Linux log triage

When a Linux box is breached, the logs usually told you first.

Start with failed logins, a wall of failures followed by one success is a brute-force that worked. Pull the successful logins and the source addresses.

Check for new users and sudo usage that shouldn't be there. Then, once you have the attacker's address, grep it across every log to trace their whole path.

The story is in the logs, you just have to read it.

# los comandos

analyst@victim:~# grep 'Failed password' /var/log/auth.log | wc -lcopiar

4127

analyst@victim:~# grep 'Accepted' /var/log/auth.log | tail -3copiar

Accepted password for root from 185.244.x.x port 51002 ssh2

analyst@victim:~# grep -Ei 'useradd|usermod|sudo:' /var/log/auth.log | tailcopiar

useradd[9931]: new user: name=svc-update, uid=0 <-- backdoor

analyst@victim:~# grep -r '185.244.x.x' /var/log/ 2>/dev/null | wc -lcopiar

Linux log triage

# los comandos

# comandos relacionados · DFIR