ps

ps reports a snapshot of current processes. It is one of the oldest UNIX utilities and exists on every POSIX system, though option syntax varies between BSD, GNU, and POSIX styles.

The u and j formats

Two format specifiers are especially useful:

# BSD-style "user-oriented" format — the default on many Linux distros
ps u
 
# "Jobs" format — adds PPID (parent PID) and numeric UID
ps j

• ps u gives USER, PID, %CPU, %MEM, VSZ, RSS, TTY, STAT, START, TIME, COMMAND.
• ps j gives PPID, PID, PGID, SID, TTY, TPGID, STAT, UID, TIME, COMMAND. The PPID column is the key difference — essential for tracing process trees and spotting orphaned or reparented malware.

Common invocations

ps aux              # all processes, user-oriented format (BSD style)
ps -ef              # all processes, full format (System V style)
ps -ejH             # forest view — process tree with jobs format
ps -o pid,ppid,user,comm -p $PID   # custom columns for one process

Security relevance

• Reconnaissance: ps aux reveals running services, cron jobs, and other users’ activity.
• Rootkit hunting: Comparing ps output against /proc or sysdig can reveal hidden processes. Attackers sometimes patch ps or use LD_PRELOAD to hide PIDs.
• Parent-child analysis: ps j or ps -ejH shows which shell spawned a suspicious binary — critical for tracing lateral movement.

Related

• posix-signals — what you send to a process after ps tells you its PID
• unix-file-descriptors — inspecting /proc/$PID/fd/ is the next step after ps
• bash-port-scanning — the process you might discover running on the target

Sources

• man7 — ps(1)
• POSIX — ps