Suspicious Procfs Comm Overwrite Attempt with Kernel Thread Name

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to overwrite a process's displayed name in /proc/[pid]/comm with a kernel worker thread name. Attackers use this technique after launching a renamed binary or LOLBin (e.g. curl, wget) to retroactively change how the process appears in monitoring tools, providing a second layer of camouflage beyond argv[0] spoofing.

2026-10-16 00:00:00

None

4c9f3b71-e82a-4d56-b1f3-7a2e0c5d9f13

attack.stealth attack.t1036.005

Nextron Sigma feed only (private)