GoBruteforcer Process Name Masquerading

Tim Peck@timpeck

•updated Jan 7, 2026•5•3•97

Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.