analyzing-linux-system-artifacts

name	analyzing-linux-system-artifacts
description	Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity. Use when working with analyzing linux system artifacts.
domain	cybersecurity
tags	["forensics","linux-forensics","system-artifacts","log-analysis","persistence-detection","incident-investigation"]
subdomain	digital-forensics
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01"]

Analyzing Linux System Artifacts

Overview

Cybersecurity skill for analyzing linux system artifacts. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing linux system artifacts"

• "Examine Linux system artifacts including auth logs, cron jobs, shell history, an"

• When investigating a compromised Linux server or workstation

• For identifying persistence mechanisms (cron, systemd, SSH keys)

• When tracing user activity through shell history and authentication logs

• During incident response to determine the scope of a Linux-based breach

• For detecting rootkits, backdoors, and unauthorized modifications

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Forensic image or live access to the Linux system (read-only)
• Understanding of Linux file system hierarchy (FHS)
• Knowledge of common Linux logging locations (/var/log/)
• Tools: chkrootkit, rkhunter, AIDE, auditd logs
• Familiarity with systemd, cron, and PAM configurations
• Root access for complete artifact collection

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Scope the Analysis — Define what linux system artifacts artifacts or data sources to examine and the investigation timeline.