process.parent[.]pidDomain
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 1 month ago
What the reports say
7 reports, newest first · the exact sentence from each-
Linux Detection Engineering - Local Privilege Escalation“sequence by host.id, process.parent[.]pid with maxspan=30s”
-
Lazarus ClickFake Interview Campaign: ClickFix Malware“process.parent[.]pid: '*'”
-
ClickFix tactic: Revenge of detection – Detect Fake CAPTCHA“process.parent[.]pid: '*'”
-
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild“)] by process.parent[.]pid, host.id, user.id”
-
Linux detection engineering with Auditd“sample by host.id, process.pid, process.parent[.]pid”
-
500ms to midnight: XZ A.K.A. liblzma backdoor“process.executable != "/usr/sbin/sshd"] by process.parent[.]pid, process.parent.entity_id”
-
Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security“"wget")] by process.parent[.]pid”
Indicators reported together
named in the same reports- process[.]pidin 5 reports
- auditd[.]datain 3 reports
- hxxps://www.archblock[.]comin 1 report
- www.archblock[.]comin 1 report
- all[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.updatein 1 report
- api.smartdriverfix[.]cloudin 1 report
- scenarios[.]herein 1 report
- hxxps://api.smartdriverfix[.]cloud/coremedia-kp9s.shin 1 report
- hxxps://api.smartdriverfix[.]cloud/nvidiawins-updatein 1 report
- driverpackx[.]appin 1 report
- vid-crypto-assess[.]comin 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-31635, CVE-2026-46331, CVE-2026-64531, CVE-2024-3094
Thanks — we review every report.