Red Lamassu Showboat: kworker Kernel Thread Impersonation (T1569.002)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects user-space processes masquerading as critical Linux kernel threads (kworker, kthreadd, ksoftirqd). The rule identifies potential impersonation by monitoring for suspicious parent processes (e.g., shells, interpreters), anomalous parent PIDs (not 1 or 2), or unexpected network socket activity generated by these kernel-named processes.