Please enable JavaScript.
Coggle requires JavaScript to display documents.
🚨 8️⃣ Incident Response - Live Response (Enterprise Linux) - Coggle…
🚨 8️⃣ Incident Response - Live Response (Enterprise Linux)
🟢 1️⃣ What is Live Response?
📌 Definition
Live Response is the process of collecting information from a running Linux system during a security incident.
📌 Main Goal
Identify attacker activity
Collect volatile evidence
Understand current system state
Stop ongoing damage
Support forensic investigation
📌 Why "Live"?
Because the system is powered on
Processes are running
Network connections are active
Memory contains temporary evidence
📌 Enterprise Usage
SOC Analyst
Incident Response Team
Digital Forensics Team
Linux Security Engineers
🟢 2️⃣ Live Response Preparation
📌 Before touching compromised server
Create Incident Ticket
Collect:
Incident ID
Date and Time
Affected Server
Analyst Name
Severity Level
Example:
Incident ID:
INC-2026-001
Server:
web-prod-01
IP:
10.10.20.15
📌 Prepare Investigation Tools
Trusted tools:
Sysinternals equivalent for Linux
SANS Linux IR Toolkit
Triage tools
Audit tools
Memory tools
📌 Preserve Evidence
Never immediately reboot
Never delete files
Never install unknown tools
Avoid changing timestamps
🟢 3️⃣ Initial Access To Compromised Linux Server
📌 Secure Connection
Use SSH
Command:
ssh
analyst@server-ip
Enterprise practice:
Use jump server
Example:
Analyst
|
|
Bastion Host
|
|
Production Server
📌 Record Session
Use script command
Start recording:
script incident_session.txt
Perform investigation
Stop recording:
exit
🟢 4️⃣ System Identification Collection
📌 Purpose
Understand compromised system
📌 Operating System Information
Command:
uname -a
Shows:
Kernel Version
Architecture
Host Information
Command:
cat /etc/os-release
Shows:
Linux Distribution
Version
📌 Hostname Information
Command:
hostnamectl
Shows:
Hostname
Operating System
Kernel
Virtualization
📌 Current Date and Time
Command:
date
Important because:
Timeline creation
📌 System Uptime
Command:
uptime
Shows:
System running duration
Load average
🟢 5️⃣ Process Investigation
📌 Purpose
Find malicious programs running in memory
📌 View Running Processes
Command:
ps aux
Explanation:
ps
Process Snapshot
a
All users
u
User format
x
Include background processes
📌 Process Tree
Command:
pstree -p
Shows:
Parent process
Child process
Example:
systemd
sshd
bash
malware.sh
📌 Find High CPU Processes
Command:
top
Enterprise alternative:
htop
📌 Check Process Details
Command:
ls -l /proc/PID
Example:
ls -l /proc/1234
Contains:
Memory
Open files
Network connections
Environment
📌 Check Process Executable
Command:
readlink /proc/PID/exe
Example:
readlink /proc/1234/exe
Output:
/tmp/.hidden/malware
Indicates:
Suspicious execution path
🟢 6️⃣ Memory Investigation
📌 Why Memory?
RAM contains:
Running malware
Encryption keys
Passwords
Active sessions
📌 Check Memory Usage
Command:
free -h
📌 Capture Memory Image
Enterprise Tools:
LiME
AVML
Example:
avml memory_dump.lime
📌 Memory Analysis
Tools:
Volatility 3
Example:
vol.py -f memory_dump.lime linux.pslist
Finds:
Hidden processes
Malware
Injected code
🟢 7️⃣ Network Investigation
📌 Purpose
Identify attacker communication
📌 Active Connections
Command:
ss -tunap
Explanation:
s
Socket
t
TCP
u
UDP
n
No DNS resolution
a
All connections
p
Process information
📌 Example Suspicious Connection
Output:
malware
PID 4444
Connection:
10.10.10.50:443
Investigation:
Check:
who owns IP
process path
logs
📌 Listening Services
Command:
ss -lntup
Finds:
Open ports
Running services
📌 Packet Capture
Command:
tcpdump -i eth0
Save traffic:
tcpdump -i eth0 -w capture.pcap
Analysis:
Wireshark
🟢 8️⃣ User Account Investigation
📌 Purpose
Detect unauthorized accounts
📌 List Users
Command:
cat /etc/passwd
📌 Check Recent Login
Command:
last
📌 Failed Login Attempts
Command:
lastb
📌 Current Logged Users
Command:
who
Command:
w
📌 Check SSH Authorized Keys
Path:
~/.ssh/authorized_keys
Command:
cat ~/.ssh/authorized_keys
Look for:
Unknown public keys
🟢 9️⃣ File System Investigation
📌 Find Recently Modified Files
Command:
find / -mtime -1
Finds:
Files changed in last 24 hours
📌 Suspicious Locations
Check:
/tmp
/var/tmp
/dev/shm
/etc/cron.*
/home
📌 File Metadata
Command:
stat filename
Shows:
Creation time
Modification time
Permissions
📌 Hash Evidence Files
Command:
sha256sum suspicious_file
Purpose:
Evidence integrity
🟢 🔟 Log Investigation
📌 Linux Log Locations
Authentication Logs
RHEL/CentOS:
/var/log/secure
Ubuntu:
/var/log/auth.log
System Logs:
/var/log/messages
/var/log/syslog
Audit Logs:
/var/log/audit/audit.log
📌 SSH Investigation
Command:
grep "Failed password" /var/log/auth.log
Finds:
Brute force attempts
📌 Journal Investigation
Command:
journalctl
Recent logs:
journalctl -xe
🟢 1️⃣1️⃣ Persistence Detection
📌 Attacker tries to survive reboot
📌 Cron Jobs
Check:
crontab -l
System cron:
ls -la /etc/cron.*
📌 Systemd Persistence
Check:
systemctl list-unit-files
Path:
/etc/systemd/system/
📌 SSH Persistence
Check:
~/.ssh/authorized_keys
📌 Startup Scripts
Check:
/etc/rc.local
🟢 1️⃣2️⃣ Evidence Collection
📌 Create Evidence Directory
Command:
mkdir /incident_IR_001
📌 Collect Important Data
System Information
uname -a > system.txt
Processes
ps aux > processes.txt
Network
ss -tunap > network.txt
Users
last > login_history.txt
Logs
cp /var/log/auth.log /incident_IR_001/
📌 Preserve Evidence
Use:
Read-only storage
Hash verification
Hash:
sha256sum evidence_file
🟢 1️⃣3️⃣ Live Response Best Practices
✅ Do
Collect volatile data first
Record commands
Preserve timestamps
Use trusted tools
Maintain chain of custody
❌ Do Not
Reboot immediately
Delete malware
Modify evidence
Run unknown scripts
🟢 1️⃣4️⃣ Enterprise Live Response Workflow
🚨 Alert Received
↓
🔐 Connect Through Jump Host
↓
📝 Start Session Recording
↓
🖥 Collect System Information
↓
⚙ Analyze Processes
↓
🧠 Capture Memory
↓
🌐 Analyze Network
↓
👤 Check Users
↓
📂 Collect Files
↓
📜 Analyze Logs
↓
🔒 Preserve Evidence
↓
📊 Send Findings To Incident Report
🟢 1️⃣5️⃣ Enterprise Tools Used
🔹 Velociraptor
Endpoint visibility
Live collection
🔹 GRR Rapid Response
Google incident response framework
🔹 osquery
SQL based endpoint investigation
🔹 Volatility
Memory analysis
🔹 Auditd
Linux auditing
🔹 Sysmon for Linux
Advanced monitoring
🔹 Elastic Agent
SIEM collection
🔹 Wazuh Agent
Security monitoring