Find signs of compromise in Linux system files.
What it does
Examines Linux system evidence to identify compromise, uncover persistence, and reconstruct user or attacker activity.
When to use it
Use when investigating compromised Linux systems, hunting persistence, tracing user activity, or scoping a breach.
How to use it
Give it a forensic image or read-only access to a Linux system; it collects evidence and produces forensic analysis reports.
What you provide
- Your files
Good to know
- works out of sight
Latest review
What you need · 6
Requires Python 3 to run the inline account and shell-history analysis.
Lists chkrootkit as a prerequisite tool for rootkit detection.
Access · 2
This skill
/mnt/evidence
Write
Mounts the evidence image read-only
/cases/baseline/pam.d/
Read
Reads baseline PAM configuration