1. UNUSUAL PROCESSES

1. ps -aux

1. Look at running processes

2. lsof -p [pid]

1. shows files and port used by [pid]

3. chkconfig --list

1. If available
2. check which services are enabled

2. UNUSUAL FILES

4. find / -uid 0 -perm -4000 -print

1. unusual SUID root files

5. find / -size +10000k -print

1. Look for unusually large files

6. find / -name “ “ -print
7. find / -name “. ” -print
8. find / -name “.. “ -print

1. Look for files with unusual dots and space in the names

9. lsof +L1

1. look for processes running/accessing unlinked files

3. UNUSUAL NETWORK USAGE

10. ip link | grep PROMISC

1. Look for promiscuous mode network card mode - possible. sniffer

11. netstat -nap

1. look for unusual port listeners

12. lsof -i

1. details about processes listening on ports

13. arp -a

1. unusual arp entries

4. UNUSUAL SCHED TASKS

14. crontab -u root -l

1. cronjobs sched by root and other 0 UID accounts

15. cat /etc/crontab
16. ls /etc/cron.*

1. unusual system-wide cronjobs

5. UNUSUAL ACCOUNTS

17. sort -nk3 -t: /etc/passwd |less

1. look for new acounts sorted by UID

18. egrep ‘:0+:’ /etc/passwd

1. look for unexpected UID 0 accounts

19. getent passwd |egrep ‘:0+:’

1. look for unexpected UID 0 accounts if using multiple authnt methods

20. find / -nouser -print

1. look for orphaned files. may be cache of temp account that was deleted

6. UNUSUAL LOG ENTRIES

21. “entered promiscuous mode”
22. large number of auth fails from local/remote
23. RPC programs that include large number of unusual characters
24. web logs with unusual number of error
25. reboots/app restarts

7. UNUSUAL OTHERS

1. uptime

1. look at load avarage

2. df

1. sudden increase in disk space utilization