Linux Forensics¶
Artifacts and log sources on Linux hosts — servers, containers hosts, and the occasional workstation. Start from the question; the mechanics are on each page.
Question → where to look¶
| Question | Primary | Also check |
|---|---|---|
| Who logged in, from where, and what did they type? | Auth & history — auth.log/secure, wtmp/btmp, shell history |
journald, auditd execve |
| How does the attacker survive reboot? | Persistence — cron, systemd, SSH keys, profiles, PAM, modules | package-integrity check (rpm -Va/dpkg --verify) |
| When was this file created/modified — was it timestomped? | Filesystem & timestamps — MACB, ctime, ext4 birth | Sleuth Kit timeline, ext4 journal |
| What ran / what's running / what's listening? | Logs, processes & triage — ps, ss, /proc, auditd |
deleted-but-open binaries in /proc |
| What was installed and when? | Logs & triage — dpkg.log/apt history/yum.log |
package integrity |
| Web server on Linux got popped | Web shell playbook | Apache/Nginx logs, logs & triage |
| Collect it all | UAC / CatScale / Velociraptor | Imaging |
Pages¶
- Auth & history — auth logs, wtmp/btmp/lastlog, shell history, cross-checking tampered logs
- Persistence — cron, systemd, profiles, SSH keys, PAM, LD_PRELOAD, modules; package-integrity checks
- Filesystem & timestamps — MACB, ctime timestomp detection, hidden/setuid files, deleted-but-open, ext4 journal
- Logs, processes & triage — log map, running-state snapshot, process triage, one-shot script
How Linux differs from Windows (for the Windows-heavy analyst)¶
The investigative method is the same — timeline, pivot on keys, cross-check sources — but the artifacts differ. There's no registry (config is text files under /etc), no Prefetch/Amcache (execution evidence comes from auditd, shell history, and package logs, if any), no $MFT $FILE_NAME second timestamp set (so ctime is your timestomp detector instead), and logs are plain text or journald rather than EVTX. The biggest variable is what logging was enabled: with auditd you have Sysmon-grade execution data; without it, you're reconstructing from history files, journald, and the file system. Note the logging posture in every report.
Order of work (live host)¶
- Snapshot volatile state first —
ps,ss,/proc,lsof,lsmod(logs & triage) — before it changes or a memory image reboots the box. - Auth story — who got in.
- Persistence sweep — where they hid, plus package integrity.
- File-system timeline — what changed, when.
- Correlate; escalate to the matching playbook if it's more than one host.
Adding a page here
python new.py linux/<name> -t artifact (or -t concept) — it appears in the sidebar automatically.