🧰 ps

The items that name it 3

• tmate - Instant Terminal Sharing (or How To Backdoor a Linux Server)
  writeup2024-10-06

  Standard process listing tool used by incident responders to find running tmate processes (e.g. ps aux | grep tmate)

• The 'Invisibility Cloak' - Slash-Proc Magic
  writeup2024-05-16

  Standard Linux process listing tool, shown to be fooled by the bind-mount hiding technique because it relies on /proc

• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01

  Used to verify running process list and confirm BPFDoor's masquerading process name (dbus-daemon --system)