The Processes page is a critical specialized view within the Monarx Web App. While other sections focus on files resting on the disk or PHP execution, this page monitors the active memory of your servers. It lists malicious or suspicious Linux processes that have been identified and neutralized in real-time.
Understanding Process Data
When a process is flagged, Monarx provides a deep dive into its behavior and origin. The following information is available for every entry:
Action: For every item in this list, the action taken is TERMINATED. Monarx kills the process immediately upon detection to prevent further damage.
Classification:
MALICIOUS: Confirmed threats that are known to be harmful.
SUSPICIOUS: Behaviors or scripts that exhibit "malware-like" traits and warrant investigation.
Malware Type: The specific family or category the process belongs to (e.g.,
xmrigfor crypto-miners,backdoor, oruploader).User: The system user on the server who started the process.
Uptime: How long the process was running in the system memory (in seconds) before it was intercepted and terminated.
Command Line: The exact command and arguments that were used to launch the process.
Process Title: The name of the process as it appeared in the system process list.
HostID: A unique nickname or ID for the specific server where the process was found. (Think of this as the "Name Tag" for your physical or virtual machine).
SHA256: The unique digital fingerprint of the process executable.
Path: The location on the server where the malicious executable file is stored.
Size: The size of the executable file involved.
ctime (Change Time): In layman's terms, this is the last time the file's status changed (like changing permissions or moving the file).
mtime (Modification Time): In layman's terms, this is the last time the content inside the file was actually edited or changed.
Enterprise ID: Your unique account ID within the Monarx system.
Process Event ID: The specific tracking number for this unique termination event.
Drilling Down with Filters
Just like the Runtime section, the Processes page features extensive filtering capabilities. You can combine filters to isolate specific threats across your entire fleet of servers.
3 Use-Case Examples for Hunting Malicious Processes:
Identifying Crypto-Miners: Filter by
Malware Type: xmrig. This allows you to quickly see which users or servers are being abused to mine cryptocurrency, which typically causes high CPU usage and slows down legitimate sites.Tracking Persistent Attackers: Filter by a specific
SHA256hash. If you find one malicious process, you can use its fingerprint to see if the exact same malicious program is attempting to run on any other servers in your company.Investigating "Stale" Infections: Filter by
Uptime(e.g., greater than 60 seconds) combined withClassification: Malicious. This helps you identify threats that managed to run for a short period before detection, allowing you to prioritize those users for a deeper security audit.
By utilizing these insights, you can move from reactive cleaning to proactive threat hunting, ensuring your server resources are used only for their intended purposes.
💡 Useful Tip: If you have a specific use-case or have questions on how to use the multiple filters to drill down to the exact information that you're looking for, do not hesitate to contact our Support team.