PolyFlame implant in vdaemon: shell spawned or injector/library load chain
Detects suspicious process activity associated with PolyFlame malware on Linux endpoints, specifically monitoring for vdaemon spawning shell or command interpreter processes, or vdaemon child processes following rsshd/conf_sshd/aaamgrd loader activity.
Microsoft Sentinel (KQL)
