Linux Process Name Masquerading, (Wed, Jun 24th)

This SANS Internet Storm Center diary details a technique used by attackers, specifically the Velvet Ant Chinese group, to mask process names in Linux systems. Attackers modify the ‘comm’ and ‘cmdline’ entries in the /proc/<pid> directory to hide the true name of a malicious process, making it less likely to be detecte…