Velvet Ant - Process Masquerading via ARGV Manipulation (T1036.004)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Detects Linux execution environments where processes manually manipulate their argv[0] to masquerade as kernel threads ([khubd]) or legitimate daemons (smbd -D). The rule specifically looks for process command lines matching 'khubd', 'smbd -D', or 'kauditd -sh' where the actual executable filename is not 'smbd', 'kauditd', or 'khubd'.