{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/process-decoupling/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["low"],"_cs_tags":["linux","execution","defense-evasion","process-decoupling"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAttackers operating in Linux environments frequently utilize background execution utilities to facilitate persistence and defense evasion. By invoking binaries such as setsid, nohup, or disown, threat actors can spawn processes that exist independently of the original terminal session. This behavior, often associated with advanced espionage campaigns like GridTide, allows malicious payloads to continue execution even if the initial parent process is terminated or the user logs out. These tools effectively decouple the malicious process tree from the interactive session, masking the true origin of the execution and complicating incident response and forensic analysis. Defenders should monitor for the introduction of these utilities in process execution telemetry, particularly when observed in environments where they are not part of standard administrative workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the Linux host via a compromised service or shell access.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a malicious binary or script intended for long-term execution.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the use of standard terminal-based session management tools to persist the execution.\u003c/li\u003e\n\u003cli\u003eAttacker executes the payload using setsid or nohup to detach the process from the current terminal control.\u003c/li\u003e\n\u003cli\u003eThe target process begins execution in a new session, ignoring SIGHUP or other termination signals sent to the parent shell.\u003c/li\u003e\n\u003cli\u003eThe initial parent process is closed, leaving the malicious process running silently in the background.\u003c/li\u003e\n\u003cli\u003eAttacker maintains persistence as the background process continues to operate outside the standard process tree structure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of these utilities enables adversaries to maintain long-running backdoors, collectors, or other malicious tools without leaving clear artifacts in the active session logs. This technique increases the difficulty of identifying malicious actors during live incident response, as the orphaned processes may not appear as descendants of expected parent processes, potentially impacting the visibility of malicious activity across affected Linux infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the detection rule below to monitor for the first-time execution of process-decoupling utilities. Establish an allowlist for known administrative or operational scripts that legitimately utilize nohup or setsid to prevent alert fatigue. Ensure that endpoint telemetry (e.g., via Auditd or Elastic Defend) is configured to capture full command-line arguments to allow for the differentiation between standard administrative tasks and potential adversary activity.\u003c/p\u003e\n","date_modified":"2026-08-03T11:53:26Z","date_published":"2026-08-03T11:53:26Z","id":"https://feed.craftedsignal.io/briefs/2026-08-linux-background-execution/","summary":"Adversaries leverage Linux background utilities such as setsid, nohup, and disown to execute processes in new sessions, enabling them to ignore termination signals and decouple malicious tasks from parent process trees.","title":"Detection of Background Utility Usage for Process Execution on Linux","url":"https://feed.craftedsignal.io/briefs/2026-08-linux-background-execution/"}],"language":"en","title":"CraftedSignal Threat Feed - Process-Decoupling","version":"https://jsonfeed.org/version/1.1"}