Processes

Overview

Evidence: Processes
Description: Collect process list
Category: System
Platform: linux
Short Name: process
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

Process information on AIX systems provides detailed records of running processes, their attributes, and system resource usage. This data is essential for understanding system activity, detecting malicious processes, and investigating process-related security incidents. AIX process information includes process IDs, command lines, resource usage, and execution context.

Data Collected

This collector gathers structured data about processes.

Processes Data

Field	Description	Example
CWD	CWD	Example value
ChildrenMajorFaults	Children Major Faults	123
ChildrenMinorFaults	Children Minor Faults	123
Command	Command	Example value
CommandLine	Command Line	Example value
EffectiveGroupId	Effective Group Id	123
EffectiveUserId	Effective User Id	123
EffectiveUserName	Effective User Name	Example value
Environment	Environment	Example value
Executable	Executable	Example value
IsExecutableExists	Is Executable Exists	true
Hash	Hash	Example value
FileDescriptors	File Descriptors	Example value
Flags	Flags	123
GroupId	Group Id	123
MajorFaults	Major Faults	123
Maps	Maps	[]
MinorFaults	Minor Faults	123
Nice	Nice	123
ParentId	Parent Id	123
Priority	Priority	123
ProcessId	Process Id	123
RealGroupId	Real Group Id	123
RealUserId	Real User Id	123
ResidentSize	Resident Size	123
SavedGroupId	Saved Group Id	123
SavedUserId	Saved User Id	123
SessionId	Session Id	123
State	State	Example value
Threads	Threads	123
TpgId	Tpg Id	123
TtyNr	Tty Nr	123
RealUserName	Real User Name	Example value
SavedUserName	Saved User Name	Example value
VMSize	VM Size	123
CSTime	CS Time	123
CUTime	CU Time	123
SystemTime	System Time	123
StartTime	Start Time	123
StartDateTime	Start Date Time	2023-10-15 14:30:25+03:00
UserTime	User Time	123

Collection Method

This collector parses the necessary data from system process information and file system.

Forensic Value

This evidence is crucial for forensic investigations as it provides comprehensive process information for AIX systems. It helps investigators understand system activity, detect malicious processes, and investigate process-related attacks. The data can reveal running applications, resource usage patterns, and execution context. Analysts can use this information to identify suspicious processes, trace process relationships, and assess AIX system security posture.