Djinn Stealer /proc/[pid]/environ Enumeration for Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the creation of a specific file named 'linux-process-env.json' on Linux endpoints. The creation of environment-related configuration files in unexpected locations or by unauthorized processes may indicate reconnaissance, staging of malicious configuration, or post-exploitation activities by an adversary.