# Detecting a Compromise with Basic Linux Tools

The blue-team portion of a Meterpreter lab, shifting from attacker to defender: using nothing but standard Linux commands to investigate whether a system shows signs of compromise.

## What I did

Acting as the responder, I ran four checks against the system, each one targeting a different kind of evidence a live or past compromise tends to leave behind:

```bash
sudo ps aux | grep shell64
```

Checks the live process list for anything matching the suspicious filename. A still-running malicious process is the most direct evidence possible, it's happening right now, not something inferred after the fact.

```bash
sudo find /home -name "*.elf"
```

Searches user home directories for executable files with a specific, unusual extension. ELF binaries sitting in a home directory, especially ones that don't correspond to anything a normal user would have reason to download or compile, are worth flagging even if the process itself has already stopped running.

```bash
sudo crontab -l
```

Reviews scheduled tasks for the current user context. This is specifically a persistence check: an attacker who wants to survive a reboot or a killed process often sets up a cron job to re-launch their access automatically. An empty result here is actually a meaningful finding in itself, not just an empty check, it specifically rules out one common persistence mechanism (root's crontab), rather than telling you nothing.

```bash
sudo last
```

Reviews recent login history. Unexpected or unfamiliar login sessions, especially ones that don't correspond to a known user's normal pattern, are a basic but genuinely useful indicator worth cross-referencing against everything else found.

## Why this combination of checks matters

**Live state and historical state are different kinds of evidence, and you need both.** `ps aux` tells you what's running right now. `find`, `crontab`, and `last` all tell you something about what happened before now, or what's set up to happen again later. A process that's already been killed won't show up in `ps`, which is exactly why the other three checks matter independently.

**An empty or clean-looking result isn't automatically good news.** The lab specifically noted that an empty `crontab -l` result is normal and expected unless persistence was actually established through it. That's an important distinction: a clean result for one specific check rules out one specific mechanism, it doesn't clear the system generally. A real investigation checks multiple possible persistence paths, not just one, before drawing any broader conclusion.

**None of these tools are exotic.** `ps`, `find`, `crontab`, and `last` are all standard, everyday Linux utilities, not specialized forensic software. That's actually the point: a huge amount of basic incident triage is possible with tools that are already present on virtually any Linux system, no special installation required, which makes this exactly the kind of check a responder can run immediately upon suspecting something is wrong, without waiting on anything else to be set up first.

**Documenting what would actually be suspicious, not just running the commands, is the real skill.** The lab's closing instruction, to write down which specific files, users, and system changes would be considered suspicious if this were a real system, is the part that actually matters. Running `find /home -name "*.elf"` is trivial. Knowing that an ELF binary sitting in a regular user's home directory is itself the anomaly worth flagging, as opposed to assuming it's normal, is the actual investigative judgment behind the command.

This exercise was a good reminder that defensive investigation doesn't require specialized tooling to get started. A live process check, a targeted file search, a persistence check, and a login history review, four ordinary commands, each answering a different question about whether and how a system might have been compromised. The real skill isn't running them; it's knowing what result from each one should actually raise a flag.