Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1036.011_overwrite-process-arguments
Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process.
Passed 14 of 22 test cases with the skill, and 8 of 22 without it.
and 6 more in the full report
6 fixed8 passed either way8 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When assessing Linux detection coverage for sub-technique T1036.011, how many distinct detection strategies are documented in the detection evaluation checklist?
| Checked | Without skill | With skill |
|---|---|---|
| The detection assessment specifies 1 detection strategy. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1036
Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the main() function as the argv array. The first element, argv[0], typically contains the process name or path - by default, the command used to actually start the process (e.g., cat /etc/passwd). By default, the Linux /proc filesystem uses this value to represent the process name. The /proc/<PID>/cmdline file reflects the contents of this memory, and tools like ps use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges.
During runtime, adversaries can erase the memory used by all command-line arguments for a process, overwriting each argument string with null bytes. This removes evidence of how the process was originally launched. They can then write a spoofed string into the memory region previously occupied by argv[0] to mimic a benign command, such as cat resolv.conf. The new command-line string is reflected in /proc/<PID>/cmdline and displayed by tools like ps.
Platforms: Linux
Identify Attack Surface: Determine if the target environment is susceptible to Overwrite Process Arguments by examining the target platforms (Linux).
Assess Existing Defenses: Review whether mitigations for T1036.011 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
test cases passed, vs 8 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.