The Process Sentinel is the piece of software that iterates over running processes, and then concludes if it is suspicious. Through its operation it assess the following parameters:
- software packaging,
- self-modification of
.textsection - presence of writable and executable memory regions within process memory
- external connections
Result are written in separate files in the tmp/procsent:
main_log-- general information about analyzed processes<PID>-<process_name>-<unique_id>-- detailed results for the particular process
user@host $ sudo ./procsent.py &
[<job_number>] + <PID> sudo ./procsent.py
user@host $ disown %<job_number>