Linux Process Enumeration

Quick notes on enumerating Linux processes and identifying unusual or privileged execution.

2026-09-12

1 min read

linuxprocessesenumerationprivilage-escalationred-team

Basic Enumeration#

process enumeration

TTY1ZSH 5.9

r41n@0xraiven:~$>ps aux

r41n@0xraiven:~$>ps -ef

r41n@0xraiven:~$>top

r41n@0xraiven:~$>pgrep -a -u root

r41n@0xraiven:~$>

Findings

INFO

Look for: • Unknown processes • Processes running as root unexpectedly • Executables from unusual directories • Scripts running in the background • Suspicious command-line arguments • Processes associated with unknown services

inspect a process

TTY1ZSH 5.9

r41n@0xraiven:~$>ps -fp <PID>

r41n@0xraiven:~$>readlink -f /proc/<PID>/exe

r41n@0xraiven:~$>tr '\0' ' ' < /proc/<PID>/cmdline

r41n@0xraiven:~$>

Takeaway#

Process enumeration gives you a snapshot of active execution. Focus on unusual processes and follow them back to the files, services, or users responsible for starting them.

Back to Notesnote: linux-process-enumeration