T1036.011sub-technique of T1036 Masquerading

Overwrite Process Arguments

Linuxnothing on this site yetT1036.011 on attack.mitre.org

Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`).
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Overwritten Process Arguments Masquerading

Detects adversary behavior where the command-line arguments of a running process are overwritten in memory to spoof the process name, typically replacing it with a benign or misleading string.

the rest of T1036

T1036.001 Invalid Code Signature · not covered yet
T1036.002 Right-to-Left Override · not covered yet
T1036.003 Rename Legitimate Utilities · not covered yet
T1036.004 Masquerade Task or Service · not covered yet
T1036.005 Match Legitimate Resource Name or Location · not covered yet
T1036.006 Space after Filename · not covered yet
T1036.007 Double File Extension · not covered yet
T1036.008 Masquerade File Type · not covered yet
T1036.009 Break Process Trees · not covered yet
T1036.010 Masquerade Account Name · not covered yet
T1036.012 Browser Fingerprint · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.