HIDING LINUX PROCESSES WITH BIND MOUNTS

Summary from the TLDR InfoSec newsletter

This post refines a methodology for hiding Linux processes by using a bind mount to mount a different directory on top of /proc/PID for the malicious process. The author was looking to refine the original methodology by creating a more realistic directory to overlay but realized that they could instead overlay the proc directory of a spontaneous process which is usually ignored by sysadmins. They note that this method would still be easy to detect if you are aware of the technique and provide a command to do so.