Kazuar Bridge Restarts a Failed Worker
Detects a 'bridge', 'kernel', 'service', or 'host' process repeatedly starting a 'worker', 'plugin', or 'module' process after short runtimes, indicating watchdog and resilience logic. This behavior is associated with the Kazuar malware.
Splunk (SPL)
