Full Report
Discover how attackers could manipulate the Linux /proc filesystem to hide malicious processes and distort forensic timelines. This technical deep dive highlights examples of command-line substitution and start time corruption, and offers detection and defense strategies for incident responders and security analysts.
Analysis Summary
# Tool/Technique: /proc Filesystem Manipulation (Linux)
## Overview
This technique involves the manipulation of the Linux `/proc` filesystem (a pseudo-filesystem providing a kernel interface to process data) to hide malicious activity, disguise process identities, and distort forensic timelines. By tampering with kernel-exported data, attackers can deceive system administrators and automated security tools that rely on standard utilities like `ps`, `top`, or `htop`.
## Technical Details
- **Type:** Technique (Anti-forensics / Evasion)
- **Platform:** Linux
- **Capabilities:** Process masquerading, timeline distortion, and concealment of malicious execution.
- **First Seen:** Historically leveraged by advanced rootkits; documented as a specific bind-mount technique for timeline distortion in recent forensic research.
## MITRE ATT&CK Mapping
- **TA0005 - Evasion**
- **T1564 - Hide Artifacts**
- **T1036 - Masquerading**
- **TA0007 - Discovery**
- **T1057 - Process Discovery** (Manipulation of)
- **TA0009 - Collection**
- **T1070 - Indicator Removal** (Timestomping/Timeline distortion)
## Functionality
### Core Capabilities
- **Command-line Substitution:** Attackers can replace the contents of `/proc/[pid]/cmdline`. When a forensic tool reads this file, it displays an arbitrary, benign string (e.g., `/usr/sbin/apache2`) instead of the actual malicious command used to launch the process.
- **Start Time Corruption:** By editing the `/proc/[pid]/stat` file, attackers can modify the process start time. This allows them to "backdate" a process to appear as if it started during a system boot or "future-date" it to appear outside the scope of a forensic window.
### Advanced Features
- **Bind-Mount Redirection:** Instead of directly editing kernel memory, attackers with root privileges use `mount --bind`. They create a directory containing fake `cmdline` or `stat` files and mount that directory over the legitimate `/proc/[pid]/` entry. Userland tools are redirected to the fake files without realizing the underlying filesystem has been shadowed.
## Indicators of Compromise
- **File Hashes:** N/A (Technique utilizes native system commands like `mount`).
- **File Names:** Look for suspicious files in `/tmp` or `/dev/shm` that mimic the structure of `/proc` files (e.g., `/tmp/.hidden/cmdline`).
- **Registry Keys:** N/A (Linux-based).
- **Network Indicators:** N/A.
- **Behavioral Indicators:**
- Unexpected mount points involving `/proc/[pid]`.
- Discrepancies between process start times in `/proc` vs. Auditd/Syslog logs.
- Presence of `tmpfs` or `ext4` filesystems mounted over `procfs` paths.
## Associated Threat Actors
- Generally associated with actors possessing **Root/Kernel-level access**.
- Advanced Persistent Threats (APTs) and rootkit developers utilizing anti-forensics to maintain long-term persistence.
## Detection Methods
- **Behavioral Detection:**
- Monitor for `mount` and `unmount` system calls targeting the `/proc` directory using `auditd` or `eBPF`.
- Generate alerts when `/proc/[pid]` is associated with non-standard filesystems (e.g., `tmpfs`).
- **Cross-Validation:**
- Compare process metadata from `/proc` against independent telemetry sources like `Auditd` records, EDR process-start events, and `systemd` journal timestamps.
- Inconsistencies between these sources are a high-confidence indicator of tampering.
## Mitigation Strategies
- **Prevention Measures:**
- Enforce the Principle of Least Privilege to prevent unauthorized users from gaining the `CAP_SYS_ADMIN` capability required for mounting.
- **Hardening Recommendations:**
- Use kernel hardening features (e.g., SELinux or AppArmor) to restrict the `mount` syscall for specific processes.
- Implement immutable logging to a remote syslog server, ensuring that even if `/proc` is manipulated, the original execution logs remain intact.
## Related Tools/Techniques
- **Rootkits (LKM):** Loadable Kernel Modules that hook syscalls to hide processes.
- **Process Ghosting/Hollowing:** Techniques to hide execution, though typically more common in Windows environments.
- **Mount Namespace Unsharing:** Used to create a private view of the filesystem to hide mounts from the main system view.