← ReflexSec
Process Execution
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
ps auxIntermediate - Dangerous
curl -fsSL https://example.com/install.sh | bashIntermediate - Dangerous
wget -qO- https://example.com/setup | shAdvanced - Dangerous
python3 -c "exec(open('/tmp/stage2.py').read())"Advanced - Dangerous
export LD_PRELOAD=/tmp/.helper.so && /usr/bin/idAdvanced - Dangerous
curl -fsSL https://example.com/bootstrap | sudo bash -s -- --forceExpert - Safe
kill -HUP $(cat /var/run/nginx.pid)Nightmare - Dangerous
bash -c "$(curl -fsSL https://example.com/install)"Expert - Dangerous
mshta https://example.com/page.htaExpert - Safe
ps -eo pid,ppid,user,etimes,cmd --sort=-etimes | awk '$4 > 86400 && $3 != "root"' | head -25Nightmare - Dangerous
printf '%s' 'dW5hbWUgLWE=' | base64 -d | shNightmare - Dangerous
curl -fsSL https://example.com/get-cli.sh | shProIntermediate - Safe
kill -TERM $(cat ./tmp/dev-server.pid)ProExpert - Dangerous
Set-ExecutionPolicy Bypass -Scope Process -Force; ./tools/install.ps1ProExpert - Dangerous
curl -s https://example.com/setup.json | jq -r '.install' | shProIntermediate - Dangerous
curl -s https://example.com/tasks.json | jq -r '.[].cmd' | bashProAdvanced - Dangerous
jq -L /tmp/jq-modules 'include "helpers"; .data | normalise' input.jsonProAdvanced - Dangerous
jq -r '.hooks[] | .command' .repo-config.json | while read -r c; do $c; doneProExpert - Dangerous
curl -s https://example.com/filters/report.jq -o /tmp/r.jq && jq -f /tmp/r.jq metrics.jsonProExpert - Dangerous
find . -name '*.sh' -exec bash {} \;ProExpert - Dangerous
curl -sSL https://get.example.com/install.sh | shProIntermediate - Dangerous
Invoke-RestMethod https://get.example.com/install.ps1 | Invoke-ExpressionProIntermediate - Safe
kill -Name node -WhatIfProAdvanced - Dangerous
Start-BitsTransfer -Source https://cdn.example.com/agent.msi -Destination $env:TEMP\agent.msi; Start-Process msiexec -ArgumentList '/i',"$env:TEMP\agent.msi",'/quiet'ProAdvanced - Dangerous
Import-Module \\198.51.100.25\tools\Ops.psm1 -ForceProExpert - Dangerous
powershell.exe -ExecutionPolicy Bypass -NoProfile -File \\198.51.100.25\deploy$\setup.ps1ProNightmare - Dangerous
$c = Invoke-RestMethod https://config.example.com/agent.json; & $c.commandProNightmare - Safe
kubectl exec deploy/web -- kill -HUP 1ProAdvanced - Dangerous
aws ssm send-command --targets Key=tag:Environment,Values=production --document-name AWS-RunShellScript --parameters 'commands=["curl -s https://tools.example.net/agent.sh | sh"]'ProExpert - Safe
objdump -d --section=.text ./sample-8f2a.bin | head -40ProExpert - Safe
gdb ./sample-8f2a.bin -batch -ex 'disassemble main'ProExpert - Safe
nm -D ./libsample.so | grep -E ' U (system|exec|fork)'ProNightmare - Safe
kill -STOP 4821ProNightmare - Safe
capa -j ./sample-8f2a.bin > ./capa.jsonProNightmare - Dangerous
chmod +x ./sample-8f2a.bin && ./sample-8f2a.binProIntermediate - Dangerous
wine ./invoice_scan.exeProIntermediate - Dangerous
xdg-open ./invoice.pdfProAdvanced - Dangerous
strace -f ./sample-8f2a.binProAdvanced - Dangerous
gdb ./sample-8f2a.bin -batch -ex run -ex btProAdvanced - Dangerous
libreoffice --norestore ./invoice.docProAdvanced - Dangerous
unzip -P infected ./sample.zip -d ./analysis && ./analysis/setup.binProAdvanced - Dangerous
python3 -c "import ctypes; ctypes.CDLL('./libsample.so')"ProNightmare - Dangerous
LD_PRELOAD=./libsample.so ls -la ./extractedProNightmare - Dangerous
sudo systemctl stop falcon-sensorProAdvanced - Safe
kill $(cat scan.pid)ProAdvanced - Safe
ps -ef > /evidence/ir-2026-004/ps.txtProIntermediate - Safe
sudo cp /proc/4821/exe /evidence/ir-2026-004/proc-4821.binProIntermediate - Dangerous
sudo kill -9 4821ProIntermediate - Safe
sudo avml /evidence/ir-2026-004/mem.limeProIntermediate - Safe
sudo lsof -p 4821 > /evidence/ir-2026-004/lsof-4821.txtProAdvanced - Safe
vol -f /evidence/ir-2026-004/mem.lime linux.pslistProExpert - Safe
kill -0 4821Beginner - Dangerous
kill -9 1Beginner