Linux process masquerading as kernel thread (bracketed name, Mirai)

Subhankar H@Andrewsec57

•updated 5 days ago•0•0•1

Detects a userland process whose image or command line is a bracketed kernel-thread name such as [kswapd0] or [kthreadd], which is a technique used by malware like Mirai to masquerade as legitimate kernel threads through prctl or argv manipulation.