CmdID

CmdID / Commands

pgrep

Search for process(es). toybox

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from the toybox, 0BSD

Search for process(es). PATTERN is an extended regular expression checked against command names.

pgrep [-aclfnovx] [-d DELIM] [-L SIGNAL] [PATTERN] [-G GID,] [-g PGRP,] [-P PPID,] [-s SID,] [-t TERM,] [-U UID,] [-u EUID,]
Show 17 options
-aShow the full command line
-cShow only count of matches
-d DELIMUse DELIM instead of newline
-L SIGNALSend SIGNAL instead of printing name
-lShow command name
-fCheck full command line for PATTERN
-GMatch real Group ID(s)
-gMatch Process Group(s) (0 is current user)
-nNewest match only
-oOldest match only
-PMatch Parent Process ID(s)
-sMatch Session ID(s) (0 for current)
-tMatch Terminal(s)
-UMatch real User ID(s)
-uMatch effective User ID(s)
-vNegate the match
-xMatch whole command (not substring)

Several platforms

from tldr-pages, CC BY 4.0

Find processes by name.

Return PIDs of any running processes with a matching command string

pgrep process_nameIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Print the process name in addition to the PID (long output)

pgrep -l process_nameIdentify
-lShow command name toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Match processes against the full argument list instead of just the process name

pgrep -f "process_name parameter"Identify
-fCheck full command line for PATTERN toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Print the PID together with the full argument list for each match

pgrep -fl "process_name"Identify
-fCheck full command line for PATTERN toybox
-lShow command name toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Search for processes run by a specific user (effective UID)

pgrep -u username process_nameIdentify
-uMatch effective User ID(s) toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Select only the newest (most recently started) matching process

pgrep -n process_nameIdentify
-nNewest match only toybox

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Linux

from tldr-pages, CC BY 4.0

Find or signal processes by name.

Return PIDs of any running processes with a matching command string

pgrep process_nameIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Also display the full command

pgrep --list-full process_nameIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Search for processes including their command-line options

pgrep --full "process_name parameter"Identify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Search for processes run by a specific user

pgrep --euid username process_nameIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

What detects it

Sigma process creation rules that name pgrep
lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad

See also

pidof