domains / families / security / analyzing-linux-system-artifacts

analyzing-linux-system-artifacts

separate

Examine Linux system artifacts (auth logs, cron/systemd persistence,

When to use

• When investigating a compromised Linux server or workstation
• For identifying persistence mechanisms (cron, systemd, SSH keys)
• When tracing user activity through shell history and authentication logs
• During incident response to determine the scope of a Linux-based breach
• For detecting rootkits, backdoors, and unauthorized modifications

Skill page

Source