BPFDoor Abnormal Process ID or Lock File Accessed — Detection Rule

detects BPFDoor .lock and .pid files access in temporary file storage facility

Read the full analysis on IntelFusions