[Reserved] emergency response and investigation traceability

Source: https://sec.ctrip.com/doc/ corporate emergency response and investigation traceable way .pdf

Troubleshooting steps:
Check the process and file

//快速查看进程信息，获取进程文件位置
    top -c
//杀死进程          
    kill -q PID   
//根据文件名特征查找
    grep -rni "shellname"*
//根据文件大小特征查找
    find / -size 1223123c
//根据文件创建时间查找
    find / -mtime 1 -name *
//查看进程占用信息
    lsof -p PID
//读取进程在内存中的信息
    cd /proc/PID
    cat *|strings -n 5|more

Detection Network

//查看port端口
    lsof -i:"port"
//查看不正常端口
    netstat -nap
//查看Tcp连接
    netstat -an |grep tcp|awk '{print \$5}'
//查看syn连接
    netstat -an|grep SYN|awk '{print \$5}'|awl -F:'{print \$1}'|sort|uniq -c|sort -nr|more

Check the system command

ls -alt /bin/|head -n 10
ls -alt /usr/sbin/|head -n 10
ls -alt /usr/bin/|head -n 10

​