atop

Linux system and process monitor. tldr-pages

On Linux 1 Sigma rule name it

Linux

Start

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start and display memory consumption for each process

atop -mIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start and display disk information

atop -dIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start and display background process information

atop -cIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start and display thread-specific resource utilization information

atop -yIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Start and display the number of processes for each user

atop -auIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display help about interactive commands

<?>

Sigma process creation rules that name atop

lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad