FLATROOF/ROOFDECK Checking for Cursor IDE Process Before Beaconing

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•4

Detects potential anti-analysis or sandbox evasion behavior where a process checks for the existence of the Cursor IDE application using native system utilities like ps, pgrep, or lsof. This check is often used by malware (such as the FLATROOF/ROOFDECK backdoors) to gate beaconing activity by ensuring the execution environment is not an analysis sandbox.