cross_validate_processes
Cross-validate pslist and psscan artifacts to reveal ghost processes hidden from standard detection.
Instructions
Compare pslist vs psscan artifacts; returns ghost processes (hidden candidates).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pslist_artifact | Yes | ||
| psscan_artifact | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | ||
| source | Yes | ||
| preview | Yes | First rows only; query the rest via artifact_query | |
| row_count | Yes | ||
| artifact_id | Yes | Cite this id in findings (artifact_refs) | |
| payload_sha256 | Yes |