Linux Live Analysis

Linux powers most of the world’s servers because it’s reliable, secure, and performs well. This includes everything from websites to big cloud services. Most of the fastest computers in the world run on Linux because they can handle huge amounts of data and complex tasks. Also, a large chunk of the internet is hosted on Linux servers.

Because Linux is used in many important places, it’s a prime target for hackers. From a security point of view, we need to be more vigilant about the latest threats and attacks, as threat actors are gaining more capabilities with time.

Incident Scenario

You are a SOC Analyst at Cybertees Pvt Ltd. Your manager gave you a Linux machine that the Red Team compromised. The Red Team has planted various footprints on the machine for you to investigate.

Your task is to perform live forensics on this Linux server to determine the level of damage and identify the attack footprints.

Learning Objective

In this room, we will cover the following learning objectives:

• Learn the importance of creating a system profile.
  
• How to perform live forensics in Linux.
• How to examine the running processes.
• How to investigate footprints on the disk.

Prerequisites

This room expects users to have a basic understanding of forensics and the Linux environment. The following rooms provide the basic knowledge needed to move forward in this room:

• Linux Fundamentals
  
• Osquery Basics
  

Let’s dive in.