blackhat

Current implementation of proclist plugin uses win32_ps_list_procs() php function on Windows host.

Therefore, linux implementation is a simple system("ps -a"), which is OPSEC unsafe, an would probably trigger EDR alerts.

A better implementation should avoid relying on system command execution.

Quark has huge progress over the past year.
However, the documentation does not catch up with the developments.
e.g. quark-rule-generate, quark reports, etc.

And our cooperation with other open source partners.
e.g. APKLab, IntelOwl, Pithus/Bazaard, BlackArch Linux, etc.