Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019)

Adversaries may manipulate a process PEB to evade defenses. For example, [Process Hollowing](https://attack.mitre.org/techniques/T1055/012) can be abused to spawn a process in a suspended state with benign arguments. After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the [Native API](https://attack.mitre.org/techniques/T1106) <code>WriteProcessMemory()</code> function) then resume process execution with malicious arguments.(Citation: Cobalt Strike Arguments 2019)(Citation: Xpn Argue Like Cobalt 2019)(Citation: Nviso Spoof Command Line 2020)

Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis.(Citation: FireEye FiveHands April 2021)

This behavior may also be combined with other tricks (such as [Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004)) to manipulate or further evade process-based detections.
Process Argument Spoofing
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1564/010  external_id: T1564.010     source_name: Microsoft PEB 2021  description: Microsoft. (2021, October 6). PEB structure (winternl.h). Retrieved November 19, 2021.  url: https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb     source_name: Xpn Argue Like Cobalt 2019  description: Chester, A. (2019, January 28). How to Argue like Cobalt Strike. Retrieved November 19, 2021.  url: https://blog.xpnsec.com/how-to-argue-like-cobalt-strike/     source_name: Cobalt Strike Arguments 2019  description: Mudge, R. (2019, January 2). https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/. Retrieved November 19, 2021.  url: https://blog.cobaltstrike.com/2019/01/02/cobalt-strike-3-13-why-do-we-argue/     source_name: Nviso Spoof Command Line 2020  description: Daman, R. (2020, February 4). The return of the spoof part 2: Command line spoofing. Retrieved November 19, 2021.  url: https://blog.nviso.eu/2020/02/04/the-return-of-the-spoof-part-2-command-line-spoofing/     source_name: FireEye FiveHands April 2021  description: McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.  url: https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html     source_name: Mandiant Endpoint Evading 2019  description: Pena, E., Erikson, C. (2019, October 10). Staying Hidden on the Endpoint: Evading Detection with Shellcode. Retrieved November 29, 2021.  url: https://www.mandiant.com/resources/staying-hidden-on-the-endpoint-evading-detection-with-shellcode     