process[.]pidDomain
Reported by 3 independent sources · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
13 reports, newest first · the exact sentence from each-
Compromised AsyncAPI npm packages: inside a CI supply-chain attack“const observerPath = '/tmp/observer-' + process[.]pid + '.js';”
-
Booking.com Phishing Campaign Targeting Hotels and Customers“| select timestamp, host.name, user.name, process[.]pid, process.executable, dll.path, dll.hash.sha256, action.properties.SignatureStatus, action.properties.Company, action.properties.Description”
-
ClickFix tactic: Revenge of detection – Detect Fake CAPTCHA“process[.]pid: '*'”
-
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild“and user.id != "0"] by process[.]pid, host.id, user.id with runs=10”
-
Linux & Cloud Detection Engineering - Getting Started with Defend for Containers (D4C)“Fields such as process[.]pid, process.start, process.end, and process.exit_code describe the process lifecycle and are useful for timing analysis and execution-flow reconstruction.”
-
Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID“| keep source.bytes, destination.address, process.name, process.entity_id, process[.]pid, @timestamp, host.name”
-
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four“/* number of screenshots i more than 5 by same process[.]pid and this behavior is limited to a unique host/process */”
-
Linux detection engineering with Auditd“sample by host.id, process[.]pid, process.parent.pid”
-
500ms to midnight: XZ A.K.A. liblzma backdoor“process.args == "-D" and process.args == "-R"] by process[.]pid, process.entity_id”
-
In-the-Wild Windows LPE 0-days: Insights & Detection Strategies“api where process[.]pid != 4 and process.Ext.api.name : "WriteProcessMemory"”
-
Detect Credential Access with Elastic Security“[file where event.action == "open" and process[.]pid == 4] by user.id”
-
Hunting for Lateral Movement using Event Query Language“…les copied via server message block (SMB) are represented by a file creation event by the virtual process System (always has a static process[.]pid value equal to 4 and represents the Windows kernel code and loaded kernel mode drivers):”
-
Detecting Exploitation of CVE-2021-44228 (Log4j2) with Elastic Security“destination.port in (1389, 389, 1099, 53, 5353)] by process[.]pid”
Indicators reported together
named in the same reports- process.parent[.]pidin 5 reports
- host.os[.]familyin 3 reports
- auditd[.]datain 2 reports
- exploit[.]inin 1 report
- rule[.]inin 1 report
- action.properties[.]companyin 1 report
- d4845669f7f56c6c4eb82147a1f82615in 1 report
- 9bab404584f6a0d9…132fd145dd32in 1 report
- 799e73863806df2964d80d12ce4e61eain 1 report
- headkickscountry[.]comin 1 report
- activatecapagm[.]comin 1 report
- homelycareinc[.]comin 1 report
- byliljedahl[.]comin 1 report
- jamerimprovementsllc[.]comin 1 report
- seedsuccesspath[.]comin 1 report
- zenavuurwerkofficial[.]comin 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2026-31431, CVE-2024-3094
Thanks — we review every report.