Rule Info
Name
Process Masquerading as Kernel Worker Thread
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects attempts to launch processes with names mimicking a Linux kernel worker thread.
Malware or the attacker uses this to evade detection masquerading as legitimate kernel
worker threads, while hiding its true identity.
Date
2026-10-16 00:00:00
Modified
None
Id
b82e4f53-91c7-4d3a-b7e8-6a1d0e8c3f47
Tags
attack.stealth attack.t1036.005
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR