Lesson 6.21: Capstone: triaging a compromised server
Triage is the first hour of an incident on a live Linux server: find what's running that shouldn't, where it talks to, what it changed, and contain it without destroying evidence. This capstone uses every section of the course on one machine. Northwind's payment API server opened an outbound connection nobody can explain. You find a disguised process running from a deleted file, link it to its parent service and its connection, check the kernel and the packages, find a credential trap in PAM, preserve the sample, freeze the service and write a sealed triage report.
24 min
You will learn to
- Find processes running from deleted files
- Link a process to its connection, parent and cgroup
- Check kernel taint and package integrity in one pass
- Spot a PAM change against a golden copy
- Contain without destroying evidence and seal a report
Key terms
- Triage
- The first, fast assessment of an incident: what, where, how bad, what to contain.
- Living off the land
- Using the system's own tools and places (/dev/shm, kernel-thread names) to blend in.
- Containment
- Stopping the damage from spreading while keeping evidence.
- Chain of custody
- A record showing evidence wasn't altered: what was collected, when, with which hash.
← Backups you can actually restore · All lessons · Capstone: from one alert to a full picture →