Rule Info
Name
Suspicious Process Name Spoofing as Linux Kernel Thread
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects a process impersonating a Linux kernel worker thread to evade
process-list inspection. Attackers rename malicious binaries or stage
legitimate LOLBins (e.g. curl, wget) under kernel thread names such as
[kworker/u8:2] to hide execution activity.
Date
2026-10-16 00:00:00
Modified
None
Id
9e1c5d72-f43b-4a87-b2e6-8d3f0a7c4b91
Tags
attack.stealth attack.t1036.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR