So, the PATH environment variable could be modified by an attacker to omit certain directories from a search using the which command. īe aware that the which command only searches in locations in the PATH environment variable.Process Name and PIDĪs the whereis and which commands are not contingent upon an actively executed program, they are also useful for locating the system path of a suspect executable even after a target process ceases running, or has been killed inadvertently-or even intentionally by an attacker in an effort to thwart detection and investigation. Relational context to system state and artifacts.

Start by collecting basic process information, such as the process name and PID, with subsequent queries to obtain the following details: □Ĭommand-line arguments used to invoke the process □ More subtle clues that a process is malicious include files that it has open, a process running as root that was launched from a user account that is not authorized to have root access, and the amount of system resources it is consuming. In some cases, malicious processes will exhibit characteristics that immediately raise a red flag, such as established network connections with an Internet Relay Chat (IRC) server, or the executable stored in a hidden directory. ▶ Distinguishing between malware and legitimate processes on a Linux system involves a methodical review of running processes.

Weird ips in tcpview system process