Do not trust process command lines!

$ /tmp/rootkit --do=evil --foo bar & 
[1] 21528
$ ps -o pid,args --pid=21528
  PID COMMAND
21528 httpd -DSYSCONFIG
$ cat /proc/21528/cmdline
httpd -DSYSCONFIG

Always keep in mind that programs can modify their own command line to fool tools like ps and top. This is especially crucial when inspecting a potentially compromised system. These tools depend on /proc/PID/cmdline, but the proc file reads the command line directly from the process’s memory. The only reliable way to verify the command line is by recording it at process startup using observability tools like auditd. P.S.: /proc/PID/exe can also be manipulated, but that will be covered in another post!