RedSide Security has released ProcSnap, a free, open-source Linux incident response and threat hunting tool designed to help security professionals investigate potentially compromised servers, identify suspicious activity, and collect forensic evidence.
When a security alert fires on a Linux server, incident responders often face an immediate challenge: determining whether the system has been compromised without relying entirely on tools that an attacker may have manipulated.
Many Linux servers operate without Endpoint Detection and Response (EDR) software. As a result, security analysts frequently rely on manual commands such as ps, ss, last, and crontab -l to investigate suspicious activity.
However, traditional command-line utilities may not provide reliable information when an attacker has tampered with system binaries, deployed a rootkit, or modified the operating environment.
To address these challenges, RedSide Security developed ProcSnap, a lightweight, Python-based live incident response tool that automates approximately 130 security checks and produces a comprehensive HTML investigation report.
The project is available under the MIT license.
GitHub Repository: RedSideSecurity/ProcSnap
What Is ProcSnap?
ProcSnap is a standalone Linux incident response triage tool designed to help security teams answer three important questions during an investigation:
- Is there evidence that the server has been compromised?
- How might an attacker have gained access?
- What persistence mechanisms may be present?
The tool collects security-relevant information directly from the Linux operating system, including the /proc filesystem and local package database.
Unlike conventional investigation workflows that depend heavily on system commands, ProcSnap is designed to inspect underlying operating system data directly wherever possible.
This approach can help analysts identify inconsistencies and suspicious behavior that might otherwise be missed.
ProcSnap is intended for rapid triage and evidence collection. Its findings support incident response decisions but do not independently guarantee that a system is clean or compromised.
Approximately 130 Security Checks Mapped to MITRE ATT&CK
ProcSnap performs approximately 130 security checks, each mapped to the MITRE ATT&CK framework.
These checks cover a wide range of Linux attack techniques and common indicators of compromise.
1. Malware and Suspicious Process Detection
ProcSnap looks for unusual process behavior and execution patterns, including:
- Fileless malware using
memfd - Processes masquerading as kernel threads
- Suspicious reverse-shell activity
- Hidden or potentially manipulated process information
- Unusual process execution characteristics
Fileless malware is particularly challenging for traditional file-based investigation because malicious code may execute in memory without leaving a conventional executable on disk.
By inspecting runtime information, ProcSnap aims to help analysts detect suspicious behavior that may not appear in ordinary filesystem searches.
2. Rootkit and System Integrity Checks
Attackers who gain privileged access may attempt to hide their activity by modifying system utilities or interfering with operating system visibility.
ProcSnap includes checks for:
- Hidden processes
- Suspicious kernel modules
- Trojaned system binaries
- Unexpected modifications to installed software
- Indicators of system-level manipulation
For Debian-based systems, ProcSnap can compare installed binaries against checksum information maintained by the dpkg package database.
This can help identify unexpected changes to system files, although package metadata and the underlying host must still be considered potentially untrusted during a serious compromise.
3. Persistence Mechanism Detection
Persistence allows an attacker to maintain access after the initial compromise.
ProcSnap examines several common Linux persistence locations and mechanisms, including:
- Unauthorized SSH public keys
- Suspicious cron jobs
- Non-default system services
- PAM authentication backdoors
LD_PRELOAD-based injection- Other suspicious system configuration changes
These checks help incident responders identify potential mechanisms that could allow an attacker to regain access after a reboot or service restart.
4. Authentication and Initial Access Investigation
ProcSnap also analyzes information related to authentication and possible entry points.
Examples include:
- Suspicious SSH access
- Unexpected authorized keys
- Login activity associated with brute-force sources
- Unusual authentication patterns
- Evidence supporting initial access investigation
The objective is to provide investigators with useful context when reconstructing how an attacker may have entered the environment.
Reducing Dependence on Potentially Compromised System Tools
One of ProcSnap's key design principles is to avoid unnecessary reliance on commands executed through the potentially compromised operating environment.
Traditional Linux triage often begins with commands such as:
ps aux
ss -tulpn
crontab -l
last
These utilities are useful under normal conditions.
However, if an attacker has replaced a system binary, altered its behavior, or deployed a rootkit, its output may be incomplete or misleading.
ProcSnap instead reads relevant information directly from sources such as /proc and the package database.
This provides an alternative collection approach and may expose discrepancies between operating system data and conventional command output.
Important: Direct access to /proc does not eliminate every form of tampering. A sufficiently privileged attacker, particularly one controlling kernel-level functionality, may still manipulate information visible to a live collection tool.
ProcSnap therefore supports rapid live triage rather than replacing trusted offline forensic analysis.
Evidence Collection With SHA-256 Hashing
During incident response, identifying suspicious activity is only part of the investigation.
Security teams also need to preserve relevant evidence for subsequent analysis.
ProcSnap can copy suspicious files into an evidence collection while generating SHA-256 hashes.
The hashes help analysts identify collected artifacts and verify whether their contents change after collection.
This capability supports workflows involving:
- Suspicious executable analysis
- Malware investigation
- Evidence preservation
- Incident documentation
- Further examination on an analyst workstation
The tool is designed to collect evidence without modifying the contents of the suspicious source files.
As with other live-response tools, collection itself may still affect system state, so responders should document tool execution and handle evidence according to their organization's forensic procedures.
Snapshot Collection: Investigating What Changed Over Time
One of ProcSnap's features is its snapshot collector.
Instead of collecting system information only once, investigators can configure repeated snapshots at short intervals.
This allows analysts to investigate questions such as:
- What processes were running at 03:14?
- What changed during the previous hour?
- Did a suspicious process appear and disappear?
- Was a new persistence mechanism introduced?
- Did system behavior change after a security alert?
Repeated snapshots provide additional context for investigating short-lived processes and changes that might be missed during a single manual examination.
This is especially useful when suspicious activity occurs intermittently.
Snapshots describe what the tool observed at the configured collection intervals; they cannot reconstruct activity that occurred before collection began or entirely between snapshots.
Offline Collection and Separate Threat Intelligence Enrichment
ProcSnap separates evidence collection from external threat intelligence enrichment.
Collection on the Suspected Host
The collection stage can operate without network access.
This is useful when incident responders need to investigate an isolated server or avoid making external requests from a potentially compromised environment.
Enrichment on the Analyst Workstation
Collected findings can subsequently be enriched from a separate workstation using external intelligence services.
Supported enrichment includes:
- IP geolocation
- VirusTotal file-hash lookups
- VirusTotal IP reputation lookups
The described enrichment workflow uses hashes and IP addresses rather than uploading collected suspicious files.
This separation helps reduce unnecessary network activity from the investigated system.
Organizations should still treat hashes, IP addresses, and investigation metadata as potentially sensitive when submitting queries to external services.
A Self-Contained HTML Incident Response Report
ProcSnap generates a self-contained HTML report designed to help analysts review and communicate investigation findings.
The report can be attached to incident response cases, shared with internal security teams, and retained with collected evidence.
A consolidated report reduces the need to manually combine information from numerous terminal commands into a separate investigation document.
It also provides a more accessible format for reviewing results and communicating them to other responders.
Designed for Fast Deployment
ProcSnap emphasizes minimal deployment requirements.
The tool is:
- Written in Python
- Implemented using the Python standard library
- Distributed as a single file
- Designed to run without installing third-party Python packages on the investigated host
- Available under the MIT open-source license
In a typical workflow, an authorized responder copies the Python file to the target Linux server and runs it to collect security-relevant information.
The project is designed to produce an initial triage snapshot in approximately one minute, although actual execution time depends on the host, enabled checks, and collection scope.
This makes ProcSnap suitable for situations where administrators need to perform initial investigation without deploying a full endpoint security platform.
Validation Against 14 Attack Simulations
According to RedSide Security's project documentation, ProcSnap is tested against 14 live attack simulations on every commit.
These simulations help validate detection functionality and reduce the risk of regressions during development.
The project also includes step-by-step usage recipes intended to help less-experienced analysts perform structured Linux triage.
Automated testing supports confidence in covered scenarios, but it does not guarantee detection of every malware family, rootkit, persistence technique, or attacker behavior.
Who Should Use ProcSnap?
ProcSnap is designed for a variety of cybersecurity roles.
| Role | Potential Use Case |
|---|---|
| Incident Responders | Rapid triage of potentially compromised Linux servers |
| SOC Analysts | Investigating Linux security alerts |
| Threat Hunters | Identifying suspicious execution and persistence patterns |
| System Administrators | Initial investigation of unexpected server behavior |
| DFIR Specialists | Collecting artifacts for further forensic examination |
| Security Researchers | Studying Linux attack techniques and detection logic |
| Cybersecurity Students | Learning structured Linux incident response workflows |
ProcSnap can complement EDR, SIEM, and existing forensic tools, particularly in environments where endpoint monitoring is limited or unavailable.
Open Source and Community Contributions
ProcSnap is published under the MIT license, making it freely available for use, review, modification, and contribution.
RedSide Security encourages security professionals to test the tool in authorized laboratory environments, report missed detections, suggest improvements, and contribute to its development.
GitHub: github.com/RedSideSecurity/ProcSnap
The project reflects RedSide Security's commitment to making practical cybersecurity capabilities accessible to organizations and individuals regardless of budget.
Conclusion
Investigating a potentially compromised Linux server is challenging, especially when endpoint security tooling is unavailable and the integrity of local system utilities cannot be fully trusted.
ProcSnap provides a lightweight, open-source approach to Linux incident response triage, combining approximately 130 MITRE ATT&CK-mapped checks, direct operating system data collection, evidence preservation, repeated snapshots, optional threat intelligence enrichment, and HTML reporting.
Its single-file Python design and offline collection capabilities make it particularly useful for rapid investigations and isolated environments.
While no live triage tool can guarantee detection of every compromise, structured evidence collection and repeatable security checks can help responders investigate suspicious activity more consistently.
Security shouldn't be a luxury.
At RedSide Security, we believe practical incident response tools should be accessible to everyone.
Project: ProcSnap on GitHub
Developer: RedSide Security
License: MIT
Use ProcSnap only on systems you own or are authorized to investigate. Live collection should be performed with appropriate evidence-handling procedures.
