linux detect activated strace

walk_proc_to_detect_trace.bash

#!/bin/bash
# Detect processes being ptraced via /proc/<pid>/status
# I am sure there are better ways!

while true; do
    for pid in /proc/[0-9]*/status; do
        tracer=$(grep -m1 "^TracerPid:" "$pid" 2>/dev/null | awk '{print $2}')
        if [[ -n "$tracer" && "$tracer" != "0" ]]; then
            target_pid=$(echo "$pid" | grep -oP '\d+')
            tracer_comm=$(cat /proc/${tracer}/comm 2>/dev/null)
            target_comm=$(cat /proc/${target_pid}/comm 2>/dev/null)
            echo "[!] $(date): '$tracer_comm' (PID $tracer) is tracing '$target_comm' (PID $target_pid)"
        fi
    done
    sleep 1
done