pspy64

./pspy64 -pf -i 1000

Unprivileged process monitor: observes commands, cronjobs, and ephemeral host processes in real time using only /proc, no root required. Ideal for discovering periodic tasks that execute modifiable scripts.

When you suspect cronjobs or periodic scripts running as root but don't see them in /etc/crontab (e.g., tasks in /etc/cron.d or launched by systemd). Leave it running in the background while doing other enumeration and check which processes appear every few seconds.

If the host has no active periodic tasks, it won't add value: check first with cat /etc/crontab if there's activity. Also avoid it on hosts where /proc is restricted (hidepid=2): without permissions you'll see very little.