Host Compromise Assessment
Introduction
Linux Host Compromise Assessment involves systematically evaluating a Linux system to determine if it has been compromised and to identify the scope of any potential breach. This process typically includes analysing key system logs, such as /var/log/auth.log or /var/log/secure, to detect unauthorised access attempts, suspicious logins, or privilege escalation activities. Analysts also inspect running processes and services for unusual activity, such as unknown or malicious binaries, rogue processes, or unexpected network connections. File integrity checks are performed to detect changes to critical system files or configurations, while cron jobs and startup scripts are examined for persistence mechanisms.
Advanced assessments incorporate memory forensics and network traffic analysis to identify malware, rootkits, or data exfiltration attempts. Tools like chkrootkit, rkhunter, and forensic utilities such as Volatility can be employed to detect signs of stealthy threats. Security frameworks like MITRE ATT&CK provide a structured approach for mapping observed behaviours to adversarial tactics and techniques. The goal of a Linux Host Compromise Assessment is to identify indicators of compromise (IOCs), assess the extent of the intrusion, and develop remediation strategies to secure the host and prevent future incidents.
The following is a set of commands that can be used to triage and help determine the state of a potentially compromised host. The commands are designed to quickly grab the relevant information that will allow the investigator to determine whether the activity warrants deeper analysis or escalation.
Note: Depending on the distro of the system being investigated, in certain situations, the commands present may not return the desired information; at that point, you will have to customise the queries to the distro being investigated.
Collect General Information
Description: Display the current date and time. Verify the timezone.
Command: date
Example: date #Displaying the Current Date and Time
date +"%Y-%m-%d %H:%M:%S" #Displaying the Date in a Specific Format
sudo date -s "2025-01-14 13:53:00" #Setting the System Date and Time
date -u #Displaying the Date in UTCDescription: Timezone information
Command: cat
Example: cat /etc/timezoneDescription: System information
Command: uname
Example: uname -aReview Activities
Investigating the executed commands of a user could give some context about an incident.
Hunting Unusual Files
Logon activities
Review the logon activities of the compromised host.
Review Processes
Review all running processes; the following command could identify potentially malicious processes
Installed Programs
File Investigation
Persistent Mechanisms
A persistent mechanism is a method used by attackers to maintain access to a compromised system across reboots or to ensure their malicious activities persist over time. Below is a potential list of the places attackers might add or modify to deploy their persistent access.
Review Account
Review user account information and activity on the system to identify potentially active user accounts, detect anomalies in user account configurations, find files belonging to non-existent users, extract password hashes for analysis, examine group information for privilege analysis, review sudo configurations for potential privilege escalation, investigate SSH authentication keys and known hosts for unauthorized access, and analyze recently used files for user activity.
Persistent Areas of Interest
Webshell
Identifying potential webshell installations or modifications
Cron Tasks
Identify any scheduled tasks or suspicious activities that may have been configured to execute at specific times
Services and Systemd
Examine systemd configurations and unit files to identify any modifications or suspicious configurations that may have been made to services or startup processes.
SSH Daemon
Examine the configuration of the SSH daemon and related resource files
Login Shell
Examine login shell configurations and scripts responsible for system initialization and startup processes.
rc scripts
RC scripts responsible for system initialization and startup processes.
Infected Binaries
Uncover recently modified files that may indicate unauthorised activity or compromise.
Pluggable Authentication Modules (PAM)
Message of the Day (MOTD)
“motd” stands for “message of the day”. These scripts may contain important system status updates, notifications, or potentially malicious content inserted by attackers.
Unusual System Resources
These commands provide information about system uptime, memory usage, and disk space usage, which can help identify abnormal behaviour such as high resource consumption, potential denial of service attacks, or disk space exhaustion.
Hunting Rootkit
To hunt via 3rd party software
Hunting and Check Files and Processes
Disk imaging using dd
Collecting digital disk image of the Linux system is essential to perform disk analysis offline. This activity is required to find suspicious files and folders, recover files and extract artifacts (triage) from the disk.
References
Last updated