Process Signal Ignoring for Persistence on Linux

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.