Defender field guide · Linux

Malware leaves footprints at the syscall boundary.

Linux malware ultimately asks the kernel to execute processes, map memory, touch files, communicate, and change privileges. This guide organizes those system calls into behaviors defenders can investigate.

architecture-awarebehavior-firsteBPF / auditd readydefensive reference

A syscall is not a verdict. Browsers, databases, backup agents, and malware often invoke the same calls. Detection comes from sequence, arguments, ancestry, identity, destination, and timing—not a syscall name in isolation.

Behavior atlas

Search by syscall, behavior, or telemetry idea. Names vary by architecture and kernel version; modern applications commonly use the *at variants.

Execution01

Process creation and launch

Starts payloads, replaces a process image, creates workers, or detaches from a parent session.

execveexecveatcloneclone3forksetsid

Watch: unexpected ancestry, execution from writable paths, deleted binaries, or unusual argument and environment combinations.

Memory02

Memory mapping and code loading

Maps executable regions, changes page permissions, creates anonymous file-backed payloads, or manipulates another process.

mmapmprotectmemfd_createptraceprocess_vm_writev

Watch: writable-to-executable transitions, executable memfd regions, cross-process writes, and ptrace outside expected debugging relationships.

Filesystem03

Dropping, modifying, and hiding files

Writes components, changes permissions, replaces configuration, removes evidence, or enumerates directories.

openatwriterenameat2fchmodatunlinkatgetdents64

Watch: writes to startup locations, executable permission changes, atomic replacement of trusted files, and rapid create-execute-delete sequences.

Network04

Command, control, and lateral traffic

Creates outbound sessions, listeners, DNS or UDP exchanges, and long-lived channels.

socketconnectbindlistenaccept4sendtorecvfrom

Watch: new process-to-destination pairs, rare ports, unexpected listeners, beacon-like timing, and network activity from tools that normally stay offline.

Privilege05

Identity, capabilities, and namespaces

Changes credentials, manipulates Linux capabilities, enters namespaces, or alters mount context.

setresuidsetresgidcapsetunsharesetnsmount

Watch: privilege transitions without an approved broker, new user or mount namespaces, capability changes, and namespace entry across unrelated workloads.

Discovery06

Host and environment discovery

Profiles kernel, CPU, filesystems, processes, interfaces, and execution context before choosing behavior.

unamesysinforeadlinkatgetdents64sched_getaffinitystatx

Watch: dense discovery bursts immediately after execution, especially from an unknown binary or a process with no operational reason to inventory the host.

IPC07

Inter-process control and signals

Moves data between processes, redirects descriptors, coordinates workers, or terminates competing services.

pipe2dup2killtgkillshmgetfutex

Watch: unusual signal targets, descriptor redirection around shell execution, or shared-memory activity between unrelated processes.

Evasion08

Timing and analysis awareness

Inspects execution conditions, changes process metadata, delays activity, or restricts observable behavior.

prctlptraceclock_gettimenanosleepseccompgetrandom

Watch: process-name changes, debugger checks, suspicious delay patterns, or security controls applied by software with no normal sandboxing role.

Detection method

Turn raw kernel events into a defensible finding by adding context at every stage.

01 / COLLECT

Capture

Use auditd, eBPF sensors, EDR, or workload telemetry at an intentional scope.

02 / ENRICH

Contextualize

Add process tree, container, user, hashes, path, arguments, and network identity.

03 / CORRELATE

Sequence

Join events into behaviors such as drop → chmod → execute → connect.

04 / VERIFY

Investigate

Compare with baseline, preserve evidence, and validate intent before response.

High-value correlations

Sequences generally provide stronger signal than isolated calls.

Observed sequence	Possible behavior	Useful context
`openat → write → fchmodat → execve`	Dropped executable launched from disk	Path ownership, mount options, signer/package provenance, parent process
`memfd_create → write → execveat`	Anonymous in-memory execution	Creator identity, executable seals, command line, subsequent network events
`socket → connect → dup2 → execve`	Network-connected command interpreter	Destination reputation, descriptor mapping, executed image, process ancestry
`unshare → mount → execve`	Namespace-isolated execution	Container runtime relationship, capabilities, mount target, user namespace mapping
`ptrace/process_vm_writev → mprotect`	Cross-process manipulation	Target relationship, debugger policy, memory permissions, loaded modules