Cheat sheet
Linux artefacts
Where to look for traces of an intrusion on a Linux server: logs, persistence and user activity. The basics are in Linux essentials.
Logs
| File | Contents |
|---|---|
| /var/log/auth.log | Authentication, sudo and SSH (Debian, Ubuntu) |
| /var/log/secure | Authentication, sudo and SSH (RHEL, Fedora) |
| /var/log/syslog | General system messages (Debian, Ubuntu) |
| /var/log/messages | General system messages (RHEL, Fedora) |
| /var/log/wtmp | Logon history, read with last |
| /var/log/btmp | Failed logons, read with lastb |
| /var/log/lastlog | Last logon of each account, read with lastlog |
| /var/log/audit/audit.log | Audit events (auditd) |
| journalctl | systemd journal (services, kernel, logons) |
grep "Accepted" /var/log/auth.log # successful SSH logons
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn
last -f /var/log/wtmp ; lastb | head # logons and failures
journalctl -u ssh --since "2026-11-01" --until "2026-11-02"
Persistence
| Location | Mechanism |
|---|---|
| /etc/crontab, /etc/cron.d/ | System scheduled tasks |
| /var/spool/cron/ | Users' scheduled tasks (crontab -l) |
| /etc/systemd/system/ | Added systemd services and timers |
| ~/.bashrc, ~/.profile | Commands run when a shell opens |
| ~/.ssh/authorized_keys | Keys allowed to log in over SSH |
| /etc/ld.so.preload | Library loaded into every process |
| /etc/rc.local | Script run at boot (older mechanism) |
| /etc/passwd (UID 0) | Extra account with root rights |
Activity traces
| Item | Contents |
|---|---|
| ~/.bash_history | Commands typed in bash |
| ~/.viminfo | Files opened and searches made in vim |
| ~/.ssh/known_hosts | Hosts the account connected to over SSH |
| /tmp, /dev/shm | World-writable folders, often used to drop tools |
| /proc/<pid>/exe | Link to a process's executable, even if deleted from disk |
| /proc/<pid>/cmdline | Full command line of a process |
ls -la /proc/*/exe 2>/dev/null | grep deleted # processes started from a deleted file find / -xdev -newermt "2026-11-01" -type f 2>/dev/null | grep -v ^/proc # files changed since a date awk -F: '$3 == 0' /etc/passwd # accounts with UID 0
Empty history?An empty ~/.bash_history, one linked to /dev/null, or an unset HISTFILE variable is a clue in itself: the attacker wanted to cover their tracks.