ClipXDaemon Process Masquerading as Kernel Worker
Detects processes masquerading as kernel worker threads (e.g., 'kworker/*') but running in a non-root user context. This technique is used by the ClipXDaemon malware to evade detection by blending in with legitimate system processes.
Sigma
