OfferLoader spawns eld0/eld1/eld2 with CID affiliate parameters
Detects instances where multiple executables named 'eld0.exe', 'eld1.exe', or 'eld2.exe' are executed on the same device within a short time window, all containing a 'CID=' argument in the command line. This behavior is often indicative of automated deployment, staging, or modular malware execution patterns.
Microsoft Sentinel (KQL)
