# Pspy

> Use for process and cron monitoring during authorized Linux pentests. Trigger on observing privileged task execution, identifying command paths for escalation hypotheses, and validating whether scheduled or transient processes create practical local attack paths.

- Skill: `timsonner/pspy` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/pspy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/pspy/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Productivity
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/pspy

---


# pspy

## Purpose

Use this skill for passive local process observation on approved Linux hosts when the current hypothesis depends on scheduled or transient privileged execution.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to observe cron, timers, or short-lived privileged processes.
- Need to confirm whether an escalation path is practically reachable.
- Need a repeatable observation path during retest.

## Avoid When

- Host-local observation is not explicitly approved.
- Long-running monitoring would exceed the approved activity window.

## Inputs

- Approved Linux host and user context
- Monitor duration and observation scope
- Evidence retention requirements

## Procedure

1. Keep monitoring duration no longer than necessary.
2. Record only the privileged or material process observations.
3. Correlate process behavior with the escalation hypothesis.
4. Manually validate material paths before escalation.
5. Preserve the exact monitor scope for retest.

## Command Syntax

Replace sample binaries with the approved local path.

```bash
# Monitor process creation events (64-bit)
./pspy64

# Monitor with filesystem events and 500ms interval
./pspy64 -pf -i 500

# 32-bit version
./pspy32

# Redirect output to file
./pspy64 2>&1 | tee /tmp/pspy_output.txt

# Run for 5 minutes then exit
timeout 300 ./pspy64 2>&1 | tee /tmp/pspy_output.txt
```

## Evidence to Capture

- Privileged or material process activity relevant to the hypothesis
- Exact host, user context, and observation mode used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only on approved hosts.
- Keep monitoring narrow and protect process observations as host evidence.