Thread by @therealwlambert

🦖Day 38 of the @velocidex #velociraptor #ArtifactsOfAutumn series

Artifact: Linux[.]Sys[.]Pslist

Link: docs.velociraptor.app/artifact_refer…

This artifact enumerates the running processes on a Linux system. This can be useful to check for proper configuration or misalignment across a fleet of hosts, or for identifying suspicious processes generated by, or leveraged by malware.

Some of the Information provided by the artifact:

- Process ID
- Parent process ID
- Command line
- Executable
- Hash
- Username
- Created time
- RSS (how much memory allocated to the process)

Here, we see Teamviewer is running. Is this suspicious? It depends on an organization's policy and risk appetite, but it could be legitimate or not. It could also be leveraged by an adversary. With this artifact, we can baseline activity and identify process anomalies at scale.

That's it for now! Stay tuned to learn about more artifacts! 🦖