process masquerading

Process masquerading aka process name stomping is an anti-analysis/deception technique used by malware in which a malicious process changes its name to something that appears benign.

For example, malware may change its name to something like “/usr/bin/httpd” to disguise itself as a web server or “[kauditd]” to disguise itself as a kernel thread instead of /dev/shm/totally_awesome_implant

https://sandflysecurity.com/blog/detecting-linux-kernel-process-masquerading-with-command-line-forensics/

https://haxrob.net/process-name-stomping/

---