How to check is a linux server is compromised or rooted?

1. bpftrace

   1 24 7,647 0.0 C++

   Discontinued High-level tracing language for Linux eBPF [Moved to: https://github.com/bpftrace/bpftrace] (by iovisor)

   

   bpftrace and/or bpfcc-tools can also be useful (dpkg -L bpftrace to see available tools). You can monitor files being opened/written at kernel level (opensnoop*, filelife*, filetop*), connections being established (tcp*bpfcc), etc.

2. CodeRabbit

   coderabbit.ai featured

   CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.

   

3. bcc

   2 79 20,904 9.0 C

   BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

   

   bpftrace and/or bpfcc-tools can also be useful (dpkg -L bpftrace to see available tools). You can monitor files being opened/written at kernel level (opensnoop*, filelife*, filetop*), connections being established (tcp*bpfcc), etc.

4. rules

   3 7 4,272 0.0 YARA

   Repository of yara rules

   

   On the other hand, you could also use a Yara scanner (apt install yara) to scan for IOCs. Here's a good list of rules https://github.com/Yara-Rules/rules

Suggest a related project