Linux IR

Investigation Methodology for SOC Analysts and IR Practitioners in Linux, Cloud, and Container Environments

Practical Incident Response: Linux Systems

The Mission: Follow the Adversary Across the Linux Stack

Every investigation technique in this course follows the same six-step pattern: what to look for, where to find it, how to extract it, how to interpret it, what it proves, and what to do next. From SSH brute force to web shell deployment to container escape to cloud lateral movement, you will learn to trace the adversary through filesystem artifacts, log entries, memory structures, and cloud audit trails — using free and open-source tools at every step.

LINUX IR — INVESTIGATION TIMELINET+0:00Alert: SSH brute force — successful auth from foreign IPSource: auth.log → failed/success pattern → auditd correlationT+0:03SSH authorized_keys modified — attacker deploys persistenceSource: filesystem timestamps → inode analysis → ctime vs mtimeT+0:08Privilege escalation — SUID binary exploited to gain rootSource: auditd execve logs → SUID file access → process treeT+0:22Container escape — Docker socket mounted, host access gainedSource: container logs → docker inspect → overlay2 filesystemT+1:45Cloud pivot — instance metadata SSRF, IAM credential theftSource: cloud audit logs → API call timeline → cross-env correlation17 modules10 scenariosFree tools40-50 hours

The Six-Step Investigation Method

Every technique in this course — from parsing an ext4 inode to investigating a container escape — follows the same systematic pattern that working investigators use on real incidents:

1. What to look for — the artifact, the log entry, the behavioral indicator that answers the investigation question.

2. Where to find it — which log file, which directory, which /proc entry, which memory structure. The exact location, not a vague reference.

3. How to extract it — the exact command, copy-paste ready, annotated line by line. Free tool primary, enterprise alternative noted.

4. How to interpret it — what the output means. What is normal. What is suspicious. What the fields contain and why each matters.

5. What it proves — the evidence significance. What this finding demonstrates, what it does not demonstrate, and what assumptions it does not support.

6. What to do next — the next investigation step. Where the evidence chain leads. Which command to run next, which artifact to examine next, which containment action to take.

Who this course is for

SOC analysts expanding into Linux. You triage alerts and investigate incidents in Windows and M365. But your organization runs Linux servers — web servers, jump boxes, CI/CD runners, database hosts. When one is compromised, you need the investigation skills to follow the attacker through filesystem artifacts, log files, and memory.

IR practitioners in mixed environments. You handle incidents across Windows, M365, and Linux. Your Windows forensics is strong. Your Linux investigation is ad hoc — you know some commands but not the systematic methodology. This course provides the structure.

Cloud security analysts. Your environment is cloud-native — EC2 instances, Azure VMs, GKE nodes, containers. The VMs run Linux. The containers run Linux. When a cloud workload is compromised, the investigation starts at the Linux layer. This course teaches you that layer.

Detection engineers building Linux coverage. You write detection rules for Windows and M365. Your Linux detection coverage is a known gap. This course provides the investigation methodology that feeds your detection engineering — every scenario ends with detection rule deployment.

The toolkit — free and open-source first

Every technique is taught with at least one free tool. You are never told "buy this forensic suite to follow along." The core toolkit: UAC (Unix Artifact Collector) for triage collection, Volatility 3 for memory forensics, Sleuth Kit for filesystem analysis, plaso/log2timeline for timeline generation, LiME for memory acquisition, standard Linux commands (journalctl, ausearch, aureport, find, grep, strace, ltrace) for live response and log analysis. Enterprise alternatives noted where relevant: Velociraptor for remote collection, AXIOM Cyber for cross-platform analysis, Elastic SIEM for Linux log aggregation.

Course Syllabus

17 modules across 3 phases. LX0–LX1 are free — no account required.

Phase 2 — Investigation Scenarios

LX4
Investigating SSH Brute Force and Credential Compromise — The most common Linux attack vector. Brute force detection, post-compromise artifacts, lateral movement, and detection rule deployment.
LX5
Investigating Web Application Compromise — Web shell detection, access log analysis, reverse shell detection, post-exploitation, and database credential theft.
LX6
Investigating Privilege Escalation — SUID exploitation, kernel exploits, sudo misconfiguration, container escape, and cron-based escalation.
LX7
Investigating Persistence Mechanisms — SSH keys, cron jobs, systemd services, shared library injection, PAM backdoors, and kernel module rootkits.
LX8
Investigating Cryptomining and Resource Abuse — Cryptominer detection, process hiding, mining pool analysis, and resource impact assessment.
LX9
Investigating Container Compromise — Docker and Kubernetes forensics. Container escape detection. Image supply chain compromise. RBAC abuse.
LX10
Investigating Cloud VM Compromise — Cloud-specific collection. Metadata service abuse. Cloud-native persistence. Cross-environment correlation.
LX11
Investigating Lateral Movement — SSH-based pivoting. Agent forwarding abuse. Configuration management tool exploitation. Internal service compromise.
LX12
Linux Memory Forensics — LiME acquisition. Volatility 3 with Linux profiles. Hidden process detection. Rootkit identification. Bash history recovery from memory.
LX13
Linux Malware Analysis for IR — Static and dynamic analysis. Common Linux malware families. IOC extraction. Second-stage payload analysis.

Phase 3 — Operations

LX14
Linux IR Reporting and Evidence Handling — Unified report structure. Chain of custody. Cross-platform incident reporting. Legal considerations.
LX15
Linux Detection Engineering and Hardening — Auditd rules. SIEM forwarding. CIS benchmark mapping. The detection engineering pipeline.
LX16
Building Linux IR Readiness — The Linux IR toolkit. The Linux-specific IR playbook. Tabletop exercises. Cross-platform IR integration.