal PID-directory permissions, and surviving network artifacts in netstat, /proc/net/tcp, and nf_conntrack.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **Syslogk**, a Linux loadable-kernel-module rootkit that alters kernel execution paths to conceal malware. It inline-hooks `proc_root_readdir` to hide processes associated with `was_sys_relay`, `tcp4_seq_show` to remove selected listening ports from TCP socket listings, and VFS `readdir` operations to conceal files and directories containing `was-patch`. Syslogk also unlinks itself from kernel-module and sysfs listings, frustrating checks using `lsmod` and `/sys/module`; kernel-level investigation and remediation are required to restore visibility. The activity reflects a broader Linux rootkit tradecraft pattern spanning user-space dynamic-linker hijacking through `LD_PRELOAD`, malicious kernel modules, ftrace and syscall hooks, and newer eBPF or `io_uring`-assisted techniques. Recent malware including PUMAKIT has combined memory-resident execution, an LKM rootkit, and an `LD_PRELOAD` shared object for persistence, stealth, privilege escalation, and command execution. Defenders should monitor sensitive linker and SSH configuration changes, suspicious shared objects and kernel modules, loaded eBPF programs, kernel-function and VFS-pointer integrity, tracing/probe activity, and anomalous web-server or system-account behavior.
Sep 9, 2026
Windows parent process ID spoofing allows attackers to create a new process that appears to have been launched by a trusted parent such as `explorer.exe`, undermining detections based on parent-child process relationships. MITRE ATT&CK tracks the method as **T1134.004**, noting it can be used for both defense evasion and, in some cases, privilege escalation by assigning a privileged parent so the child may inherit an elevated token. A published C++ proof of concept demonstrated the technique by using `CreateProcess` with extended startup attributes to set `PROC_THREAD_ATTRIBUTE_PARENT_PROCESS`, launching `mspaint.exe` in a suspended state, injecting a payload, queueing execution with APC, and then resuming the thread so the process appeared to be a child of `explorer.exe`. The walkthrough said the sample was detected by 20 of 70 VirusTotal engines and linked the tradecraft to real-world offensive tooling and malware, including **Cobalt Strike** and **KONNI RAT**, highlighting how adversaries can disguise execution chains that would otherwise look suspicious.
Aug 15, 2026
Bitdefender disclosed that attackers can abuse Windows **bind links** to create conflicting filesystem views that let malware appear benign to endpoint detection and response tools while executing attacker-controlled content. The researchers described three variants—**file-binding**, **process-binding**, and **silo-binding**—that redirect trusted paths to malicious files, potentially undermining path-based trust decisions, suppressing **AMSI** visibility, and concealing offensive tools such as `Mimikatz` from security products. Microsoft documentation on **Sysmon** remains relevant for defenders seeking deeper Windows telemetry, but Microsoft reportedly rated the bind-link issue as low severity because exploitation requires local administrator privileges. Bitdefender argued that this prerequisite does not meaningfully reduce risk in real intrusions, where attackers and ransomware operators frequently gain elevated access before moving to defense evasion and persistence.
Jul 20, 2026