Process Discovery via pgrep for Tunnel/Service Processes

Duo Tech@duotech

•updated Aug 9, 2026•1•0•5

Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.