Please enable JavaScript.

Coggle requires JavaScript to display documents.

🛡️Live Examination - Important (how to check if linux compromissed) 🛡️…

- - - - Identify suspicious activity
      - Sources:
        
        SIEM Alerts
        
        Elastic SIEM
        
        Splunk
        
        QRadar
        
        IDS/IPS Alerts
        
        EDR Alerts
        
        User Reports
        
        Security Monitoring
      - Example Alert:
        
        Successful SSH Login From Unknown Country
    - - Goal:
        
        Determine if system is compromised
      - Important Rule:
        
        DO NOT reboot immediately
        
        DO NOT delete suspicious files
        
        DO NOT kill processes immediately
      - Reason:
        
        Memory evidence can disappear
        
        Running malware may disappear
        
        Attack timeline can be destroyed
    - - Collect:
        
        System Information
        
        hostname
        
        uptime
        
        IP address
        
        running processes
        
        network connections
        
        Authentication Evidence
        
        login history
        
        SSH logs
        
        sudo activity
        
        Persistence Evidence
        
        cron jobs
        
        systemd services
        
        startup scripts
    - - Objective:
        
        Stop attacker access
      - Actions:
        
        Network Isolation
        
        Disconnect server from network
        
        Block attacker IP
        
        Move server to quarantine VLAN
        
        Disable Account
        
        passwd -l username
        
        Block IP
        
        iptables
        
        firewall
    - - Remove:
        
        Malware
        
        Backdoors
        
        Unauthorized users
        
        Persistence mechanisms
      - Fix:
        
        Vulnerabilities
        
        Weak passwords
        
        Misconfiguration
    - - Restore service
      - Actions:
        
        Patch system
        
        Restore clean backup
        
        Enable monitoring
        
        Verify security controls
- - - - Preserve digital evidence before making any changes
      - Maintain evidence integrity
      - Support forensic investigation
      - Prevent contamination of evidence
    - - ✅ DO
        
        📌 Collect evidence first
        
        Capture system state
        
        Capture running processes
        
        Capture network connections
        
        Capture logged-in users
        
        Capture volatile data
        
        📌 Document every action
        
        Record commands executed
        
        Record timestamps
        
        Record investigator name
        
        Record system affected
        
        📌 Work on copies whenever possible
        
        Create forensic copies
        
        Preserve original evidence
        
        Use read-only methods
      - ❌ AVOID
        
        🚫 Reboot System
        
        Memory contents will be lost
        
        Running malware may disappear
        
        Active connections will terminate
        
        Volatile evidence will be destroyed
        
        🚫 Delete Files
        
        Removes forensic evidence
        
        Destroys attacker artifacts
        
        Removes timestamps and metadata
        
        🚫 Reinstall Operating System
        
        Destroys evidence
        
        Removes malware traces
        
        Deletes logs and configuration changes
        
        🚫 Install Unnecessary Tools
        
        Changes system state
        
        Modifies timestamps
        
        Creates additional artifacts
    - - 🎯 Purpose
        
        Store incident response evidence
        
        Keep collected information organized
        
        Protect investigation files
      - 📂 Create Directory
        
        Command
        
        mkdir /root/incident_response
        
        Explanation
        
        mkdir
        
        Create a directory
        
        /root
        
        Root user's home directory
        
        incident_response
        
        Investigation storage location
      - 🔐 Secure Directory Permissions
        
        Command
        
        chmod 700 /root/incident_response
        
        Permission Meaning
        
        Owner
        
        Read
        
        Write
        
        Execute
        
        Group
        
        No Access
        
        Others
        
        No Access
        
        Enterprise Reason
        
        Only incident responders can access evidence
        
        Prevent unauthorized modification
        
        Protect sensitive investigation data
    - - 🎯 Purpose
        
        Establish investigation timeline
        
        Correlate events with logs
        
        Match SIEM alerts
        
        Support forensic analysis
      - 📅 Record Current Date and Time
        
        Command
        
        date
        
        Collects
        
        Current system date
        
        Current system time
        
        Timezone information
      - 🕒 Check Time Synchronization
        
        Command
        
        timedatectl
        
        Collects
        
        System Clock
        
        Current system time
        
        Universal Time
        
        UTC reference time
        
        RTC Time
        
        Hardware clock time
        
        Time Zone
        
        Server location setting
        
        NTP Status
        
        Network time synchronization
        
        Enterprise Importance
        
        Accurate timestamps are required for:
        
        SIEM correlation
        
        Log analysis
        
        Attack timeline
        
        Legal investigation
    - - 🎯 Purpose
        
        Capture baseline system information
        
        Identify affected asset
        
        Support forensic documentation
      - 🏷️ Host Identity Information
        
        Command
        
        hostnamectl
        
        Collects
        
        Hostname
        
        Server identity
        
        Operating System
        
        Linux distribution
        
        Kernel Version
        
        Running kernel information
        
        Architecture
        
        x86_64 or ARM
        
        Virtualization
        
        VMware
        
        KVM
        
        AWS
        
        Azure
        
        Enterprise Usage
        
        Asset identification
        
        CMDB verification
        
        Incident ticket documentation
      - 🐧 Kernel Information
        
        Command
        
        uname -a
        
        Collects
        
        Kernel name
        
        Hostname
        
        Kernel release
        
        Kernel version
        
        Hardware architecture
        
        Security Importance
        
        Detect:
        
        Kernel vulnerabilities
        
        Unauthorized kernel changes
        
        Unsupported versions
      - ⚡ System Running Time
        
        Command
        
        uptime
        
        Collects
        
        Current time
        
        System uptime
        
        Logged-in users
        
        CPU load average
        
        Investigation Use
        
        Detect:
        
        Recent reboot
        
        Possible attacker activity
        
        Service interruption
    - - Create Investigation Notes
        
        Command
        
        touch /root/incident_response/investigation_notes.txt
      - Record Commands Output
        
        Example
        
        hostnamectl > /root/incident_response/hostname.txt
        
        uname -a > /root/incident_response/kernel.txt
        
        uptime > /root/incident_response/uptime.txt
        
        date > /root/incident_response/time.txt
      - Verify Evidence Files
        
        Command
        
        ls -lah /root/incident_response
        
        Check
        
        File ownership
        
        File permissions
        
        File creation time
        
        Evidence completeness
    - - 👤 Access Control
        
        Evidence directory owner
        
        root
        
        Permissions
        
        700
      - 📝 Chain of Custody
        
        Record
        
        Who collected evidence
        
        When evidence was collected
        
        Which commands were executed
        
        Where evidence is stored
      - 🔐 Integrity Protection
        
        Generate Hash
        
        Command
        
        sha256sum evidence_file
        
        Purpose
        
        Prove evidence was not modified
        
        Maintain forensic integrity
    - - 1️⃣ Preparation
        
        Tools ready
        
        IR procedures available
        
        Logging enabled
      - 2️⃣ Evidence Preservation
        
        Create investigation directory
        
        Record time
        
        Record system information
        
        Preserve volatile evidence
      - 3️⃣ Identification
        
        Determine:
        
        Compromised host
        
        Attack indicators
        
        Suspicious activity
      - 4️⃣ Containment
        
        Network isolation
        
        Disable attacker access
        
        Preserve system state
      - 5️⃣ Eradication
        
        Remove malware
        
        Patch vulnerabilities
        
        Reset credentials
      - 6️⃣ Recovery
        
        Restore services
        
        Monitor system
        
        Validate security
      - 7️⃣ Lessons Learned
        
        Root cause analysis
        
        Improve controls
        
        Update procedures
- - - - Identify active user sessions
      - Detect unauthorized access
      - Find possible attacker interactive sessions
      - Verify who is currently connected to the Linux server
    - - Incident Alert Received
        
        Suspicious login detected
        
        Security monitoring alert
        
        SIEM notification
        
        User reports abnormal activity
      - First Response Question
        
        Who is currently logged into the system?
        
        Is any attacker still connected?
        
        Is the session legitimate?
    - - 📌 Purpose
        
        Shows currently logged-in users
        
        Provides basic session information
      - 📝 Syntax
        
        who
      - 📊 Example Output
        
        root pts/0 192.168.1.50
        
        bilal pts/1 10.10.10.5
      - 🔍 Output Explanation
        
        👤 Username
        
        root
        
        Administrator account
        
        bilal
        
        Normal user account
        
        💻 Terminal
        
        pts/0
        
        Virtual terminal session
        
        Usually SSH connection
        
        pts/1
        
        Another remote session
        
        🌐 Source IP Address
        
        192.168.1.50
        
        Client machine IP
        
        Check if trusted
        
        10.10.10.5
        
        Remote source
        
        Verify ownership
    - - 👤 User Verification
        
        Is this user expected?
        
        Does this account belong to an employee?
        
        Is the account active?
        
        Was this account recently created?
      - 🌐 IP Address Verification
        
        Is this IP known?
        
        Is it from corporate network?
        
        Is it from VPN?
        
        Is it from suspicious location?
        
        Is it a public internet address?
      - ⏰ Login Time Verification
        
        Is login time normal?
        
        Did user login outside working hours?
        
        Does it match user activity?
      - 🔐 Account Verification
        
        Check account status
        
        passwd -S username
        
        Check user information
        
        id username
        
        Check group membership
        
        groups username
    - - 📌 Purpose
        
        Detailed view of logged-in users
        
        Shows user activity
        
        Shows running commands
      - 📝 Syntax
        
        w
      - 📊 Information Displayed
        
        👤 Username
        
        Logged-in account name
        
        💻 Terminal
        
        Session terminal identifier
        
        ⏰ Login Time
        
        When session started
        
        ⏳ Idle Time
        
        How long user inactive
        
        🌐 Source IP
        
        Remote connection address
        
        ⚙️ Running Command
        
        Current process being executed
    - - Step 1️⃣
        
        Check active sessions
        
        who
        
        w
      - Step 2️⃣
        
        Identify suspicious users
        
        Unknown account
        
        Unexpected root login
        
        Strange username
      - Step 3️⃣
        
        Identify source IP
        
        Verify IP ownership
        
        Check network logs
        
        Check firewall logs
      - Step 4️⃣
        
        Investigate user activity
        
        Check shell history
        
        cat ~/.bash_history
        
        Check processes
        
        ps aux
        
        Check network connections
        
        ss -tulpn
        
        Check login history
        
        last
        
        Check failed login attempts
        
        lastb
    - - Example 1️⃣
        
        Output:
        
        root pts/0 45.33.22.10
        
        Investigation:
        
        Root login from external IP
        
        Verify VPN usage
        
        Check SSH logs
        
        Possible compromise
      - Example 2️⃣
        
        Output:
        
        unknownuser pts/1 192.168.1.100
        
        Investigation:
        
        Unknown account
        
        Check account creation
        
        Check sudo permissions
        
        Review commands executed
    - - SSH Authentication Logs
        
        Ubuntu / Debian
        
        /var/log/auth.log
        
        RHEL / CentOS
        
        /var/log/secure
      - System Logs
        
        /var/log/messages
      - Journal Logs
        
        journalctl
    - - Current Sessions
        
        who
      - Detailed Sessions
        
        w
      - Last Successful Logins
        
        last
      - Failed Login Attempts
        
        lastb
      - Active Processes
        
        ps aux
      - Network Connections
        
        ss -tunap
      - SSH Login Investigation
        
        journalctl -u ssh
      - Real Time Monitoring
        
        tail -f /var/log/auth.log
    - - User Known?
        
        YES
        
        Continue monitoring
        
        NO
        
        Investigate account
      - IP Known?
        
        YES
        
        Validate activity
        
        NO
        
        Treat as suspicious
      - Root Session?
        
        YES
        
        High priority investigation
        
        NO
        
        Continue analysis
    - - Record
        
        Username
        
        Source IP
        
        Login Time
        
        Terminal
        
        Running Commands
      - Preserve Evidence
        
        Take screenshots
        
        Save command output
        
        Export logs
      - Example
        
        who > active_users.txt
        
        w > user_activity.txt
    - - SIEM
        
        Forward authentication logs
        
        Detect abnormal login patterns
        
        Correlate IP reputation
      - EDR
        
        Monitor processes
        
        Detect malicious activity
      - PAM
        
        Control privileged sessions
        
        Record administrator activity
      - IDS/IPS
        
        Detect suspicious network sources
    - - Identify unauthorized sessions
      - Determine:
        
        Who logged in?
        
        From where?
        
        When?
        
        What are they doing?
      - Take Action:
        
        Terminate session
        
        Disable account
        
        Block IP
        
        Collect forensic evidence
- - - - Identify previous attacker access
      - Detect unauthorized login attempts
      - Investigate suspicious user activity
      - Determine initial access timeline
      - Identify compromised accounts
      - Support forensic investigation
    - - 🛠 Command
        
        last
      - 📌 Purpose
        
        Show successful login sessions
        
        Display user access history
        
        Identify who accessed the system
        
        Identify when access occurred
        
        Identify source location/IP
      - 📄 Example Output
        
        root pts/0 203.0.113.5
      - 🔍 Output Analysis
        
        👤 Username
        
        root
        
        Administrator account
        
        High-risk account
        
        💻 Terminal
        
        pts/0
        
        SSH interactive session
        
        🌐 Source IP
        
        203.0.113.5
        
        Remote login origin
        
        ⏰ Login Time
        
        Check unusual time
        
        Check outside business hours
      - 🚨 Investigate Suspicious Login
        
        🌍 Unknown Country
        
        Login from unexpected geographic location
        
        Compare with company user location
        
        Check VPN usage
        
        🌐 Unknown IP Address
        
        Verify IP ownership
        
        Check threat intelligence
        
        Check reputation
        
        👑 Root Login
        
        Direct root access investigation
        
        Check SSH configuration
        
        Verify authorized administrators
        
        👤 Unknown User Account
        
        Check account creation time
        
        Check user privileges
        
        Check sudo permissions
    - - 🛠 Commands
        
        last -a
        
        Show login source IP
        
        last -i
        
        Show IP address format
        
        lastlog
        
        Show last login for every user
        
        who
        
        Show currently logged-in users
        
        w
        
        Show active users and processes
      - 🔍 Investigate
        
        Active attacker session
        
        Suspicious user activity
        
        Long-running sessions
        
        Unexpected administrative access
    - - 🎯 Purpose
        
        Detect password attacks
        
        Identify brute force attempts
        
        Detect account targeting
        
        Find automated attack tools
      - 🐧 Ubuntu / Debian Systems
        
        📂 Log Location
        
        /var/log/auth.log
        
        🛠 Command
        
        grep "Failed password" /var/log/auth.log
        
        Example
        
        Failed password for invalid user admin
        
        from 203.0.113.10 port 22 ssh2
      - 🔴 RHEL / CentOS / Rocky Linux
        
        📂 Log Location
        
        /var/log/secure
        
        🛠 Command
        
        grep "Failed password" /var/log/secure
        
        Example
        
        Failed password for root
        
        from 203.0.113.10 port 22 ssh2
    - - 🚨 Indicators
        
        🔑 Multiple Failed Password Attempts
        
        Same username
        
        Same IP address
        
        Short time interval
        
        🌐 Multiple Source IPs
        
        Distributed brute force attack
        
        Botnet activity
        
        👤 Targeted Accounts
        
        root
        
        admin
        
        ubuntu
        
        test
        
        🌙 Unusual Timing
        
        Night-time attacks
        
        Weekend activity
      - 🛠 Investigation Commands
        
        Count failed attempts
        
        grep "Failed password" /var/log/auth.log | wc -l
        
        Find attacking IP addresses
        
        grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr
        
        Search root attack attempts
        
        grep "Failed password for root" /var/log/auth.log
    - - 📂 Configuration File
        
        /etc/ssh/sshd_config
      - 🔍 Check Root Login
        
        PermitRootLogin
      - 🛠 Command
        
        grep PermitRootLogin /etc/ssh/sshd_config
      - Secure Configuration
        
        PermitRootLogin no
      - Investigate
        
        Root login enabled
        
        Weak SSH configuration
        
        Password authentication enabled
    - - 🎯 Goal
        
        Build attacker activity timeline
      - Collect
        
        🕒 First Login
        
        When attacker entered
        
        🕒 Failed Attempts
        
        Password guessing period
        
        🕒 Successful Login
        
        Initial compromise
        
        🕒 Privilege Escalation
        
        sudo usage
        
        🕒 Persistence Activity
        
        New users
        
        Cron jobs
        
        SSH keys
      - Commands
        
        Authentication timeline
        
        journalctl -u ssh
        
        Recent authentication events
        
        journalctl _SYSTEMD_UNIT=sshd.service
    - - 🔍 Check Users
        
        View Users
        
        cat /etc/passwd
        
        Check Recent Users
        
        last
        
        Check UID 0 Accounts
        
        awk -F: '$3==0 {print $1}' /etc/passwd
      - Detect
        
        🚨 Unauthorized Accounts
        
        🚨 Hidden Users
        
        🚨 Fake Admin Accounts
        
        🚨 UID 0 Backdoor Accounts
    - - 🎯 Purpose
        
        Detect privilege escalation
      - 📂 Logs
        
        Ubuntu
        
        /var/log/auth.log
        
        RHEL
        
        /var/log/secure
      - Commands
        
        grep sudo /var/log/auth.log
        
        grep sudo /var/log/secure
      - Detect
        
        sudo abuse
        
        Unauthorized root commands
        
        Privilege escalation attempts
    - - 🚨 If Compromise Suspected
        
        1️⃣ Preserve Evidence
        
        Do not reboot immediately
        
        Capture volatile data
        
        2️⃣ Isolate System
        
        Network isolation
        
        Block attacker IP
        
        3️⃣ Disable Compromised Account
        
        passwd -l username
        
        4️⃣ Kill Active Sessions
        
        pkill -u username
        
        5️⃣ Rotate Credentials
        
        Change passwords
        
        Replace SSH keys
        
        6️⃣ Review Logs
        
        Authentication logs
        
        Application logs
        
        Firewall logs
        
        7️⃣ Document Findings
        
        Time
        
        User
        
        IP address
        
        Commands executed
        
        Impact assessment
    - - 🛡 SIEM Monitoring
        
        Elastic SIEM
        
        SSH login detection
        
        Failed authentication alerts
        
        Geo-location analysis
        
        Splunk
        
        Authentication correlation
        
        User behavior analysis
        
        Wazuh / OSSEC
        
        Login monitoring
        
        File integrity alerts
      - 🔎 Threat Intelligence
        
        IP reputation checking
        
        Malware indicators
        
        Attack source investigation
    - - 1️⃣ Alert Received
        
        Suspicious login detected
      - 2️⃣ Validate Event
        
        Check user
        
        Check IP
        
        Check timestamp
      - 3️⃣ Investigate History
        
        last
        
        auth.log
        
        secure log
      - 4️⃣ Determine Attack Type
        
        Brute force
        
        Credential theft
        
        Insider activity
      - 5️⃣ Containment
        
        Block access
        
        Disable account
      - 6️⃣ Recovery
        
        Patch system
        
        Reset credentials
      - 7️⃣ Lessons Learned
        
        Improve monitoring
        
        Update security controls
- - - - 📂 SSH Configuration Files
        
        📄 Main SSH Server Configuration
        
        /etc/ssh/sshd_config
        
        Controls SSH daemon security
        
        Authentication methods
        
        User access control
        
        Network binding
        
        Security hardening settings
        
        📄 SSH Client Configuration
        
        /etc/ssh/ssh_config
        
        Client side SSH settings
        
        Default connection behavior
        
        📂 User SSH Directory
        
        ~/.ssh/
        
        authorized_keys
        
        id_rsa
        
        id_rsa.pub
        
        known_hosts
        
        config
    - - 🔍 Step 1: Identify SSH Service Status
        
        Check SSH Service
        
        Ubuntu / Debian:
        
        systemctl status ssh
        
        RHEL / CentOS:
        
        systemctl status sshd
        
        Check SSH Process
        
        ps aux | grep sshd
        
        Check Listening Ports
        
        ss -tulnp | grep ssh
        
        netstat -tulnp | grep ssh
      - 🔍 Step 2: Analyze SSH Configuration
        
        View SSH Configuration
        
        cat /etc/ssh/sshd_config
        
        Check Effective SSH Configuration
        
        sshd -T
        
        Validate Configuration Syntax
        
        sshd -t
    - - 🚨 PermitRootLogin
        
        Check:
        
        grep PermitRootLogin /etc/ssh/sshd_config
        
        Dangerous:
        
        PermitRootLogin yes
        
        Allows:
        
        Direct root login
        
        Brute force attacks against root
        
        Privilege escalation risk
        
        Enterprise Recommended:
        
        PermitRootLogin no
        
        Better Administration:
        
        Normal User
        
        ↓
        
        sudo privilege
        
        ↓
        
        Root Access
      - 🚨 PasswordAuthentication
        
        Check:
        
        grep PasswordAuthentication /etc/ssh/sshd_config
        
        Dangerous:
        
        PasswordAuthentication yes
        
        Risk:
        
        Password guessing attacks
        
        Brute force attacks
        
        Credential theft impact
        
        Enterprise Recommended:
        
        PasswordAuthentication no
        
        Use:
        
        SSH Public Key Authentication
      - 🔐 PubkeyAuthentication
        
        Check:
        
        grep PubkeyAuthentication /etc/ssh/sshd_config
        
        Recommended:
        
        PubkeyAuthentication yes
        
        Benefits:
        
        Strong cryptographic authentication
        
        No password attacks
        
        Enterprise friendly
    - - 🔒 Recommended sshd_config Settings
        
        Disable Root Login
        
        PermitRootLogin no
        
        Disable Password Login
        
        PasswordAuthentication no
        
        Enable SSH Keys
        
        PubkeyAuthentication yes
        
        Disable Empty Passwords
        
        PermitEmptyPasswords no
        
        Limit Login Attempts
        
        MaxAuthTries 3
        
        Change Default SSH Port
        
        Port 22
        
        Optional:
        
        Port 2222
        
        Restrict Users
        
        AllowUsers bilal admin
        
        Restrict Groups
        
        AllowGroups linux_admins
        
        Disable X11 Forwarding
        
        X11Forwarding no
        
        Disable Agent Forwarding
        
        AllowAgentForwarding no
        
        Disable TCP Forwarding
        
        AllowTcpForwarding no
    - - 🔑 User SSH Keys
        
        Current User:
        
        cat ~/.ssh/authorized_keys
        
        Example:
        
        /home/bilal/.ssh/authorized_keys
        
        Check Permissions:
        
        ls -la ~/.ssh/
        
        Secure Permissions:
        
        chmod 700 ~/.ssh
        
        chmod 600 ~/.ssh/authorized_keys
      - 🔑 Investigate All Users SSH Keys
        
        Command:
        
        find /home -name authorized_keys -exec cat {} \;
        
        Check:
        
        Unknown public keys
        
        Unknown users
        
        Suspicious comments
        
        Unauthorized access
    - - 🚨 Suspicious Indicators
        
        Unknown Public Key
        
        Example:
        
        ssh-rsa AAAAB3NzaC1yc2EAAA...
        
        Investigate:
        
        Who created it?
        
        When added?
        
        Which user owns it?
        
        Unknown User Account
        
        Check Users:
        
        cat /etc/passwd
        
        Find Recent Users:
        
        lastlog
        
        Check Account Creation:
        
        grep useradd /var/log/auth.log
        
        Unexpected SSH Access
        
        Check:
        
        last
        
        Check Login History:
        
        lastb
    - - 📄 Linux Authentication Logs
        
        Ubuntu / Debian:
        
        /var/log/auth.log
        
        RHEL / CentOS:
        
        /var/log/secure
      - Search SSH Events
        
        Successful Login:
        
        grep "Accepted" /var/log/auth.log
        
        Failed Login:
        
        grep "Failed password" /var/log/auth.log
        
        Invalid Users:
        
        grep "Invalid user" /var/log/auth.log
        
        Root Login Attempts:
        
        grep "root" /var/log/auth.log
    - - 🚨 Possible Compromise Scenario
        
        Detection
        
        ↓
        
        Check SSH Configuration
        
        ↓
        
        Check Root Login Settings
        
        ↓
        
        Review Authentication Logs
        
        ↓
        
        Investigate SSH Keys
        
        ↓
        
        Identify Suspicious Users
        
        ↓
        
        Remove Unauthorized Access
        
        ↓
        
        Harden SSH Configuration
        
        ↓
        
        Restart SSH Service
    - - Remove Suspicious Key
        
        Edit:
        
        nano ~/.ssh/authorized_keys
        
        Remove:
        
        Unknown public key
      - Disable Compromised User
        
        Lock Account:
        
        passwd -l username
        
        Remove User:
        
        userdel username
      - Kill Active Sessions
        
        Check:
        
        who
        
        Kill:
        
        pkill -u username
    - - 🛡 Centralized Logging
        
        Send SSH Logs To:
        
        SIEM
        
        Elastic Stack
        
        Splunk
        
        QRadar
      - 📊 Monitor:
        
        Failed SSH Attempts
        
        Brute Force Attacks
        
        Root Login Attempts
        
        New SSH Keys
        
        New User Creation
        
        Privilege Escalation
    - - 🔍 Audit Tools
        
        Lynis
        
        System Security Audit
        
        OpenSCAP
        
        Compliance Checking
        
        AIDE
        
        File Integrity Monitoring
        
        OSSEC / Wazuh
        
        Host Intrusion Detection
        
        Fail2ban
        
        Blocks brute force IPs
    - - ✅ Root SSH Login Disabled
      - ✅ Password Authentication Disabled
      - ✅ SSH Key Authentication Enabled
      - ✅ Authorized Keys Reviewed
      - ✅ Unknown Keys Removed
      - ✅ SSH Logs Monitored
      - ✅ SIEM Integration Enabled
      - ✅ File Permissions Correct
      - ✅ User Access Controlled
      - ✅ SSH Configuration Audited Regularly
- - - - Identify unauthorized user accounts
      - Detect attacker-created accounts
      - Verify privileged accounts
      - Investigate UID/GID abuse
      - Maintain account security baseline
    - - 📁 Main User Database
        
        /etc/passwd
      - 📖 Purpose of /etc/passwd
        
        Stores local user account information
        
        Contains:
        
        Username
        
        User ID (UID)
        
        Group ID (GID)
        
        User description
        
        Home directory
        
        Login shell
      - 🔍 View User Database
        
        Command:
        
        cat /etc/passwd
      - Example Output:
        
        root:x:0:0:root:/root:/bin/bash
        
        ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
        
        bilal:x:1001:1001:Bilal:/home/bilal:/bin/bash
        
        hacker123:x:1002:1002:Hacker:/home/hacker123:/bin/bash
    - - Format:
        
        username:x:UID:GID:comment:home:shell
      - Field Explanation:
        
        👤 Username
        
        Account login name
        
        Example:
        
        root
        
        ubuntu
        
        bilal
        
        hacker123
        
        🔑 Password Field
        
        Usually contains:
        
        x
        
        Means password hash stored in:
        
        /etc/shadow
        
        🆔 UID
        
        User ID number
        
        Important Values:
        
        UID 0
        
        Root privilege
        
        UID 1-999
        
        System accounts
        
        UID 1000+
        
        Normal users
        
        👥 GID
        
        Primary group ID
        
        🏠 Home Directory
        
        User personal directory
        
        🖥️ Login Shell
        
        User command environment
        
        Examples:
        
        /bin/bash
        
        /bin/sh
        
        /usr/sbin/nologin
    - - 🔎 Investigation Goal
        
        Find unknown accounts
        
        Find attacker-created users
        
        Find unauthorized access
      - Normal Users Example:
        
        root
        
        ubuntu
        
        bilal
      - Suspicious Examples:
        
        hacker123
        
        testadmin
        
        backup2
        
        tempuser
      - 🚨 Suspicious Indicators
        
        Unknown Username
        
        User does not match company inventory
        
        Recently Created Account
        
        Check:
        
        stat /etc/passwd
        
        Strange Home Directory
        
        Example:
        
        /tmp/hacker
        
        Strange Shell
        
        Example:
        
        /bin/bash
        
        For service accounts
    - - Enterprise Practice:
        
        Maintain authorized user inventory
      - Sources:
        
        Active Directory
        
        LDAP
        
        HR Identity Database
        
        IAM System
      - Compare:
        
        Linux Users
        
        VS
        
        Approved Users
    - - 🔥 Critical Security Check
      - Why UID 0 Matters:
        
        UID 0 = Root Privileges
      - Command:
        
        awk -F: '$3==0 {print $1}' /etc/passwd
      - Expected Result:
        
        root
      - Suspicious Result:
        
        root
        
        admin2
      - Meaning:
        
        admin2 has root-level privileges
        
        Possible:
        
        Misconfiguration
        
        Insider threat
        
        Compromised account
        
        Backdoor account
    - - Check All Users With UID:
        
        awk -F: '{print $1,$3}' /etc/passwd
      - Example:
        
        root 0
        
        ubuntu 1000
        
        bilal 1001
        
        admin2 0
      - Investigate:
        
        If UID 0 user is not approved
        
        Immediate investigation required
    - - Command:
        
        cat /etc/group
      - Important Privileged Groups:
        
        sudo
        
        wheel
        
        adm
        
        docker
      - Check User Membership:
        
        groups username
      - Example:
        
        groups bilal
      - Suspicious:
        
        hacker123 sudo
    - - Command:
        
        sudo -l -U username
      - Example:
        
        sudo -l -U bilal
      - Investigate:
        
        Full sudo access
        
        username ALL=(ALL) ALL
        
        Risk:
        
        Complete root access
    - - Command:
        
        sudo lastlog
      - Check Login Activity:
        
        last
      - Check Failed Login:
        
        lastb
      - Investigate:
        
        Unknown login times
        
        Unknown locations
        
        Failed password attempts
    - - Command:
        
        passwd -S username
      - Example:
        
        passwd -S bilal
      - Check:
        
        Locked account
        
        Active account
        
        Password expiration
    - - File:
        
        /etc/shadow
      - Contains:
        
        Password hashes
        
        Password aging
        
        Account expiration
      - Command:
        
        sudo cat /etc/shadow
      - Security:
        
        Only root should access
    - - Search Shell Accounts:
        
        cat /etc/passwd | grep bash
      - Investigate:
        
        Unexpected users with:
        
        /bin/bash
        
        /bin/sh
      - Service Accounts Should Use:
        
        /usr/sbin/nologin
    - - Step 1️⃣
        
        Collect User Evidence
        
        Commands:
        
        cat /etc/passwd
        
        cat /etc/group
        
        cat /etc/shadow
      - Step 2️⃣
        
        Identify Unauthorized Accounts
        
        Check:
        
        Unknown usernames
        
        UID 0 users
        
        Sudo access
      - Step 3️⃣
        
        Validate Identity
        
        Compare:
        
        Linux Accounts
        
        VS
        
        IAM Database
      - Step 4️⃣
        
        Contain Threat
        
        Actions:
        
        Disable Account
        
        usermod -L username
        
        Remove Sudo Access
        
        Remove User
        
        userdel username
      - Step 5️⃣
        
        Preserve Evidence
        
        Collect:
        
        /etc/passwd
        
        /etc/shadow
        
        /etc/group
        
        Authentication logs
    - - Ubuntu/Debian:
        
        /var/log/auth.log
      - RHEL/CentOS:
        
        /var/log/secure
      - Commands:
        
        grep sudo /var/log/auth.log
        
        grep "useradd" /var/log/auth.log
      - Detect:
        
        New account creation
        
        Privilege escalation
        
        Failed logins
    - - 🔐 Identity Management
        
        Active Directory
        
        LDAP
        
        FreeIPA
        
        IAM
      - 🔐 Privileged Access Management
        
        CyberArk
        
        BeyondTrust
        
        HashiCorp Vault
      - 🔐 Monitoring
        
        SIEM
        
        Splunk
        
        Elastic SIEM
        
        QRadar
      - 🔐 Compliance
        
        CIS Benchmark
        
        NIST SP 800-53
        
        ISO 27001
    - - ✅ Review /etc/passwd
      - ✅ Identify unknown users
      - ✅ Check UID 0 accounts
      - ✅ Review sudo privileges
      - ✅ Check group membership
      - ✅ Review authentication logs
      - ✅ Disable suspicious accounts
      - ✅ Preserve forensic evidence
      - ✅ Report findings to SOC
- - - - Identify unauthorized privilege escalation paths
      - Detect suspicious sudo permissions
      - Verify administrative access control
      - Prevent unauthorized root-level access
    - - 🔹 Definition
        
        Privilege escalation means gaining higher permissions than normally assigned
        
        Example:
        
        Normal User → Root User
        
        Developer → Administrator
      - 🔹 Types
        
        🟢 Vertical Privilege Escalation
        
        User → Root
        
        Example:
        
        Exploiting sudo misconfiguration
        
        🟡 Horizontal Privilege Escalation
        
        User A → User B
        
        Example:
        
        Accessing another employee account
      - 🔹 Enterprise Risk
        
        Unauthorized root access
        
        Data theft
        
        Malware installation
        
        Security control bypass
        
        System compromise
    - - 🔐 What is sudo?
        
        sudo = Super User Do
        
        Allows authorized users to execute commands with elevated privileges
      - 📂 Important Files
        
        /etc/sudoers
        
        Main sudo policy file
        
        /etc/sudoers.d/
        
        Additional sudo configuration files
        
        Enterprise recommended practice
        
        /etc/group
        
        Check administrative groups
        
        /etc/passwd
        
        User account information
    - - 🔍 Review Main Sudo Configuration
        
        Command:
        
        cat /etc/sudoers
        
        Purpose:
        
        Identify users with administrative privileges
        
        Look For:
        
        User ALL=(ALL) ALL
        
        Group %admin ALL=(ALL) ALL
        
        NOPASSWD rules
      - 🔍 Review Additional Sudo Rules
        
        Command:
        
        ls -la /etc/sudoers.d/
        
        Purpose:
        
        Find hidden or unauthorized sudo policies
        
        Investigate Files:
        
        cat /etc/sudoers.d/<filename>
        
        Check:
        
        Unknown users
        
        Suspicious commands
        
        Recently modified files
    - - 🛠️ visudo Command
        
        Command:
        
        sudo visudo
        
        Purpose:
        
        Safely edit sudoers file
        
        Advantages:
        
        ✅ Syntax checking
        
        ✅ Prevent configuration mistakes
        
        ✅ Lock file during editing
        
        ✅ Avoid breaking sudo access
      - 📝 Enterprise Practice
        
        Never edit directly:
        
        ❌ nano /etc/sudoers
        
        Use:
        
        ✅ visudo
      - 🔐 Recommended Custom Rules
        
        Create separate files:
        
        /etc/sudoers.d/admin_team
        
        Example:
        
        %linux_admins ALL=(ALL) ALL
    - - 🔍 Current User Permission Check
        
        Command:
        
        sudo -l
        
        Purpose:
        
        Shows allowed sudo commands
      - Example Output:
        
        User bilal may run:
        
        (root)
        
        /usr/bin/systemctl
        
        /usr/bin/journalctl
      - Investigate:
        
        Allowed commands
        
        Run-as users
        
        Password requirement
        
        Restricted commands
    - - 🔴 Check Unauthorized Sudo Access
        
        Look For:
        
        Unknown Users
        
        Example:
        
        attacker ALL=(ALL) ALL
        
        Unknown Groups
        
        Example:
        
        %hackers ALL=(ALL) ALL
        
        Suspicious Files:
        
        /etc/sudoers.d/
      - 🔴 Check NOPASSWD Privileges
        
        Command:
        
        grep NOPASSWD /etc/sudoers
        
        grep -R NOPASSWD /etc/sudoers.d/
        
        Risk:
        
        User can execute root commands
        
        Without entering password
        
        Example:
        
        bilal ALL=(ALL) NOPASSWD: ALL
        
        Impact:
        
        Full root access
      - 🔴 Check ALL Permissions
        
        Search:
        
        grep ALL /etc/sudoers
        
        Dangerous Example:
        
        user ALL=(ALL) ALL
        
        Meaning:
        
        User
        
        ↓
        
        Any Host
        
        ↓
        
        Any User
        
        ↓
        
        Any Command
    - - 🔎 Check File Permissions
        
        Command:
        
        ls -l /etc/sudoers
        
        Expected:
        
        -r--r----- root root
        
        Secure Permission:
        
        chmod 440 /etc/sudoers
      - 🔎 Check Ownership
        
        Command:
        
        stat /etc/sudoers
        
        Expected:
        
        Owner:
        
        root
        
        Group:
        
        root
      - 🔎 Check Modification Time
        
        Command:
        
        ls -la /etc/sudoers
        
        Investigate:
        
        Recent changes
        
        Unknown modifications
    - - 👤 Check User Accounts
        
        Commands:
        
        cat /etc/passwd
        
        awk -F: '$3==0 {print}' /etc/passwd
        
        Look For:
        
        Multiple UID 0 users
      - 👥 Check Administrative Groups
        
        Commands:
        
        getent group sudo
        
        getent group wheel
        
        Investigate:
        
        Unexpected members
      - 🔍 Check User Group Membership
        
        Command:
        
        groups username
        
        Example:
        
        groups bilal
    - - 🚨 Suspicious Signs
        
        Unknown sudo users
        
        UID 0 accounts
        
        NOPASSWD: ALL
        
        World writable sudo files
        
        Modified sudoers timestamps
        
        New users in admin groups
        
        Suspicious commands allowed
    - - Phase 1️⃣ Preparation
        
        Maintain:
        
        User inventory
        
        Sudo policy baseline
        
        Admin account list
      - Phase 2️⃣ Detection
        
        Collect:
        
        /etc/sudoers
        
        /etc/sudoers.d/
        
        sudo -l output
      - Phase 3️⃣ Analysis
        
        Compare:
        
        Current state
        
        Approved baseline
        
        Identify:
        
        Unauthorized changes
        
        Privilege abuse
      - Phase 4️⃣ Containment
        
        Remove unauthorized sudo access
        
        Disable compromised account
        
        Reset credentials
      - Phase 5️⃣ Recovery
        
        Restore correct sudo policy
        
        Verify permissions
        
        Monitor future changes
      - Phase 6️⃣ Documentation
        
        Record:
        
        User involved
        
        Time detected
        
        Changed file
        
        Commands allowed
        
        Remediation action
    - - ✅ Principle of Least Privilege
        
        Give minimum required access
      - ✅ Role Based Access Control (RBAC)
        
        Separate:
        
        Linux Admin
        
        Developer
        
        SOC Analyst
        
        Database Admin
      - ✅ Use Central Identity Management
        
        Examples:
        
        Active Directory
        
        LDAP
        
        FreeIPA
      - ✅ Enable Audit Logging
        
        Tools:
        
        auditd
        
        SIEM
        
        Splunk
        
        Elastic Security
      - ✅ Regular Sudo Review
        
        Monthly:
        
        Review sudoers
        
        Remove inactive admins
        
        Verify permissions
    - - ☑ Check /etc/sudoers
      - ☑ Check /etc/sudoers.d/
      - ☑ Run sudo -l
      - ☑ Review NOPASSWD rules
      - ☑ Review ALL permissions
      - ☑ Check UID 0 accounts
      - ☑ Check admin groups
      - ☑ Verify file ownership
      - ☑ Compare with security baseline
      - ☑ Document findings
- - - - 🔍 8️⃣ Process Investigation
        
        🎯 Purpose
        
        Detect malicious processes running in memory
        
        Identify malware, miners, backdoors, rootkits
        
        Find unauthorized applications
        
        Investigate suspicious user activity
        
        Determine process parent-child relationships
        
        🏢 Enterprise Investigation Approach
        
        1️⃣ Process Discovery
        
        Goal:
        
        Identify all running processes
        
        Understand normal vs abnormal activity
        
        Commands:
        
        ps aux
        
        Shows all running processes
        
        Displays:
        
        6 more items...
        
        ps -ef
        
        Enterprise process view
        
        Shows:
        
        5 more items...
        
        pstree
        
        Shows process hierarchy
        
        Parent-child relationship
        
        top
        
        Real-time process monitoring
        
        Shows:
        
        3 more items...
        
        htop
        
        Advanced interactive process viewer
        
        Features:
        
        3 more items...
        
        2️⃣ Analyze Running Processes
        
        🔎 Process Identification
        
        Check:
        
        Process Name
        
        Process Owner
        
        CPU Consumption
        
        Memory Consumption
        
        Execution Path
        
        Parent Process
        
        Network Connections
        
        Normal Examples:
        
        sshd
        
        /usr/sbin/sshd
        
        systemd
        
        /usr/lib/systemd/systemd
        
        nginx
        
        /usr/sbin/nginx
        
        cron
        
        /usr/sbin/cron
        
        Suspicious Examples:
        
        Hidden directories:
        
        /tmp/.hidden/malware
        
        Shared memory execution:
        
        /dev/shm/malware
        
        User hidden locations:
        
        /home/user/.cache/miner
        
        Fake system names:
        
        /usr/bin/systemd_fake
        
        Cryptocurrency miners:
        
        xmrig
        
        kinsing
        
        miner
        
        3️⃣ Find Process Executable Location
        
        🎯 Purpose:
        
        Identify where the running program came from
        
        Linux Method:
        
        /proc filesystem
        
        Command:
        
        ls -l /proc/PID/exe
        
        Example:
        
        ls -l /proc/1234/exe
        
        Normal Output:
        
        /proc/1234/exe -> /usr/bin/sshd
        
        Suspicious Output:
        
        /proc/1234/exe -> /tmp/.hidden/malware
        
        4️⃣ Investigate Process Information
        
        Check Process Directory:
        
        ls -la /proc/PID
        
        Important Files:
        
        /proc/PID/exe
        
        Actual executable file
        
        /proc/PID/cmdline
        
        Command used to start process
        
        /proc/PID/status
        
        Process information
        
        /proc/PID/environ
        
        Environment variables
        
        /proc/PID/fd
        
        Open files
        
        Example:
        
        cat /proc/1234/cmdline
        
        cat /proc/1234/status
        
        5️⃣ Process Owner Investigation
        
        Command:
        
        ps -fp PID
        
        Example:
        
        ps -fp 1234
        
        Check:
        
        Which user started process
        
        Is root running unknown program?
        
        Is normal user running privileged process?
        
        Suspicious:
        
        root 1234 /tmp/.hidden/miner
        
        6️⃣ Check Process Parent Relationship
        
        Command:
        
        pstree -p
        
        Purpose:
        
        Find malware spawned by legitimate processes
        
        Example:
        
        sshd
        
        bash
        
        python
        
        1 more item...
        
        Investigation:
        
        Why is python running?
        
        Who started malware?
        
        What is parent process?
        
        7️⃣ Check Network Connections
        
        Purpose:
        
        Find malware communicating externally
        
        Commands:
        
        ss -tulpn
        
        netstat -tulpn
        
        lsof -i
        
        Investigate:
        
        Unknown IP connections
        
        Strange listening ports
        
        Outbound connections
        
        Example:
        
        malware
        
        |
        
        |
        
        Internet
        
        |
        
        C2 Server
        
        8️⃣ Check Process File Hash
        
        Purpose:
        
        Verify executable integrity
        
        Commands:
        
        sha256sum /path/to/file
        
        Example:
        
        sha256sum /tmp/.hidden/malware
        
        Compare:
        
        Known good hash
        
        Threat intelligence database
        
        9️⃣ Check Deleted Running Malware
        
        Advanced Technique:
        
        Problem:
        
        Malware deletes itself after execution
        
        Check:
        
        ls -l /proc/PID/exe
        
        Example:
        
        /proc/1234/exe -> /tmp/malware (deleted)
        
        Meaning:
        
        Process still running in memory
        
        Response:
        
        Capture evidence
        
        Analyze memory
        
        Terminate process
        
        🔟 Memory Malware Investigation
        
        Tools:
        
        Volatility Framework
        
        LiME
        
        AVML
        
        Purpose:
        
        Analyze RAM dump
        
        Detect:
        
        Injected code
        
        Hidden processes
        
        Rootkits
        
        Malware
        
        1️⃣1️⃣ Process Termination
        
        Before Killing:
        
        Collect evidence
        
        Record:
        
        PID
        
        User
        
        Command
        
        Executable path
        
        Network connection
        
        Kill Process:
        
        kill PID
        
        Force Kill:
        
        kill -9 PID
        
        Example:
        
        kill -9 1234
        
        Enterprise Practice:
        
        Do not immediately kill
        
        First:
        
        Document
        
        Capture evidence
        
        Analyze
        
        1️⃣2️⃣ Automated Process Monitoring
        
        Enterprise Tools:
        
        SIEM
        
        Splunk
        
        Elastic Security
        
        QRadar
        
        EDR
        
        CrowdStrike
        
        SentinelOne
        
        Microsoft Defender
        
        Linux Security Tools:
        
        OSSEC
        
        Wazuh
        
        AIDE
        
        1️⃣3️⃣ Incident Response Workflow
        
        Step 1️⃣
        
        Detect suspicious process
        
        Step 2️⃣
        
        Collect information
        
        Commands:
        
        ps aux
        
        ps -ef
        
        ls -l /proc/PID/exe
        
        lsof -p PID
        
        Step 3️⃣
        
        Investigate:
        
        User
        
        Parent process
        
        Network activity
        
        File location
        
        Step 4️⃣
        
        Preserve Evidence
        
        Logs
        
        Memory
        
        Hash
        
        Step 5️⃣
        
        Containment
        
        Kill process
        
        Block IP
        
        Isolate host
        
        Step 6️⃣
        
        Eradication
        
        Remove malware
        
        Patch vulnerability
        
        Reset credentials
        
        Step 7️⃣
        
        Recovery
        
        Monitor system
        
        Verify clean state
        
        Step 8️⃣
        
        Lessons Learned
        
        Update detection rules
        
        Improve monitoring
        
        Document incident
    - - Never trust process name alone
      - Always verify:
        
        ✅ Executable location
        
        ✅ File hash
        
        ✅ Process owner
        
        ✅ Parent process
        
        ✅ Network behavior
        
        ✅ Startup persistence
        
        ✅ Logs
      - A process running from:
        
        /usr/bin
        
        Usually normal
        
        /tmp
        
        Suspicious
        
        /dev/shm
        
        Highly suspicious
        
        Hidden directories
        
        Investigate immediately
- - - - Goal
        
        Identify active network connections
        
        Detect suspicious communication
        
        Find unknown services
        
        Investigate possible compromise
        
        Trace malicious external connections
    - - Why Network Investigation Is Important
        
        Detect Command and Control C2 communication
        
        Identify malware callbacks
        
        Find unauthorized services
        
        Detect data exfiltration
        
        Identify attackers connections
      - Enterprise Investigation Questions
        
        Which ports are open?
        
        Which processes are using network ports?
        
        Which users started network services?
        
        Which external IP addresses are connected?
        
        Are unknown services running?
    - - Socket
        
        Endpoint for network communication
        
        Combination of IP address and port
        
        Used by applications to communicate
      - Socket Components
        
        Source IP
        
        Local system address
        
        Source Port
        
        Temporary communication port
        
        Destination IP
        
        Remote system address
        
        Destination Port
        
        Remote service port
        
        Protocol
        
        TCP
        
        UDP
    - - Command
        
        ss -tunap
      - Full Command Explanation
        
        s
        
        Show socket information
        
        t
        
        TCP connections
        
        u
        
        UDP connections
        
        n
        
        Do not resolve DNS names
        
        Show numeric IP addresses
        
        a
        
        Show all sockets
        
        Listening and established connections
        
        p
        
        Show process information
        
        Display PID and application name
      - What This Command Shows
        
        Current active connections
        
        Established sessions
        
        Source IP
        
        Destination IP
        
        Port numbers
        
        Running process
        
        Process ID PID
        
        User owning process
      - Example Output
        
        tcp
        
        192.168.1.10:45000
        
        8.8.8.8:443
        
        ESTABLISHED
        
        firefox PID 2345
      - Investigation Questions
        
        Is destination IP trusted?
        
        Is process expected?
        
        Is user authorized?
        
        Is port normal?
        
        Is connection encrypted?
    - - Command
        
        ss -tulnp
      - Full Command Explanation
        
        t
        
        TCP sockets
        
        u
        
        UDP sockets
        
        l
        
        Listening ports only
        
        n
        
        Numeric output
        
        No DNS lookup
        
        p
        
        Show process details
      - Purpose
        
        Find services waiting for connections
        
        Identify exposed applications
        
        Detect unauthorized servers
      - Example
        
        0.0.0.0:8080
        
        Meaning
        
        0.0.0.0
        
        Listening on all network interfaces
        
        8080
        
        Application port
      - Investigation
        
        Check service owner
        
        Check process
        
        Check configuration
        
        Check package installation
    - - Common Legitimate Ports
        
        22
        
        SSH Remote Administration
        
        80
        
        HTTP Web Server
        
        443
        
        HTTPS Secure Web Server
        
        53
        
        DNS Service
        
        25
        
        SMTP Mail Service
        
        3306
        
        MySQL Database
        
        5432
        
        PostgreSQL Database
      - Suspicious Port Examples
        
        Unknown high ports
        
        Random services
        
        Unexpected external communication
        
        Cryptocurrency mining ports
        
        Remote access tools
    - - Find Process Information
        
        Command
        
        ps aux
        
        Check
        
        Process name
        
        User
        
        PID
        
        CPU usage
        
        Memory usage
      - Combine Network and Process
        
        Command
        
        ss -tunap
        
        Example
        
        tcp
        
        0.0.0.0:8080
        
        java PID 4456
        
        Investigation
        
        Is Java application authorized?
        
        Which user owns it?
        
        Where is application installed?
    - - Step 1
        
        Identify Port
        
        Example
        
        0.0.0.0:8080
      - Step 2
        
        Find Process
        
        Command
        
        ss -tulnp
      - Step 3
        
        Check Process Details
        
        Command
        
        ps -fp PID
      - Step 4
        
        Locate Binary
        
        Command
        
        ls -l /proc/PID/exe
      - Step 5
        
        Check Package
        
        Ubuntu
        
        dpkg -S binary_name
        
        RHEL
        
        rpm -qf binary_name
      - Step 6
        
        Check Logs
        
        Commands
        
        journalctl
        
        /var/log/
      - Step 7
        
        Decide Action
        
        Legitimate service
        
        Investigate further
        
        Stop service
    - - Identify External Connections
        
        Command
        
        ss -tunap
      - Check
        
        Unknown destination IP
        
        Foreign countries
        
        Suspicious domains
        
        Repeated connections
      - IP Information
        
        WHOIS lookup
        
        Threat intelligence lookup
        
        Firewall logs
    - - Phase 1
        
        Detect
        
        Tools
        
        ss
        
        netstat
        
        lsof
      - Phase 2
        
        Analyze
        
        Collect
        
        IP address
        
        Port number
        
        Process ID
        
        User account
        
        Timestamp
      - Phase 3
        
        Investigate
        
        Check
        
        Process history
        
        Binary location
        
        Logs
        
        User activity
      - Phase 4
        
        Containment
        
        Actions
        
        Block IP
        
        Stop process
        
        Disable account
        
        Isolate server
      - Phase 5
        
        Recovery
        
        Remove malware
        
        Patch vulnerability
        
        Restart services
        
        Monitor
    - - lsof
        
        Command
        
        lsof -i
        
        Purpose
        
        Show network files and processes
      - netstat
        
        Command
        
        netstat -tulnp
        
        Purpose
        
        Legacy network investigation tool
      - tcpdump
        
        Command
        
        tcpdump -i eth0
        
        Purpose
        
        Capture network packets
      - nmap
        
        Command
        
        nmap localhost
        
        Purpose
        
        Port scanning and service discovery
    - - SIEM Integration
        
        Collect
        
        Network connections
        
        Firewall logs
        
        IDS alerts
        
        Authentication logs
      - Tools
        
        Elastic SIEM
        
        Splunk
        
        QRadar
        
        Wazuh
      - Detection Examples
        
        Unexpected SSH connection
        
        Unknown outbound traffic
        
        New listening service
        
        Malware communication
    - - Regular Auditing
        
        Monitor open ports
        
        Review services
        
        Remove unnecessary applications
      - Hardening
        
        Disable unused services
        
        Configure firewall
        
        Use SELinux/AppArmor
        
        Apply patches
      - Documentation
        
        Maintain service inventory
        
        Record approved ports
        
        Track application owners
- - - - 1️⃣ Objective of File System Investigation
        
        🎯 Purpose
        
        Identify attacker files
        
        Detect malware persistence
        
        Find unauthorized scripts
        
        Discover web shells
        
        Locate modified system binaries
        
        Collect forensic evidence
        
        🏢 Enterprise Goal
        
        Protect critical servers
        
        Identify compromise timeline
        
        Support SOC investigation
        
        Preserve evidence
        
        Perform root cause analysis
      - 2️⃣ Common Attacker Storage Locations
        
        📁 /tmp Directory
        
        🔎 Why attackers use it
        
        Writable by normal users
        
        Temporary storage location
        
        Often ignored by administrators
        
        🔍 Investigation Commands
        
        ls -la /tmp
        
        find /tmp -type f
        
        find /tmp -type f -ls
        
        🚩 Suspicious Examples
        
        /tmp/update.sh
        
        /tmp/backdoor
        
        /tmp/install.sh
        
        /tmp/.hidden_binary
        
        📁 /var/tmp Directory
        
        🔎 Why attackers use it
        
        Files survive reboot
        
        Longer temporary storage
        
        Used for malware persistence
        
        🔍 Investigation Commands
        
        ls -la /var/tmp
        
        find /var/tmp -type f
        
        🚩 Suspicious Files
        
        Unknown binaries
        
        Unknown scripts
        
        Hidden files
        
        Recently created files
        
        📁 /dev/shm Directory
        
        🔎 Description
        
        Shared memory filesystem
        
        Stored in RAM
        
        No disk persistence
        
        🔎 Why attackers use it
        
        Fileless malware techniques
        
        Malware execution
        
        Avoid disk detection
        
        🔍 Investigation Commands
        
        ls -la /dev/shm
        
        find /dev/shm -type f
        
        🚩 Suspicious Indicators
        
        Executable files
        
        Unknown scripts
        
        ELF binaries
        
        Hidden files
      - 3️⃣ File Permission Investigation
        
        🔍 Check Permissions
        
        ls -la /tmp
        
        ls -la /var/tmp
        
        ls -la /dev/shm
        
        🚩 Suspicious Permissions
        
        World Writable Files
        
        Example
        
        -rwxrwxrwx
        
        Executable Files
        
        Example
        
        -rwx------
        
        Hidden Files
        
        Example
        
        .update
        
        .config
        
        🔧 Find World Writable Files
        
        find / -perm -002 -type f 2>/dev/null
        
        🔧 Find Executable Temporary Files
        
        find /tmp -type f -executable
      - 4️⃣ Recently Modified Files Investigation
        
        🎯 Purpose
        
        Find attacker activity
        
        Identify newly dropped files
        
        Build attack timeline
        
        🔍 Command
        
        find / -mtime -1 2>/dev/null
        
        📘 Meaning
        
        -mtime
        
        Modification time
        
        -1
        
        Modified within last 24 hours
        
        2>/dev/null
        
        Hide permission errors
        
        Examples
        
        find /etc -mtime -1
        
        find /var -mtime -1
        
        find /home -mtime -1
      - 5️⃣ Advanced File Timeline Investigation
        
        ⏰ Search by Minutes
        
        Modified last 60 minutes
        
        find / -mmin -60 2>/dev/null
        
        📅 Search Specific Days
        
        find / -mtime -7 2>/dev/null
        
        🔍 Search Recently Created Files
        
        find / -ctime -1 2>/dev/null
        
        🔍 Search Recently Accessed Files
        
        find / -atime -1 2>/dev/null
      - 6️⃣ Detect Suspicious Scripts
        
        🔎 Search Shell Scripts
        
        find / -name "*.sh" 2>/dev/null
        
        🔎 Search Python Malware
        
        find / -name "*.py" 2>/dev/null
        
        🔎 Search Executable Files
        
        find / -type f -executable 2>/dev/null
        
        🚩 Review Suspicious Content
        
        cat suspicious_file
        
        less suspicious_file
        
        strings suspicious_binary
      - 7️⃣ Detect Hidden Attacker Files
        
        🔍 Search Hidden Files
        
        find /tmp -name ".*"
        
        find /dev/shm -name ".*"
        
        🚩 Common Attacker Names
        
        .backdoor
        
        .hidden
        
        .config
        
        .ssh
      - 8️⃣ Malware Binary Investigation
        
        🔍 File Type Check
        
        file /tmp/update.sh
        
        Example Output
        
        ELF 64-bit executable
        
        🔍 Hash Collection
        
        md5sum suspicious_file
        
        sha256sum suspicious_file
        
        🔍 Binary Analysis
        
        strings suspicious_file
        
        🔍 Check Execution
        
        ps aux | grep suspicious_file
      - 9️⃣ Process and File Relationship
        
        🎯 Goal
        
        Find running malware
        
        🔍 Running Processes
        
        ps aux
        
        🔍 Process Tree
        
        pstree -p
        
        🔍 Open Files
        
        lsof
        
        🔍 Find Process Executable
        
        ls -l /proc/PID/exe
        
        Example
        
        ls -l /proc/1234/exe
      - 🔟 Persistence Investigation
        
        🔍 Check Cron Jobs
        
        crontab -l
        
        ls -la /etc/cron*
        
        🔍 Check Systemd Services
        
        systemctl list-units
        
        ls /etc/systemd/system/
        
        🔍 Check Startup Files
        
        cat /etc/rc.local
        
        🔍 Check SSH Keys
        
        find /home -name authorized_keys
      - 1️⃣1️⃣ Enterprise Forensic Collection
        
        📦 Preserve Evidence
        
        Do not delete files immediately
        
        Create forensic copy
        
        🔐 Hash Evidence
        
        sha256sum file
        
        📂 Copy Evidence
        
        cp suspicious_file /evidence/
        
        📝 Document
        
        File path
        
        Owner
        
        Permissions
        
        Timestamp
        
        Hash value
      - 1️⃣2️⃣ SOC Analyst Investigation Workflow
        
        🚨 Alert Received
        
        ↓
        
        🔍 Identify Host
        
        ↓
        
        📂 Investigate File System
        
        Check:
        
        /tmp
        
        /var/tmp
        
        /dev/shm
        
        ↓
        
        ⏰ Timeline Analysis
        
        find commands
        
        ↓
        
        🧬 Malware Analysis
        
        file
        
        strings
        
        hash
        
        ↓
        
        🔎 Persistence Check
        
        cron
        
        systemd
        
        SSH keys
        
        ↓
        
        🛡️ Containment
        
        Isolate system
        
        Block attacker access
        
        ↓
        
        🔄 Recovery
        
        Remove malware
        
        Patch vulnerability
        
        Monitor system
      - 1️⃣3️⃣ Enterprise Security Tools Integration
        
        🛡️ SIEM
        
        Elastic SIEM
        
        Splunk
        
        QRadar
        
        🔍 EDR
        
        CrowdStrike
        
        SentinelOne
        
        Microsoft Defender
        
        🧪 Forensics Tools
        
        Autopsy
        
        Volatility
        
        Sleuth Kit
        
        🔐 Integrity Monitoring
        
        AIDE
        
        Tripwire
        
        OSSEC
      - 1️⃣4️⃣ Important Investigation Commands Summary
        
        📌 Directory Check
        
        ls -la /tmp
        
        ls -la /var/tmp
        
        ls -la /dev/shm
        
        📌 Modified Files
        
        find / -mtime -1 2>/dev/null
        
        📌 Permissions
        
        find / -perm -002 -type f 2>/dev/null
        
        📌 Processes
        
        ps aux
        
        pstree
        
        📌 Open Files
        
        lsof
        
        📌 Hash
        
        sha256sum
      - 1️⃣5️⃣ Red Flags (Compromise Indicators)
        
        🚩 Unknown files in /tmp
        
        🚩 Executable files in /dev/shm
        
        🚩 Recent file modifications
        
        🚩 Hidden scripts
        
        🚩 Unknown cron jobs
        
        🚩 Unknown systemd services
        
        🚩 Unauthorized SSH keys
        
        🚩 Modified system binaries
        
        🚩 Suspicious network connections
- - - - crontab -l
    - - sudo crontab -l
    - - ls -la /etc/cron*
- - - - /var/log/auth.log
    - - /var/log/secure