These syscalls can be used by malware to either create new processes or search for existing ones (for example, to detect AV software/reverse engineering tools or find a process containing valuable data). Here are some common examples:
- fork/vfork: Create a child process, for example, a copy of itself
- execve/execveat: Execute a specified program, for example, another module
- prctl: Allows various operations on the process, for example, a name change
- kill: Send a signal to the program, for example, to force it to stop operating
