Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting f

Analyzing Linux System Artifacts When to Use When investigating a compromised Linux server or workstation For identifying persistence mechanisms (cron, systemd, SSH keys) When tracing user activity through shell history and authentication logs During incident response to determine the scope of a Linux based breach For detecting rootkits, backdoors, and unauthorized modifications Prerequisites Forensic image or live access to the Linux system (read only) Understanding of Linux file system hierarchy (FHS) Knowledge of common Linux logging locations (/var/log/) Tools: chkrootkit, rkhunter, AIDE, auditd logs Familiarity with systemd, cron, and PAM configurations Root access for complete artifact collection Workflow Step 1: Mount and Collect System Artifacts Step 2: Analyze User Accounts and Authentication Step 3: Examine Persistence Mechanisms Step 4: Analyze Shell History and Command Execution Step 5: Check for Rootkits and Modified Binaries Key Concepts Concept Description /var/log/auth.log Primary authentication log on Debian/Ubuntu systems /var/log/secure Primary authentication log on RHEL/CentOS systems wtmp/btmp Binary logs recording successful and failed login sessions .bash history User command history file (can be cleared by attackers) crontab Scheduled task system commonly used for persistence authorized keys SSH public keys granting passwordless access to an account SUID bit File permission allowing execution as the file owner (privilege escalation vector) LD PRELOAD Environment variable that loads a shared library before all others (hooking technique) Tools & Systems Tool Purpose chkrootkit Rootkit detection scanner for Linux systems rkhunter Rootkit Hunter checks for rootkits, backdoors, and local exploits AIDE Advanced Intrusion Detection Environment file integrity monitor auditd Linux audit framework for system call and file access monitoring last/lastb Parse wtmp/btmp for login and failed login history Plaso/log2timeline Super timeline creation including Linux artifacts osquery SQL based system querying for live forensic investigation Velociraptor Endpoint agent with Linux artifact collection capabilities Common Scenarios Scenario 1: SSH Brute Force Followed by Compromise Analyze auth.log for failed SSH attempts followed by success, identify the attacking IP, check .bash history for post compromise commands, examine authorized keys for added backdoor keys, check crontab for persistence, review network connections. Scenario 2: Web Server Compromise via Application Vulnerability Examine web server access and error logs for exploitation attempts, check /tmp and /dev/shm for webshells, analyze the web server user's activity (www data), check for privilege escalation via SUID binaries or kernel exploits, review outbound connections. Scenario 3: Insider Threat on Database Server Analyze the suspect user's bash history for database dump commands, check for large tar/zip files in home directory or /tmp, examine scp/rsync commands for data transfer, review cron jobs for automated exfiltration, check USB device logs. Scenario 4: Crypto Miner on Cloud Instance Check for high CPU processes in /proc (live) or systemd service files, examine crontab entries for miner restart scripts, check /tmp for mining binaries, analyze network connections for mining pool communications, review authorized keys for attacker access. Output Format

analyzing-linux-system-artifacts