Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1564.010_process-argument-spoofing
Adversaries may attempt to hide process command-line arguments by overwriting process memory.
Passed 19 of 22 test cases with the skill, and 11 of 22 without it.
and 7 more in the full report
8 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the complete sub-technique ID and canonical name for process argument spoofing within the Hide Artifacts technique category?
| Checked | Without skill | With skill |
|---|---|---|
| Provides the sub-technique ID T1564.010. | Missed | Passed |
| Names the technique Process Argument Spoofing. | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1564
Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.
Adversaries may manipulate a process PEB to evade defenses. For example, Process Hollowing can be abused to spawn a process in a suspended state with benign arguments. After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the Native API WriteProcessMemory() function) then resume process execution with malicious arguments.
Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis.
This behavior may also be combined with other tricks (such as Parent PID Spoofing) to manipulate or further evade process-based detections.
Platforms: Windows
Identify Attack Surface: Determine if the target environment is susceptible to Process Argument Spoofing by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1564.010 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.