Skip to content

Back to the catalog

dfir.chwriteup

The 'Invisibility Cloak' - Slash-Proc Magic

A DFIR researcher tests and explains a Linux anti-forensics technique — bind-mounting an empty directory over /proc/[pid] (and its fd subfolder) to hide a running process from ps — using a Sliver beacon as the test payload. The post traces via strace how ps reads /proc/[pid]/stat, status, and cmdline to build its output, then documents forensic tells that survive the hiding trick: writable/non-standard permissions on the process's /proc entry, a suspicious mount entry in /proc/mounts, an empty fd directory, and the still-visible C2 connection in netstat, nf_conntrack, and /proc/net/tcp.

TL;DR Hiding a Sliver beacon's process from `ps` via a /proc/[pid] bind mount — and the /proc/mounts, netstat, and nf_conntrack artifacts that still expose it.
Open original ↗
Document

What it is

A walkthrough of a Linux process-hiding technique: bind-mounting an empty directory over /proc/[pid] so /proc-dependent tools (ps, and inspection of /proc/[pid]/fd) can no longer see the process. The author encountered it in Defensive Security's "Linux Attack, Detection and Live Forensics" course and traced the commands to a public gist by Timb-machine. It is demonstrated against a Sliver beacon named DISTANT_VISUAL.

How it works

The spoof directory (containing an empty fd subdirectory) is bind-mounted onto the target's /proc/[pid]. Anything reading /proc/[pid] then sees the empty spoof contents instead of the real process entries. Because ps builds its listing by walking /proc, the process vanishes from ps aux and /proc/[pid]/fd shows nothing.

Preconditions / Affected

Root (the mount operation requires it). The technique hides the process only from tools that trust /proc; the process itself keeps running (the Sliver beacon continues checking in). Notably, the author found the gist's extra socket-symlink step not necessary to achieve hiding — only the bind mount was needed.

What to do

The hide, reproduced from the post:

mkdir -p spoof/fd
mount -o bind spoof /proc/22665

Verify a process's /proc entry is intact before/without the trick (a populated directory means no bind mount is masking it):

ls -l /proc/22665/

An empty /proc/[pid]/fd for a PID that should have open descriptors is the tell:

ls -la /proc/22665/fd

The gist's optional (unneeded) step, documented for completeness:

ln -s socket:[283] /proc/[pid]/fd/99

Caveats

  • The fetched text stops before the promised "strace (ps deep-dive)" detection section, so the specific forensic artifacts the author uses to reveal the hidden process are not captured here — read the original for those.
  • The author could not identify who originally developed the technique and invites corrections.
  • Hiding is superficial: the mount itself is an artifact. A bind mount over a /proc/[pid] path is anomalous and visible to anything enumerating mounts rather than reading /proc.

Organisations named here

  • Timb-machine

Technologies named here

  • Sliver
  • Linux
  • CentOS
  • ps
  • netstat
  • strace
  • Sandfly
  • Linux kernel

Techniques named here

  • Bind mount over /proc/[pid]
  • Symlinking fake socket fd
  • Process hiding detection via /proc/mounts analysis
  • Process hiding detection via permission anomaly

Related in Blue Team & Detection