Every running program on Linux is a process. Understanding how to view, manage, and monitor processes is critical for security professionals. During incident response, the first question is often 'what is running on this system?' Malware, backdoors, cryptominers, and unauthorized services all appear as processes. This lesson teaches you how to find them.
Linux provides several tools to inspect running processes. Each offers different levels of detail and is useful in different scenarios.
Understanding parent-child process relationships is crucial for identifying malicious activity. Legitimate processes have expected parents. A web server spawning a shell is suspicious. An unknown process with no parent (orphaned) is very suspicious.
⚠️ The python3 process above (PID 2891) is a red flag. It was spawned by sshd (PID 412), meaning someone connected via SSH and ran a Python one-liner. The command uses 'import socket,subprocess,os' — a classic reverse shell pattern. This is exactly the kind of anomaly you must catch during monitoring.
One of the most important security checks is identifying which processes have active network connections. This reveals listening services, outbound connections, and potential command-and-control channels.
💡 The combination of ss -tulnp and lsof -i is your go-to for identifying suspicious network activity. Look for: unexpected listening ports, processes connecting to unknown external IPs, and processes that should not have network access (like text editors or compilers).
Resource abuse is a common indicator of compromise. Cryptominers consume CPU. Memory-resident malware consumes RAM. Monitoring resource usage helps detect these threats.
When you identify a malicious process, you need to terminate it — but carefully. Simply killing a process may trigger persistence mechanisms. Always investigate before killing.
# Process termination escalation:
kill 2891 # Graceful termination (SIGTERM)
kill -15 2891 # Same as above, explicit
kill -9 2891 # Force kill (SIGKILL) — use if SIGTERM fails
kill -9 -1 # ⚠️ KILL ALL PROCESSES (including yourself!)
# Kill by name
killall python3 # Kill all python3 processes
pkill -f "reverse" # Kill processes matching a pattern
# Before killing, capture forensic evidence:
cat /proc/2891/cmdline | tr '\0' ' ' > /tmp/evidence_2891.txt
ls -la /proc/2891/exe > /tmp/exe_2891.txt
cp /proc/2891/exe /tmp/malware_sample_2891 2>/dev/null
ss -tnp | grep 2891 > /tmp/connections_2891.txt
# Then kill
kill -9 2891In a real incident response scenario, do NOT immediately kill the malicious process. Instead, isolate the system from the network (pull the cable or disable the interface), then capture memory, disk images, and process details before terminating anything. Killing the process destroys volatile evidence.
Verify exercises to earn ★ 140 XP and unlock next lab level.