Detached child process execution
Named by 2 kept items in this workspace.
Search every workspace for Detached child process execution. It matches the name as written, so it can find other things that share it.
The items that name it 2
Worker runs as a detached, unreferenced child process with ignored stdio, allowing the parent install/import process to finish while the worker continues running with little visible output.
Payload forks a detached child process with environment variable __ntw=1 to run collection/exfiltration outside the original module-load event, using stdio:'ignore' and unref().
All techniques in this workspace.