Righteous IT

One situation that I run into all too frequently in Linux investigations is disk images the come from multiple systems but which were originally created from a common “master” image (or which use a generic LVM2 volume group name like “linux_lvm“).

In this installment I’m going to tell you the sequence of steps I took to create the scenario data.

Please read Part 1 and Part 2 for additional background We’ve actually done quite well reconstructing the major points of our intrusion scenario, but there are definitely some lingering questions.

Please read the previous installment of this investigation for additional background.

I recently posted a Linux scenario that I had mocked up and asked for people to submit write-ups for judging.

When triaging a collection of memory images, I often find myself running multiple Volatility plugins on each image.

jq is a tremendously useful tool for dealing with JSON data.

Let’s try something a little different for today’s blog post!

There’s an old riddle in Unix circles: “Name a letter that is not an option for the ls command”.

In my previous blog post I demonstrated a method for persisting a Linux LKM rootkit across reboots by leveraging systemd-modules-load.