Djinn Stealer Linux /proc environ enumeration writing linux-process-env.json

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects processes attempting to access sensitive Linux system files (/proc/[pid]/environ or /proc/[pid]/cmdline) or the specific file 'linux-process-env.json'. Such actions are indicative of an adversary attempting to perform system discovery, dump process environment variables for secrets, or collect process metadata.