From 389223795561620ba4ff868976cf81e57ce8722e Mon Sep 17 00:00:00 2001 From: Jaeyou PARK Date: Mon, 23 Jun 2025 15:37:35 +0900 Subject: [PATCH] Update getting-started-linux-tutorial.rst : Rearrange linux.pstree plugin description Moved plugin output example above the feature explanation for better flow and clarity. Simplified the description while retaining key points about process hierarchy and anomaly detection. --- doc/source/getting-started-linux-tutorial.rst | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index d84872b3e..d0b097e0e 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -133,9 +133,7 @@ This detailed view allows investigators to correlate user privileges, startup ti linux.pstree ~~~~~~~~~~~~ - -This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes. -It is especially useful for identifying unusual or suspicious process structures, such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution. +This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes. .. code-block:: shell-session @@ -155,7 +153,10 @@ It is especially useful for identifying unusual or suspicious process structures **** 0x8ca671210000 1608 1608 1507 gnome-session-b ***** 0x8ca66fba42c0 1765 1765 1608 ssh-agent -The tree view can help identify anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships. + +It helps identify unusual or suspicious process structures such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution. +The tree view is particularly useful for spotting anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships. + linux.bash