CmdID

CmdID / Commands

pstree

A convenient tool to show running processes as a tree. tldr-pages

On Linux 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

Display a tree of all processes (rooted at init)

pstreeIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display a tree of processes with PIDs

pstree --show-pidsIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display all process trees rooted at processes owned by specified user

pstree userIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display command line arguments

pstree --argumentsIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display children of a specified process

pstree process_idIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

Display parents of a specified process

pstree --show-parents process_idIdentify

Trips 1 Sigma rule: lowProcess Discovery by Ömer Günal, oscd.community, CheraaghiMilad

What detects it

Sigma process creation rules that name pstree
lowProcess DiscoveryÖmer Günal, oscd.community, CheraaghiMilad