0

On Windows, there is a program available for download which is part of what's called the sysinternals suite of tools. This program is called Process Explorer 64 aka ProcExp64. The program is useful for amongst many other things, identifying potential malware on a machine because one common behavior of malware is to launch and kill processes essentially faster than the typical program and/or the human eye could perceive/notice. This posed a challenge using the Windows Task Manager, because a malware may quickly launch, launch a child process, inject into another process and then kill the child all in under 1 second, for example (potentially even under 200ms). ProcExp64 has what's called Difference Highlight Duration which highlights a killed process to a specified color and keeps it in the process list for some duration, even after it's killed. In fact, the user can even specify to "scroll to new process", which I simply use sort by PID for on linux in htop. I do see an update time setting in htop but if I make that larger, it may miss the launch altogether.

On Linux, I've found a similar issue and I'm not sure how to solve it. In this case, I am not trying to observe malware, but I am trying to observe other, non-malicious processes that begin and exit quickly. An example is that I noticed that when I enter the command ps aux | grep ld-linux, I get an output, but then when I view htop, there is no such process still running because I believe the ld-linux executable exits and remains present only in shared object (.so) space rather than as a separate process (I could be wrong, but this is how I understand what's happening). One reason I suspect this is the case is that every time I run the aforementioned command, the PID is incremented further and further for ld-linux because I think that is the instance that was loaded in the actual loading process for ps itself (again, just speculation). Is there a way to observe this in action using htop or some other tool to put some kind of delay on the existence of the ld-linux loader process in the process table/list, and otherwise highlight it so that it stands out?

1
  • I guess it could be done using auditd. Commented Nov 23, 2022 at 7:07

1 Answer 1

0

You can use the kernel tracing tools found at github, or in a package called bcc-tools or similar, depending on your system. It contains, for example, execsnoop to trace exec() syscalls. It needs to be run as root, and your kernel needs to have been compiled with the appropriate flags, which is usually the case. See the tutorial.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .