Description: BASH environmental variables.
What The Data Shows: Malware can change variable such as $PATH to get their binaries to be run instead of legitimate copies.
SQL:
SELECT p.name,pe.key,pe.value
FROM processes AS p
JOIN process_envs AS pe
ON p.pid = pe.pid
WHERE p.name = "bash";
