search
githubEdit

Host Compromise Assessment

hashtag
Introduction

Linux Host Compromise Assessment involves systematically evaluating a Linux system to determine if it has been compromised and to identify the scope of any potential breach. This process typically includes analysing key system logs, such as /var/log/auth.log or /var/log/secure, to detect unauthorised access attempts, suspicious logins, or privilege escalation activities. Analysts also inspect running processes and services for unusual activity, such as unknown or malicious binaries, rogue processes, or unexpected network connections. File integrity checks are performed to detect changes to critical system files or configurations, while cron jobs and startup scripts are examined for persistence mechanisms.

Advanced assessments incorporate memory forensics and network traffic analysis to identify malware, rootkits, or data exfiltration attempts. Tools like chkrootkit, rkhunter, and forensic utilities such as Volatility can be employed to detect signs of stealthy threats. Security frameworks like MITRE ATT&CK provide a structured approach for mapping observed behaviours to adversarial tactics and techniques. The goal of a Linux Host Compromise Assessment is to identify indicators of compromise (IOCs), assess the extent of the intrusion, and develop remediation strategies to secure the host and prevent future incidents.

The following is a set of commands that can be used to triage and help determine the state of a potentially compromised host. The commands are designed to quickly grab the relevant information that will allow the investigator to determine whether the activity warrants deeper analysis or escalation.

Note: Depending on the distro of the system being investigated, in certain situations, the commands present may not return the desired information; at that point, you will have to customise the queries to the distro being investigated.

hashtag
Collect General Information

Description: Display the current date and time. Verify the timezone.
Command: date
Example: date #Displaying the Current Date and Time
date +"%Y-%m-%d %H:%M:%S" #Displaying the Date in a Specific Format
sudo date -s "2025-01-14 13:53:00" #Setting the System Date and Time
date -u #Displaying the Date in UTC
Description: Timezone information
Command: cat
Example: cat /etc/timezone
Description: System information
Command: uname
Example: uname -a

hashtag
Review Activities

Investigating the executed commands of a user could give some context about an incident.

hashtag
Hunting Unusual Files

hashtag
Logon activities

Review the logon activities of the compromised host.

hashtag
Review Processes

Review all running processes; the following command could identify potentially malicious processes

hashtag
Installed Programs

hashtag
File Investigation

hashtag
Persistent Mechanisms

A persistent mechanism is a method used by attackers to maintain access to a compromised system across reboots or to ensure their malicious activities persist over time. Below is a potential list of the places attackers might add or modify to deploy their persistent access.

hashtag
Review Account

Review user account information and activity on the system to identify potentially active user accounts, detect anomalies in user account configurations, find files belonging to non-existent users, extract password hashes for analysis, examine group information for privilege analysis, review sudo configurations for potential privilege escalation, investigate SSH authentication keys and known hosts for unauthorized access, and analyze recently used files for user activity.

hashtag
Persistent Areas of Interest

hashtag
Webshell

Identifying potential webshell installations or modifications

hashtag
Cron Tasks

Identify any scheduled tasks or suspicious activities that may have been configured to execute at specific times

hashtag
Services and Systemd

Examine systemd configurations and unit files to identify any modifications or suspicious configurations that may have been made to services or startup processes.

hashtag
SSH Daemon

Examine the configuration of the SSH daemon and related resource files

hashtag
Login Shell

Examine login shell configurations and scripts responsible for system initialization and startup processes.

hashtag
rc scripts

RC scripts responsible for system initialization and startup processes.

hashtag
Infected Binaries

Uncover recently modified files that may indicate unauthorised activity or compromise.

hashtag
Pluggable Authentication Modules (PAM)

hashtag
Message of the Day (MOTD)

“motd” stands for “message of the day”. These scripts may contain important system status updates, notifications, or potentially malicious content inserted by attackers.

hashtag
Unusual System Resources

These commands provide information about system uptime, memory usage, and disk space usage, which can help identify abnormal behaviour such as high resource consumption, potential denial of service attacks, or disk space exhaustion.

hashtag
Hunting Rootkit

hashtag
To hunt via 3rd party software

hashtag
Hunting and Check Files and Processes

hashtag
Disk imaging using dd

Collecting digital disk image of the Linux system is essential to perform disk analysis offline. This activity is required to find suspicious files and folders, recover files and extract artifacts (triage) from the disk.

hashtag
References

PreviousCommandline BasicsNextDFIR Workflow Cheatsheet

Last updated