Malware evasion technique by manipulating process command-line arguments to hide the actual executed payload, commonly used to evade Windows monitoring tools. MITRE ATT&CK ID: T1036.005 (Masquerading: Match Legitimate Name or Location).
About this project
Procmon-Process-Argument-Spoofer Overview Welcome to the Procmon-Argument-Spoofer repository! This project focuses on manipulating process arguments to bypass monitoring tools like Process Monitor (Procmon). The goal is to demonstrate how argument spoofing can be used to obscure malicious activities or evade detection during system monitoring. This repository is for educational and research purposes only and aims to help security professionals understand and defend against such techniques. Table of Contents Overview Features Installation Usage Contributing Disclaimer License Features This repository includes the following techniques: Argument Spoofing: Modify process arguments at runtime to evade monitoring. Process Injection: Demonstrates methods to inject spoofed arguments into a target process. Anti-Detection Mechanisms: Techniques to reduce traceability during spoofing operations. Installation To set up and run this project: Clone the Repository: Open in Visual Studio: Load the solution file into Visual Studio. Build the Solution: Select the appropriate configuration (Debug/Release). Build the project. Run the Executable: Execute the compiled binary and observe the behavior.
From the project README on
GitHub
- Stars
- 14
- Forks
- 1
- License
- MIT
- Last push
- 22 Dec 2024
Add this badge to your README
Show that your project is listed on Made in Algeria.
[](https://www.madeinalgeria.dev/projects/procmon-process-argument-spoofer)