Lesson 1.14: Reading a process through /proc
ps shows what a process claims to be. /proc shows what it is: the real executable behind it (even after the file was deleted), the directory it works in, the environment it started with, its parent, its owner and its open files and connections. In the lab a monitoring alert says web03 is burning a CPU core in a process named like a kernel thread. You prove it isn't one, find where it came from and where it talks to, save the deleted program from memory as evidence, and only then stop it.
18 min
You will learn to
- Tell a real kernel thread from an impostor
- Read exe, cwd, status and environ under /proc/PID
- List a process's network connections with lsof
- Recover a deleted executable from /proc/PID/exe
- Collect evidence before ending a process
Key terms
- /proc
- A virtual file system the kernel fills with live information; /proc/PID describes one process.
- exe and cwd
- Links to the program the process runs and the directory it works in.
- environ
- The environment variables the process started with, separated by NUL bytes.
- Kernel thread
- Work done inside the kernel; shown in [brackets], owned by root, child of kthreadd (PID 2), no command line.
- Masquerading
- Naming a malicious process or file after something legitimate.
- Order of volatility
- Collect the evidence that disappears first (memory, processes, connections) before what lasts (disk).
← Unit files and drop-ins · All lessons · Login records and their gaps →