Fleet logo
Menu An icon indicating that interacting with this button will open the navigation menu.
Fleet logo An 'X' icon indicating that this can be interacted with to close the navigation menu.
Device management + MDM Orchestration + monitoring Software management + CVEs, usage, app library Integrations
Get started Guides Vitals Queries Policies Software Data tables API SUPPORT Chat Contribute Release notes "Why is Fleet on my computer?" Get your license
Stories
What people are saying News Ask around Take a tour Meetups COMPANY Origins   (Fleet & osquery) The handbook Logos/artwork Why open source?
Pricing Try it yourself
Get processes that no longer exist on disk

Get processes that no longer exist on disk

Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching a process to mask presence.

To learn more about queries, check this guide

SELECT name, path, pid FROM processes WHERE on_disk = 0;
An icon indicating that this section has important information

PowerShell commands are currently work in progress, contributions welcome.

Platform

macOS Windows Linux ChromeOS
Suggest an editEdit