Detached or Backgrounded Process Spawn

How the attack works

An agent is asked to run a task, and instead of running it as a normal foreground command tied to the session, it uses a detaching mechanism such as nohup, disown, setsid, a detached tmux/screen session, or a trailing background operator (&) at the end of a shell command. The process then keeps running independently of the agent session. Because the session ends but the process does not, later actions taken by that process are no longer attributable to the request that spawned it. The rule also flags fork bombs, which rapidly multiply processes in the same detached manner.

Netzilo detection

Why it matters

An organization loses the ability to trace what a background process does back to the agent session or user request that started it, making it harder to attribute later actions, contain runaway processes, or investigate incidents.

What you can do

• →Review agent tool permissions to restrict which commands can use nohup, disown, setsid, or session multiplexers like tmux/screen.
• →Require that any legitimate background or long-running task be logged with the originating request ID at launch time.
• →Set resource limits (e.g., process count, CPU) on agent execution environments to contain fork bombs.
• →Treat alerts from CI pipelines or developer environments as likely false positives, but confirm the process owner and purpose before dismissing.

Known benign look-alikes

• Long-running builds and dev servers started in the background deliberately
• CI helpers using nohup to survive a shell teardown
• Developers using tmux/screen as their normal working environment
• Log tailing or file watching backgrounded during a debugging session

References

• https://attack.mitre.org/techniques/T1059/
• https://attack.mitre.org/techniques/T1543/

Related threats