I was reading in Harlan Carvey's latest book about Lspd.pl. I see where this pl script will reveal the command that was executed to spawn the PID of interest. My question (and hopfully Harlan is out there reading this), does this include processes that are created automatically, say from malware etc.
Thanks in advance.
Mark
"I was reading in Harlan Carvey's latest book about Lspd.pl. I see where this pl script will reveal the command that was executed to spawn the PID of interest. My question (and hopfully Harlan is out there reading this), does this include processes that are created automatically, say from malware etc."
First, thanks for purchasing the book!
Now, lspd.pl will return, as part of its output, the command line used to launch a process. If you look at the output of the tool provided with the book, you'll see that there are number of processes that are created automatically that lspd.pl will return their command line.
A malware process will be no different.
Hope that helps,
Harlan