Malware evasion technique by manipulating process command-line arguments to hide the actual executed payload, commonly used to evade Windows monitoring tools. MITRE ATT&CK ID: T1036.005 (Masquerading: Match Legitimate Name or Location).
عن هذا المشروع
Procmon-Process-Argument-Spoofer Overview Welcome to the Procmon-Argument-Spoofer repository! This project focuses on manipulating process arguments to bypass monitoring tools like Process Monitor (Procmon). The goal is to demonstrate how argument spoofing can be used to obscure malicious activities or evade detection during system monitoring. This repository is for educational and research purposes only and aims to help security professionals understand and defend against such techniques. Table of Contents Overview Features Installation Usage Contributing Disclaimer License Features This repository includes the following techniques: Argument Spoofing: Modify process arguments at runtime to evade monitoring. Process Injection: Demonstrates methods to inject spoofed arguments into a target process. Anti-Detection Mechanisms: Techniques to reduce traceability during spoofing operations. Installation To set up and run this project: Clone the Repository: Open in Visual Studio: Load the solution file into Visual Studio. Build the Solution: Select the appropriate configuration (Debug/Release). Build the project. Run the Executable: Execute the compiled binary and observe the behavior.
من ملف README الخاص بالمشروع على
GitHub
- النجوم
- 14
- التفريعات
- 1
- الرخصة
- MIT
- آخر تحديث
- 22/12/2024
أضف هذه الشارة إلى ملف README
أظهر أن مشروعك مُدرج على «صُنع في الجزائر».
[](https://www.madeinalgeria.dev/projects/procmon-process-argument-spoofer)