RedTail masquerading as php-fpm/postgres (process name/hash mismatch)

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•2

Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.