Process Argument Spoofing
Adversaries may attempt to hide process command-line arguments by overwriting the Process Environment Block (PEB) in memory. The PEB is a Windows data structure that stores process metadata, including command-line arguments referenced at execution time. When a process is created, defensive tools and EDR sensors typically capture command-line arguments from the PEB at process creation. Adversaries exploit this monitoring window by first spawning a target process in a suspended state with innocuous-looking arguments (e.g., 'svchost.exe -k netsvcs'), allowing the arguments to be logged by monitoring tools. While the process is suspended, the adversary uses the WriteProcessMemory() Windows API — accessed via NtWriteVirtualMemory — to overwrite the RTL_USER_PROCESS_PARAMETERS structure inside the PEB with malicious arguments. The process is then resumed, executing with the malicious payload while all telemetry shows only the spoofed benign arguments. Cobalt Strike implements this capability as the 'argue' feature, allowing operators to mask beacon-spawned process arguments. SombRAT uses the same mechanism to hide its own command-line parameters from post-execution memory analysis. This technique is commonly chained with Parent PID Spoofing (T1134.004) to further blend injected processes into the legitimate process tree.
// Detect Process Argument Spoofing (T1564.010)
// Primary signal: process injection-class API calls that enable PEB manipulation
// These APIs are required to write to a target process PEB after creation
//
// MDE captures WriteProcessMemory-pathway events via DeviceEvents ActionTypes
let KnownSecurityTools = dynamic([
"MsMpEng.exe", "MsSense.exe", "SenseNdr.exe", "CylanceSvc.exe",
"cb.exe", "cbdaemon.exe", "CSFalconService.exe", "SentinelAgent.exe",
"CSFalcon.exe", "elastic-endpoint.exe"
]);
let LolbinTargets = dynamic([
"svchost.exe", "rundll32.exe", "dllhost.exe", "regsvr32.exe",
"msiexec.exe", "conhost.exe", "notepad.exe", "cmd.exe",
"wscript.exe", "cscript.exe", "werfault.exe", "taskhost.exe",
"taskhostw.exe", "backgroundtaskhost.exe"
]);
// Stage 1: Capture process injection-class events (enable PEB write access)
let InjectionEvents = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in (
"ProcessInjection",
"CreateRemoteThreadApiCall",
"NtAllocateVirtualMemoryRemoteApiCall",
"SetThreadContextApiCall",
"NtMapViewOfSectionRemoteApiCall"
)
| where InitiatingProcessFileName !in~ (KnownSecurityTools)
| extend Fields = parse_json(AdditionalFields)
| extend TargetProcessId = tolong(Fields.TargetProcessId)
| extend TargetProcessName = tostring(Fields.TargetProcessName)
| extend IsLolbinTarget = TargetProcessName has_any (LolbinTargets)
// Exclude injections from known-good system parents into their own children
| where not (
InitiatingProcessFileName =~ "services.exe" and TargetProcessName =~ "svchost.exe"
)
| project Timestamp, DeviceName, AccountName,
ActionType,
InjectorProcess = InitiatingProcessFileName,
InjectorCommandLine = InitiatingProcessCommandLine,
InjectorPID = InitiatingProcessId,
TargetProcess = TargetProcessName,
TargetPID = TargetProcessId,
IsLolbinTarget;
// Stage 2: Join to target process creation to expose the (potentially spoofed) command line
let RecentProcesses = DeviceProcessEvents
| where Timestamp > ago(24h)
| project DeviceName, ProcessId, SuspectedCommandLine = ProcessCommandLine,
ProcessFileName = FileName, ProcessCreationTime = Timestamp;
InjectionEvents
| join kind=leftouter (
RecentProcesses
) on DeviceName, $left.TargetPID == $right.ProcessId
| extend TimeDeltaSecs = datetime_diff("second", Timestamp, ProcessCreationTime)
// PEB spoofing occurs immediately after process creation (within seconds)
| extend IsEarlyInjection = (TimeDeltaSecs >= -2 and TimeDeltaSecs <= 30)
| extend SuspicionScore = toint(IsLolbinTarget) + toint(IsEarlyInjection)
+ iif(ActionType in ("SetThreadContextApiCall", "CreateRemoteThreadApiCall"), 1, 0)
| where SuspicionScore >= 1 or isempty(TimeDeltaSecs)
| project Timestamp, DeviceName, AccountName,
ActionType,
InjectorProcess, InjectorCommandLine, InjectorPID,
TargetProcess, TargetPID,
SuspectedSpoofedCommandLine = SuspectedCommandLine,
TimeDeltaSecs, IsEarlyInjection, IsLolbinTarget, SuspicionScore
| sort by SuspicionScore desc, Timestamp descData Sources
Required Tables
False Positives
- Legitimate security and monitoring tools (AV, EDR agents) that use process injection or memory scanning to inspect process memory
- Game anti-cheat software that injects into game processes using similar API patterns
- Windows system processes: services.exe spawning svchost.exe children, csrss.exe internal operations, wininit.exe managing subsystem initialization
- Debuggers and development tools (Visual Studio, WinDbg, x64dbg) that attach to processes and write memory during debugging sessions
- IT management and RPA tools (UiPath, Automation Anywhere, some SCCM operations) that inject into processes for automation
References (10)
- https://attack.mitre.org/techniques/T1564/010/
- https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb
- https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/
- https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/
- https://blog.nviso.eu/2020/02/04/the-return-of-the-spoof-part-2-command-line-spoofing/
- https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html
- https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.010/T1564.010.md
- https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory
- https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-rtl_user_process_parameters
Unlock Pro Content
Get the full detection package for T1564.010 including response playbook, investigation guide, and atomic red team tests.