Does anyone know where I can find, or at least to read about common general indicators of compromise for Linux process masquerading ? To clarify I'm not looking for instructions how to do masquerading, I'm interested in any methods to detect it's happening via osquery