htop(1) can also highlight running processes that have had their on-disk executable replaced (highlights in red) or one of its shared libraries (highlights in yellow). I find this very useful.