Pspy

pspy

Purpose

Use this skill for passive local process observation on approved Linux hosts when the current hypothesis depends on scheduled or transient privileged execution.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

• Need to observe cron, timers, or short-lived privileged processes.
• Need to confirm whether an escalation path is practically reachable.
• Need a repeatable observation path during retest.

Avoid When

• Host-local observation is not explicitly approved.
• Long-running monitoring would exceed the approved activity window.

Inputs

• Approved Linux host and user context
• Monitor duration and observation scope
• Evidence retention requirements

Procedure

1. Keep monitoring duration no longer than necessary.
2. Record only the privileged or material process observations.
3. Correlate process behavior with the escalation hypothesis.
4. Manually validate material paths before escalation.
5. Preserve the exact monitor scope for retest.

Command Syntax

Replace sample binaries with the approved local path.

# Monitor process creation events (64-bit)
./pspy64

# Monitor with filesystem events and 500ms interval
./pspy64 -pf -i 500

# 32-bit version
./pspy32

# Redirect output to file
./pspy64 2>&1 | tee /tmp/pspy_output.txt

# Run for 5 minutes then exit
timeout 300 ./pspy64 2>&1 | tee /tmp/pspy_output.txt

Evidence to Capture

• Privileged or material process activity relevant to the hypothesis
• Exact host, user context, and observation mode used
• Minimal proof needed for remediation

Safety Boundaries

• Use only on approved hosts.
• Keep monitoring narrow and protect process observations as host evidence.