# Leveraging Linux Internals to Supercharge Osquery Malware Detection

DevFeed: [Leveraging Linux Internals to Supercharge Osquery Malware Detection](<https://devfeed.tech/articles/leveraging-linux-internals-to-supercharge-osquery-malware-detection-15748.md>)

Original publisher: [Read original article](<https://developer.squareup.com/blog/leveraging-linux-internals-to-supercharge-osquery-malware-detection>)

Author: Frank Graziano

Published: 2024-03-27T16:00:00Z

Content type: tutorial

Language: en

Sources: [Square Corner Blog RSS Feed](<https://devfeed.tech/sources/square-corner-blog-rss-feed.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Security](<https://devfeed.tech/topics/security.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>), [Operating system](<https://devfeed.tech/topics/operating-system.md>), [Instrumentation](<https://devfeed.tech/topics/instrumentation.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [engineering](<https://devfeed.tech/tags/engineering.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [instrumentation](<https://devfeed.tech/tags/instrumentation.md>), [internals](<https://devfeed.tech/tags/internals.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [memory](<https://devfeed.tech/tags/memory.md>)

## AI overview

This article explains how to use Linux's virtual /proc filesystem with osquery's YARA scanning capability to detect fileless or in-memory malware. It describes the limitations of scanning only on-disk files and presents /proc as a way to satisfy the required file-path argument while scanning process-related data.

## Source excerpt

Using /proc to find fileless malware