Full Report
Group-IB explores methods of process visibility evasion through /proc filesystem manipulation in Linux, along with effective defenses to counteract these tactics.
Analysis Summary
# Tool/Technique: /proc Mount Evasion (Process Hiding)
## Overview
This technique involves manipulating the Linux `/proc` filesystem—a pseudo-filesystem that provides an interface to kernel data structures—to hide malicious processes from system administrators and security tools. By using the `mount --bind` command, an attacker can overlay a specific process directory within `/proc/[PID]` with an empty directory, effectively making the process invisible to standard monitoring tools like `ps`, `top`, and `ss`.
## Technical Details
- **Type:** Technique (Evasion)
- **Platform:** Linux (Kernel 2.4.0 and later)
- **Capabilities:** Process concealment, defense evasion, anti-forensics.
- **First Seen:** Known to be employed by unclassified threat actor groups; historically leveraged by rootkits and manual attackers.
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1564 - Hide Artifacts]**
- **[T1564.001 - Hidden Files and Directories]**
- **[TA0007 - Discovery]**
- **[T1057 - Process Discovery]** (Used to evade this specific discovery tactic)
## Functionality
### Core Capabilities
- **Directory Overlaying:** Uses `mount --bind` to map an empty directory over a sensitive process-related directory (e.g., `/proc/1234`).
- **Administrative Evasion:** Bypasses standard administrative utilities (`ps`, `htop`, `ss`, `netstat`) that rely on reading `/proc` to display active system information.
- **Persistence via fstab:** Can be configured in `/etc/fstab` to ensure the process remains hidden even after system reboots.
### Advanced Features
- **File Remounting:** Capability to remount single files instead of entire directories to selectively hide specific process attributes (like command line arguments or environmental variables) while leaving the PID visible.
- **Submount Isolation:** The operation affects only the specific targeted part of the filesystem without triggering alerts associated with broad filesystem changes.
## Indicators of Compromise
- **File Names:** Check for unusual empty directories created in `/tmp` or hidden paths (e.g., `/tmp/.hidden_proc`) used as the source for bind mounts.
- **Behavioral Indicators:**
- Execution of the `mount --bind` command targeting the `/proc` filesystem.
- Discrepancies between the number of running tasks and the PIDs visible in `/proc`.
- Presence of unexpected mount entries in `/proc/mounts` or `/proc/self/mountinfo`.
## Associated Threat Actors
- Mentioned as being utilized by **unclassified threat actor groups** targeting Linux environments for long-term persistence and stealth.
## Detection Methods
- **Manual Table Inspection:** Inspecting the mount table specifically for `/proc` entries.
- Command: `cat /proc/mounts | grep /proc/`
- **Behavioral Detection:** Monitoring for `mount` system calls where the target path matches the regex `^/proc/\d+`.
- **Auditd:** Configure `auditd` rules to log any mount operations:
- `-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mount_activity`
- **Tooling Discrepancy:** Comparing the output of `/proc` with information gathered via `task_struct` in a kernel module or using specialized forensic tools that bypass the filesystem layer.
## Mitigation Strategies
- **Prevention:**
- Implement **SELinux** or **AppArmor** policies to restrict the `mount` capability to only authorized users or services.
- Use `nosuid` and `nodev` mount options where applicable.
- **Hardening:**
- Regularly audit `/etc/fstab` for unauthorized entries.
- Use immutable attributes (`chattr +i`) on critical system configuration files.
## Related Tools/Techniques
- **Libprocesshider:** A tool that uses `LD_PRELOAD` to hide processes by hooking `readdir` calls.
- **Rootkits (LKM):** Loadable Kernel Modules that modify the kernel's process list directly.
- **Process Masquerading:** Renaming processes to look like legitimate system threads (e.g., `kworker`).