Lesson 6 of 8

Process Management

Understanding how Linux manages processes is critical for both system administration and security analysis. You will learn to monitor running processes, manage foreground and background jobs, send signals, and identify suspicious processes that may indicate a compromise. Process analysis is a key skill in incident response and malware analysis.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Manage Linux processes with ps, top, and kill. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Almost every professional security tool runs on Linux, and almost every server you will ever test runs Linux. Fluency in the terminal is not optional — it is the foundation that every other skill in this field is built on.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Navigate a Linux system confidently from the command line, write basic automation scripts to speed up repetitive tasks, and use the terminal-based security tools that are standard in professional penetration testing.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Process Management · Objective 1 of 4

VIDEO

Loading video…

List all running processes

Run 'ps aux' to list all running processes with their user, PID, CPU usage, memory usage, and command line. The output can be long — pipe it through 'less' with 'ps aux | less' to scroll through it, or through 'sort -k3 -rn | head -20' to see the top 20 CPU-consuming processes. In a post-exploitation scenario, the process list reveals what software is running, which users are active, and may expose credentials passed as command-line arguments (a common misconfiguration). Run 'ps aux --forest' to see the parent-child process hierarchy.

ps aux | sort -k3 -rn | head -20

Find processes by name

Run 'pgrep -la apache' to find all processes whose name contains 'apache', showing both the PID and the full command line. The 'pgrep' command is more precise than 'ps aux | grep apache' because it does not include the grep process itself in the results. Use 'pgrep -u root' to list all processes running as root — any of these that have exploitable vulnerabilities can be used for privilege escalation. Run 'lsof -p <pid>' to see all files and network connections open by a specific process.

pgrep -la apache

Check cron jobs

Run 'crontab -l' to list cron jobs for the current user, and 'sudo crontab -l' to list root's cron jobs if you have sudo access. Also check system-wide cron jobs in '/etc/crontab', '/etc/cron.d/', '/etc/cron.hourly/', '/etc/cron.daily/', '/etc/cron.weekly/', and '/etc/cron.monthly/'. Any cron job that runs a script or binary that you can write to is a privilege escalation vector — if root runs '/opt/backup.sh' every minute and you can write to that file, you can inject commands that execute as root. Run 'cat /etc/crontab' and examine every entry carefully.

crontab -l && cat /etc/crontab && ls /etc/cron.*/

Kill a process

Run 'kill <pid>' to send the default SIGTERM signal to a process, asking it to terminate gracefully. If the process does not respond to SIGTERM, use 'kill -9 <pid>' to send SIGKILL, which forces immediate termination without cleanup. Use 'killall apache2' to kill all processes with a given name, or 'pkill -u username' to kill all processes owned by a specific user. In a penetration test, you may need to kill a process to free a port, restart a service after modifying its configuration, or terminate a monitoring agent that is logging your activity.

kill -9 <pid>

Previous: Networking Commands Next Lesson