Current implementation of proclist plugin uses win32_ps_list_procs() php function on Windows host.
Therefore, linux implementation is a simple system("ps -a"), which is OPSEC unsafe, an would probably trigger EDR alerts.
A better implementation should avoid relying on system command execution.
Current implementation of
proclistplugin useswin32_ps_list_procs()php function on Windows host.Therefore, linux implementation is a simple
system("ps -a"), which is OPSEC unsafe, an would probably trigger EDR alerts.A better implementation should avoid relying on system command execution.