Linux User-Space Kernel Worker Masquerading
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Sigma
