RedTail rapid multi-tool SIGKILL of monitors by short-lived unsigned parent

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•2

Detects rapid, repeated execution of process control utilities (kill, strace, inotifywait, timeout) directed at monitored processes, often used by malware (such as 'redtail') to disable security monitoring, debugging, or auditing tools on Linux systems.