TRUST ME, I'M A LEGITIMATE PROCESS: VERISIMILITUDE AND THE ART OF HIDING

Summary from the TLDR InfoSec newsletter

Modern adversaries focus on appearing believable rather than staying hidden, using techniques like process impersonation, legitimate parent-child relationships, and contextually appropriate command-line arguments to blend into everyday operations. Deception can be categorized into visual (fooling human analysts), logical (passing reasoning checks), and behavioral (mimicking legitimate timing and patterns) verisimilitude layers. Detection strategies must shift from pure anomaly detection to plausibility-based approaches that question whether actions make contextual sense for specific users, systems, and operational environments.