Linux Host Forensics

What problem does it solve?

Helps incident responders rapidly identify persistence, privilege-escalation vectors, and evidence of compromise on live or imaged Linux/Unix endpoints, even when attackers attempt anti-forensics such as clearing command history.

Core Features & Use Cases

• Local account and authentication triage: Reviews /etc/passwd, /etc/shadow, and SSH/auth logs to surface suspicious UID-0 accounts, weak or altered password data, and successful/failed login patterns.
• Persistence and execution trace discovery: Enumerates cron, systemd units, rc.local, and user shell profiles, then correlates them with bash history patterns for download/execute chains.
• Host compromise indicators and escalation paths: Checks for staged malware in /tmp, /dev/shm, /var/tmp, validates SUID/SGID binaries, inspects kernel modules, and optionally mines auditd for privilege escalation and sensitive access.

Quick Start

Use the skill with your mounted case evidence by setting CASE_ROOT to the Linux evidence root path and running the skill’s execution workflow to generate the analysis outputs under ./analysis/linux.