Use the available remote shell commands to investigate Linux endpoints.
Command |
Description |
Syntax |
Example |
Supported on |
---|---|---|---|---|
bashhistory |
List command/bash history (/root/.bash_history) |
bashhistory |
bashhistory |
|
cat |
Output the specified content of the selected file (max size 1MB) |
cat [--offset <offset> <size>] [--hex] <file_location_and_extension> Note:
For the <file_location_and_extension>, specify the absolute or relative path to the file, the file name, and the file extension. Important:
The following optional parameters are only available on endpoints with the XDR Endpoint Sentor.
|
|
|
cd |
Change the current working directory |
cd <path> Note:
For the <path>, specify the absolute or relative path. |
cd /root |
|
clear |
Clear screen |
clear |
clear |
|
env |
List environment variables |
env |
env |
|
fileinfo |
List detailed file properties |
fileinfo <file_location_and_extension> |
|
|
get |
Collect a specific file and upload to Trend Micro Vision One Maximum file size: 4 GB |
get <file_location_and_extension> |
|
|
group list |
List local group information |
group list |
group list |
|
help |
Display help information |
help |
help |
|
ipconfig |
Display network configuration information |
ipconfig |
ipconfig |
|
kill |
Terminate a running process |
kill <PID> |
kill 1234 |
|
listenports |
List listening ports |
listenports |
listenports |
|
ls |
List contents of the directory |
ls [-a] [-l] [path]
Note:
For the <path>, specify the absolute or relative path. |
ls |
|
netstat |
List network statistics and active connections |
netstat |
netstat |
|
ps |
List running process information |
ps |
ps |
|
pwd |
Display current directory |
pwd |
pwd |
|
run |
Execute a previously uploaded script |
run <script_name_and_extension> [arguments] |
run demo.sh 1 "22 33" 44 |
|
scheduletasks |
List scheduled tasks |
scheduletasks |
scheduletasks |
|
service list |
List service information |
service list |
service list |
|
systeminfo |
List system information |
systeminfo |
systeminfo |
|
user info |
List account properties |
user info <username> Note:
<username> supports the use of the UID (for example, "0" for the root account). |
user info john_doe |
|
user list |
List local user accounts |
user list |
user list |
|