RedTail-style burst /proc & /sys profiling by short-lived process

Arnold Chan@slaz

•updated Sep 11, 2026•1•0•1

Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.