Shady processes can fake their names, but faking their location is much harder.