Watch the shell commands being executed actively. This beacon requires strace.
salt.beacons.sh.
beacon
Scan the shell execve routines. This beacon will convert all login shells
beacons: sh: {}
netapi