October 28, 2026
Linux pstree Cheat Sheet: How to Find Who Started That Process
It’s 3 a.m. and the alert says: unexpected shell on a production Linux server. 🌙
By Xpert4Cyber
A flat process list gives you hundreds of lines. A process tree gives you the story: who started what, and when.
That's the quiet power of the Linux pstree command, and it's one of the fastest ways to turn a vague alert into a lead during incident response and threat hunting.
In this deep dive for SOC analysts, DFIR teams, and Linux admins, I walk through:
🌳 Reading pstree -ap output with PIDs and arguments 🔍 Tracing ancestry with pstree -sp PID 🧩 Parent-child chains worth a closer look, like web server → shell and cron → download tool → interpreter ⚠️ Where pstree misleads: short-lived processes, reparenting to PID 1, and spoofed names
The key lesson: pstree shows relationships, not a malware verdict. Confirm the executable path, command line, and network activity before escalating. The guide also shows how to turn the same logic into auditd and EDR detections.
Read the full cheat sheet: https://www.xpert4cyber.com/2026/10/linux-pstree-command-cheat-sheet.html