Showboat Malware Masquerading as kworker Kernel Thread on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

This rule detects processes on Linux systems that masquerade as kernel worker threads (kworker). Legitimate kworker processes are kernel threads initiated by the kernel with no on-disk file path (or a bracketed path). The rule flags processes that have an actual file system path associated with them and are not spawned by the kernel thread manager (kthreadd), indicating potential malicious masquerading.