Listen to this Post
Introduction:
In an era of sophisticated cyber threats, the Australian Signals Directorate (ASD) has highlighted the critical need for robust system monitoring after security incidents. Advanced adversaries often maintain persistence within compromised environments, making post-intrusion detection a cornerstone of modern cybersecurity. This guide provides a technical deep dive into the forensic techniques and commands necessary to uncover hidden malware, unauthorized access, and persistence mechanisms on both Linux and Windows systems, transforming you from a passive user into an active threat hunter.
Learning Objectives:
- Master essential command-line forensic commands for Linux and Windows to identify rogue processes and unauthorized users.
- Learn to analyze system persistence mechanisms, including scheduled tasks, services, and cron jobs, where threats often hide.
- Develop the skills to scrutinize network connections and system logs for evidence of lateral movement and data exfiltration.
You Should Know:
1. Analyzing Running Processes and Identifying Anomalies
The first step in any forensic investigation is to get a snapshot of what is currently executing on your system. Attackers often run processes that mimic legitimate system ones, making close inspection critical.
Step‑by‑step guide explaining what this does and how to use it.
On Linux:
List all processes with full command lines and a hierarchical view ps auxfw Look for unusual parent-child relationships. For example, a bash shell spawned by a web server process could be suspicious. Use top or htop for an interactive, real-time view. Sort by CPU or memory usage to identify resource hogs. htop Check for processes hidden from common tools using a rootkit hunter sudo rkhunter --check
The `ps auxfw` command is vital. The `f` option provides a process tree, revealing if a benign-looking process is spawning malicious children. The `aux` options show all processes, the owning user, and resource utilization.
On Windows (PowerShell):
Get a detailed list of processes including the parent process ID (PPID) Get-WmiObject Win32_Process | Select-Name, ProcessId, ParentProcessId, CommandLine Alternatively, use the tasklist command for a quicker overview tasklist /v /fo table
Correlate the `ProcessId` with the ParentProcessId. A process like `notepad.exe` having `svchost.exe` as a parent is normal, but if its parent is an unknown script, it’s a major red flag.
2. Uncovering Hidden Users and Unauthorized Access
Attackers frequently create backdoor accounts or use compromised legitimate accounts to maintain access. Auditing user accounts and active sessions is non-negotiable.
Step‑by‑step guide explaining what this does and how to use it.
On Linux:
Review all user accounts, including system accounts
cat /etc/passwd
Check for users with a login shell (e.g., /bin/bash) who shouldn't have one
grep -E ':/bin/(bash|sh|zsh)' /etc/passwd
See who is currently logged in and from where
who -a
last -a
Check for empty password accounts
sudo awk -F: '($2 == "") {print}' /etc/shadow
The `/etc/passwd` file should be checked for any new, unfamiliar users. The `last` command shows login history, revealing connections from unexpected geographic locations.
On Windows (PowerShell):
List all local user accounts Get-LocalUser Get details about currently logged-on users query user Check for hidden accounts (accounts that don't show up in the GUI) net user
Focus on accounts with administrative privileges, especially those recently created or enabled. The `net user
- Auditing Persistence Mechanisms: Cron, Services, and Scheduled Tasks
Persistence is the art of surviving a reboot. Adversaries achieve this by planting their code in autostart locations.
Step‑by‑step guide explaining what this does and how to use it.
On Linux:
Check system-wide and user-specific cron jobs sudo cat /etc/crontab sudo ls -la /etc/cron./ sudo crontab -l -u root and for other privileged users Check systemd services for suspicious ones systemctl list-unit-files --type=service --state=enabled Look for scripts in common autostart directories ls -la ~/.config/autostart/ ls -la /etc/init.d/
A common tactic is to install a cron job that runs every minute to re-establish a reverse shell or execute a payload.
On Windows (PowerShell):
List all scheduled tasks Get-ScheduledTask | Where-Object State -eq "Ready" Check registry run keys for persistence reg query "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" Get a list of all services Get-Service | Where-Object Status -eq "Running"
Scheduled tasks are a favorite for attackers. Use `Get-ScheduledTaskInfo` on a specific task to see its last run time and result.
4. Scrutinizing Network Connections for Data Exfiltration
An infected system will communicate with its command-and-control (C2) server. Identifying unexpected network connections can reveal an active breach.
Step‑by‑step guide explaining what this does and how to use it.
On Linux:
Display all listening ports and the associated processes sudo netstat -tulnp Or use the more modern ss command sudo ss -tulnp Monitor network traffic in real-time sudo tcpdump -i any -w capture.pcap Check which process is using a specific port sudo lsof -i :8080
`netstat -tulnp` is crucial because the `-p` option shows the process ID and name, allowing you to link a suspicious port (e.g., 4444) to a specific malware process.
On Windows:
Show all network connections and the owning Process ID (PID) netstat -ano Use Get-Process to find the process associated with the PID Get-Process -Id <PID>
Look for connections to unknown IP addresses or domains, especially on non-standard ports. A process like `calc.exe` making network connections is a definitive sign of compromise.
5. Leveraging System Logs for Forensic Evidence
Logs provide an immutable record of system activity. Centralized log collection is ideal, but even on a single host, logs are a goldmine of evidence.
Step‑by‑step guide explaining what this does and how to use it.
On Linux:
Check for failed login attempts sudo grep "Failed password" /var/log/auth.log Check for successful logins sudo grep "session opened" /var/log/auth.log Check the bash history for suspicious commands sudo cat ~/.bash_history sudo cat /root/.bash_history
A sudden spike in failed login attempts followed by a successful one can indicate a brute-force attack.
On Windows (PowerShell):
Query the security log for specific event IDs (e.g., 4624: successful logon, 4625: failed logon)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624,4625} -MaxEvents 50
Check system logs for service installation (Event ID 7045)
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045}
Correlate logon events (Event ID 4624) with the originating IP address and the account used. Look for logons outside of business hours or from unusual locations.
What Undercode Say:
- Assumption of Compromise is the New Normal. The most critical shift in mindset is to stop asking if you are breached and start actively hunting for evidence as if you already are. Proactive, continuous hunting is more effective than a passive, alert-driven defense.
- The Attacker’s Logic is Your Guide. To find an intruder, you must think like one. Follow the path of least resistance: where would you hide a backdoor? How would you move without being seen? The commands in this guide are a direct response to these attacker tactics, allowing you to systematically dismantle their foothold.
Prediction:
The techniques highlighted by the ASD signal a future where perimeter-based security becomes increasingly obsolete. The focus will shift decisively towards Identity and Endpoint Detection and Response (EDR). We will see a greater integration of AI not just for generating attacks, but for automating defense—AI-powered hunters that can correlate the forensic data points outlined above across millions of endpoints in real-time, identifying novel attack patterns before human analysts can spot them. The adversary will continue to automate and scale their operations, and the only viable defense will be to meet them with superior automation and intelligent, pervasive monitoring. The age of the silent, long-dwell breach is ending, replaced by a continuous, high-stakes battle of visibility and control on every device.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Australian Signals – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
