How to check is a linux server is compromised or rooted?

• bpftrace

  24 7,647 0.0 C++

  Discontinued High-level tracing language for Linux eBPF [Moved to: https://github.com/bpftrace/bpftrace]

  

bpftrace and/or bpfcc-tools can also be useful (dpkg -L bpftrace to see available tools). You can monitor files being opened/written at kernel level (opensnoop*, filelife*, filetop*), connections being established (tcp*bpfcc), etc.

• bcc

  71 19,404 9.2 C

  BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

  

bpftrace and/or bpfcc-tools can also be useful (dpkg -L bpftrace to see available tools). You can monitor files being opened/written at kernel level (opensnoop*, filelife*, filetop*), connections being established (tcp*bpfcc), etc.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• rules

  7 3,962 0.0 YARA

  Repository of yara rules

  

On the other hand, you could also use a Yara scanner (apt install yara) to scan for IOCs. Here's a good list of rules https://github.com/Yara-Rules/rules

Suggest a related project