Here is the scenario: I do not have any prior services or programs, tripwire, etc., on my computer to tell me files or services that have changed. The integrity of a service, say ps, was changed so that it would actually execute the netcat command. I’ll explain it in another way. Say netcat was on my system but it was changed so that when you input ps, it would execute netcat. It completely removed the actual psservice and replaced it with netcat, but it is still called/executed with ps. Now the question is this: How would I find out that netcat is now called by ps?

  • Did you check if it is an alias case? Type alias on your terminal and check the output
    Dec 20, 2017 at 8:32
  • @BANJOSA well this is a scenario, this is more of a “if it happened” type of thing. And in it, they did not use an alias.
    – Hunter T.
    Dec 20, 2017 at 19:00
  • But are you having this issue or not?
    Dec 21, 2017 at 8:07
  • Not at the moment.
    – Hunter T.
    Dec 21, 2017 at 8:09
  • You know that the goal here is to help people with real problems that could be debugged. In your case you can't supply any debugging information since it's not a real problem. You are just wasting time of people that could be trying to help other with real problems.
    Dec 21, 2017 at 8:15

1 Answer 1


Try using the tool

command -v ps


type ps

they will tell you the absolute path and if it is a builtin shell function or alias.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .