Runner.Worker PID Discovery via pgrep

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.