Djinn Stealer Linux /proc Enumeration via SimpleHelp RMM Session

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of a 'linux-process-env.json' artifact by a Node.js process. This file is typically generated by the Djinn Stealer malware as part of its 'collectLinuxProcessEnv' function, which enumerates system process command lines and environment variables from the /proc directory after initial compromise.