Linux Hiding in plain sight (part 2) - Abusing the dynamic linker A stealthy process stomping method compatible with UNIX-like systems with anti-forensic enhancements for Linux.
Linux Hiding in plain sight: Modifying process names in UNIX-like systems (part 1) Exploring ways malware on Linux and other UNIX-like systems can disguise their process names.
