pspy - Process Snooping

./pspy64

watch -n 1 "ps -aux | grep pass"
watch "ps aux | grep '/bin/bash' | grep 'root'"
watch -n 1 "ps aux | grep '/bin/bash' | grep 'root'" > log.txt

sudo tcpdump -i lo -A | grep "pass"