Find processes whose executable was deleted
find processes running deleted binary | proc exe deleted malware | detect fileless malware linux | proc | malware | processesls -l /proc/*/exe 2>/dev/null | grep '(deleted)'Checks the /proc/PID/exe link of every process and shows those whose executable was deleted. Malware likes to start from /tmp and then delete its file to attract less attention. The PID is part of the path, ps -fp PID shows details.
Note: After package updates, old versions of services often keep running and show up here as well. They disappear after the service is restarted.
Also searched as
- find processes running deleted binary
- proc exe deleted malware
- detect fileless malware linux