Linux forensic artefacts: logs, history and persistence
On a compromised Linux server you examine login records, shell history, scheduled jobs, services and SSH keys to reveal what the attacker did.
Level 201 · 16 lessons · 15 practice labs
Lessons
Accounts and logins
- /etc/passwd, shadow and group: new or changed accounts
- auth.log and secure: SSH logins and sudo use
- wtmp and btmp records with last, lastb and lastlog
- authorized_keys, known_hosts and SSH configuration
- Short task: find the account and time of the attacker’s first login
Commands and files
- Shell history: .bash_history and its removal
- /tmp, /dev/shm and hidden dot files
- Files changed in a time window with find
- Changed system files with dpkg --verify and rpm -Va
- Short task: list the tools the attacker downloaded and where
Persistence and system logs
- Persistence traces in cron and at
- Persistence with systemd services and timers
- Persistence via .bashrc, profile and ld.so.preload
- Reading the system journal as evidence with journalctl
- Web shell traces in the web server directory
- Capstone: reconstruct the attack story from a compromised web server image
Practice labs
- Find the newly added account: Identify the account added later or with changed privileges from the /etc/passwd and shadow files.
- Extract SSH logins and sudo use: Order the successful SSH logins and the sudo commands run from auth.log.
- Find the first account entered and the time: Combine wtmp, btmp and auth.log records to prove the account, address and time of the first unauthorised login.
- Audit the authorized_keys files: List every user's authorized_keys file and mark the unrecognised key.
- Work out where connections went from known_hosts: Work out from known_hosts and shell history which machines this server made SSH connections to.
- Find the altered SSH configuration: Find the weakening changes in sshd_config and its drop-in files and give their change times.
- Read the commands from shell history: List the downloaded tools and commands run from the .bash_history file.
- Find the files changed in a time window: List the files changed within two hours of the incident with find and separate those in /tmp and /dev/shm.
- Verify altered system files: Find the system files not matching package contents with dpkg --verify and prove by hash which was replaced.
- Audit the cron and at entries: List every user's cron entries and mark the suspicious one.
- systemd service and timer traces: Find the systemd unit added later and write the file it runs and its creation time.
- Shell start-up files and ld.so.preload: Find the persistence traces in .bashrc, profile and ld.so.preload and explain when each is triggered.
- Read the incident hour with journalctl: Extract the service restarts and errors at the incident hour from the system journal.
- Find the web shell trace in the web directory: Find the script added later to the web root and show its first call in the access log.
- The incident story from a web server image: From Turnalı Perakende's prepared server image tell the entry, tool download and persistence steps in time order.
About this course
On a compromised Linux server you examine login records, shell history, scheduled jobs, services and SSH keys to reveal what the attacker did.
What you will learn
- Accounts and logins
- Commands and files
- Persistence and system logs
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.