Queries/

Get processes that no longer exist on disk

AndrewB

Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching a process to mask presence.

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

SELECT name, path, pid FROM processes WHERE on_disk = 0;

echo "name, path, pid"; ps -e -o pid= | while read pid; do path=$(lsof -p "$pid" 2>/dev/null | awk '$4=="txt" {print $9; exit}'); if [ -n "$path" ] && [ ! -e "$path" ]; then echo "$(basename "$path"), $path, $pid"; fi; done