System administrators can identify suspicious activity on Linux servers by monitoring processes, network connections, and automated tasks using standard built-in tools. Key utilities for initial diagnostics include ps, top, ss, systemctl, and journalctl.
To investigate a process, administrators should examine its PID, parent process, user, and execution path. Tools like ps aux and readlink help verify if a process matches expected configurations, while stat provides file metadata for further analysis.
Network activity analysis involves using the ss command to inspect TCP and UDP sockets. Administrators should correlate connections with specific processes and verify remote addresses, noting that unknown connections are not inherently malicious as they may belong to legitimate services.
Systemd and cron are common vectors for automated execution. Checking systemctl units, timers, and cron directories allows for the identification of unexpected tasks. Additionally, auditing user accounts with UID 0 and reviewing SSH keys are critical steps in maintaining system security.
Effective incident response requires gathering evidence before taking action. Administrators should avoid immediate deletion of files or system reboots, as these steps may destroy data. Instead, they should document observations, preserve logs, and follow established response plans.
