Process concealment is a stealth technique used to hide a malicious program from basic process listings, task managers, and lightweight inspection tools. Attackers may rename processes, run code under trusted-looking names, unlink or mask process artifacts, or inject into legitimate services so the harmful activity is harder to spot.
It matters because many defenders begin with simple checks such as ps, top, or endpoint dashboards. If a backdoor can avoid obvious visibility, it can keep running for longer and support persistence, remote control, or proxy abuse without drawing attention. In real intrusions, process concealment is often paired with hidden files, startup persistence, and suspicious outbound connections. Defenders look for mismatches between a process name, its parent process, command line, loaded modules, and on-disk files, because those inconsistencies often reveal concealed malware.