Title
#general
n

nebi

07/30/2018, 1:30 AM
but there is no entry for this command
y

yuvalapidot

07/30/2018, 12:08 PM
Process table does not log scripts (like the one you described). However, i believe that the curl process should appear. If you run a query for the processes table right when the curl is running, it should be showing, but it might be hard to get it in the exact moment in time.
stefanmaerz

stefanmaerz

07/30/2018, 12:44 PM
yeah that is what i was thinking. you are probably creating a race condition. I bet you will see the curl process if you download a big file (that takes more time) using curl
a

ag4ve

07/30/2018, 11:11 PM
Auditd (kernel hook) should see the processes - while and test are (most likely) internal to your shell
11:14 PM
Also, I'm pretty sure audit won't directly catch echo > /dev/tcp/ip/port stuff if you're trying to catch that type of behavior