Linux Internals — detection-relevant knowledge

This skill encodes how Linux works at the level needed to write detections for Linux endpoints, servers, and container workloads.

1. Process model

fork/exec

Parent process → fork() → child process (copy of parent)
  → execve() → new program loaded into child's address space
  → Program executes with inherited file descriptors, environment, UID/GID

Detection-relevant: Unlike Windows (single CreateProcess), Linux separates process creation (fork) from program loading (exec). A fork without exec creates a child running the same code as the parent — used in daemonisation and some evasion techniques.

/proc filesystem