| namespace | aiwg |
| name | linux-forensics |
| description | Generalized Linux incident response and forensic analysis covering Debian/Ubuntu, RHEL/CentOS/Rocky, and SUSE families |
| tools | Bash, Read, Write, Glob, Grep |
| platforms | ["all"] |
linux-forensics
Performs structured forensic analysis on Linux systems, adapting collection and verification procedures to the detected distribution family. Covers Debian/Ubuntu (apt/debsums), RHEL/CentOS/Rocky (rpm), and SUSE (zypper/rpm). Produces a findings document aligned with NIST SP 800-86 collection ordering.
Triggers
Alternate expressions and non-obvious activations (primary phrases are matched automatically from the skill description):
- "ir" / "incident response" for Linux → generalized Linux forensics
- "DFIR" → Digital Forensics and Incident Response
- "triage [host]" → host-level forensic triage
Purpose
Linux distributions differ in package managers, log file paths, service managers, and integrity verification tools. A forensic workflow that hardcodes Debian paths will miss evidence on RHEL systems and vice versa. This skill detects the distribution family at runtime and selects appropriate tooling, producing consistent output regardless of target distro.
Behavior
When triggered, this skill:
-
Detect distribution family:
- Read
/etc/os-release — check ID_LIKE and ID fields
- Classify as:
debian (Debian, Ubuntu, Mint), rhel (RHEL, CentOS, Rocky, AlmaLinux, Fedora), suse (openSUSE, SLES)
- Fall back to generic Linux procedures if family is unknown
-
Verify package integrity:
- Debian family:
debsums -c 2>/dev/null | grep -v OK — lists files failing checksum
- RHEL family:
rpm -Va 2>/dev/null | grep -v '^......G' — lists changed attributes
- SUSE family:
rpm -Va 2>/dev/null (same as RHEL; rpm is the package tool)
- Flag any modified files in system binary directories (
/bin, /sbin, /usr/bin, /usr/sbin, /lib)
-
Collect authentication and authorization evidence:
- Debian:
/var/log/auth.log, /var/log/auth.log.1
- RHEL/SUSE:
/var/log/secure, /var/log/secure-*
- All families:
journalctl -u sshd --no-pager -n 5000
- Parse for: failed logins, sudo usage, su activity, PAM events, cron authentication
-
Audit scheduled tasks:
- System cron:
/etc/crontab, /etc/cron.d/, /etc/cron.{hourly,daily,weekly,monthly}/
- User cron tables:
for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u $u 2>/dev/null; done
- Systemd timers:
systemctl list-timers --all
- At jobs:
atq 2>/dev/null
-
Review persistence mechanisms:
- Init scripts:
/etc/init.d/ (SysV), /etc/rc.local
- Systemd units added by non-package managers: compare unit file mtimes against package database
- PAM modules:
/etc/pam.d/ — check for unexpected pam_exec.so or pam_python.so entries
Usage Examples
Example 1 — Remote investigation
linux forensics user@prod-api-01.example.com
Example 2 — Local system
investigate linux server localhost
Example 3 — RHEL target with elevated access
linux incident response root@192.0.2.100
Output Locations
- Findings:
.aiwg/forensics/findings/<hostname>-linux.md
- Package integrity report:
.aiwg/forensics/evidence/<hostname>-pkg-integrity.txt
- Raw collection:
.aiwg/forensics/evidence/<hostname>-linux-raw.txt
Configuration
linux_forensics:
find_depth: 5
log_lines: 5000
flag_suid_non_root: true
distro_families:
debian:
auth_log: /var/log/auth.log
pkg_verify: debsums -c
rhel:
auth_log: /var/log/secure
pkg_verify: "rpm -Va"
suse:
auth_log: /var/log/messages
pkg_verify: "rpm -Va"
References
- @$AIWG_ROOT/agentic/code/addons/aiwg-utils/rules/research-before-decision.md — Detect distribution family before selecting tooling; read /etc/os-release first
- @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/non-destructive.md — Never modify target system state; use read-only commands and copy-on-collect procedures
- @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/volatility-order.md — Collect volatile process and network state before disk artifacts
- @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/rules/red-flag-escalation.md — Escalate immediately when active malicious processes, rootkit indicators, or live attacker sessions are found
- @$AIWG_ROOT/agentic/code/frameworks/forensics-complete/skills/evidence-preservation/SKILL.md — Preserve and hash collected log files before analysis
