title: Linux process comm renamed to bracketed kernel-thread mimicry
id: a7adc4e8-33dd-4dbe-92f4-c7b25bb55764
status: experimental
description: |
    Detects user-space processes whose comm field has been renamed via
    prctl(PR_SET_NAME) to a bracketed pseudo-random string (e.g. [syystytt],
    [soololss]), mimicking kernel threads, but whose parent PID is not
    kthreadd (PID 2). Mirai-derived sshscan kits use this pattern to confuse
    process listing during triage.

    Field names vary by Linux telemetry source. Map ProcessName to comm /
    proc.name / process.name depending on auditd, eBPF, osquery, Sysmon for
    Linux, or your EDR's schema before deployment.
references:
    - https://research.ohiiho.com/part-3-adjacent-campaigns-defender-playbook
author: OHIIHO Research
date: 2026-05-01
logsource:
    product: linux
    category: process_creation
detection:
    bracketed_process_name:
        ProcessName|re: '^\[[a-z]{6,12}\]$'
    not_kthreadd:
        ParentProcessId: 2
    condition: bracketed_process_name and not not_kthreadd
falsepositives:
    - True kernel threads with PPID 2; expected to be filtered by the
      not_kthreadd clause but verify in your environment.
    - Field-mapping mismatches will silently produce zero matches;
      verify the ProcessName field maps to comm in your telemetry pipeline.
level: medium
tags:
    - attack.defense_evasion
    - attack.t1036.005
