Card, PayPal or bank transfer · Morocco and worldwideتعلَّم · مارِس · أتقِن

Catalogue / Cybersecurity

Linux Incident Response and Digital Forensics

Investigate your own compromised Linux servers without destroying evidence: triage, logs, persistence, suspicious files, disk and memory imaging, timeline, then communication and obligations in Morocco (DGSSI, CNDP).

  • Intermediate to advanced
  • 12 lessons
  • 11 h 15 min

A MasterLinux course · Original text

What you will learn

  • Run the incident response cycle, from preparation to the lessons-learned review
  • Collect evidence in order of volatility and keep a chain of custody
  • Triage a suspect Linux server (processes, connections, accounts, SSH keys, scheduled tasks, services)
  • Read auth.log, journald, wtmp and auditd to find who logged in and what ran
  • Hunt persistence (systemd, cron, ld.so.preload, shell profiles, authorized_keys)
  • Analyze a suspicious file without running it (hashes, strings, permissions, timestamps)
  • Understand disk and memory acquisition and verify image integrity
  • Rebuild an attack timeline in UTC from disk and logs
  • Communicate during a crisis and meet Moroccan obligations (law 05-20, DGSSI, law 09-08, CNDP)
  • Investigate three rewritten real incidents end to end (mining, web shell, added SSH key)

Course content

12 lessons · 11 h 15 min
Section 1 — Fundamentals2 lessons · 1 h 25 min
  1. The incident response cycle and preparation Preview40 min
  2. Collecting evidence: order of volatility and chain of custody 45 min
Section 2 — Triage and logs2 lessons · 1 h 50 min
  1. Triaging a suspect Linux server 55 min
  2. Analyzing logs: auth, journald, auditd and the web server 55 min
Section 3 — Investigation4 lessons · 3 h 25 min
  1. Hunting persistence: systemd, cron, ld.so.preload, shell profiles 55 min
  2. Analyzing a suspicious file without running it 50 min
  3. Disk and memory imaging: concepts and tools 50 min
  4. Building the attack timeline 50 min
Section 4 — Obligations and real cases3 lessons · 2 h 35 min
  1. Communicating during the crisis and meeting the obligations (Morocco) 45 min
  2. Real case: cryptocurrency mining on an exposed server 55 min
  3. Real case: web shell on a CMS, then an added SSH key 55 min
Section 5 — Final project1 lesson · 2 h
  1. Final project: investigating a compromised server end to end 2 h

Requirements

  • Solid hands-on experience with the Linux command line (at least the "Fundamentals" course)
  • Able to administer a Debian or Rocky server (services, users, logs)
  • Ideally the "Linux Server Hardening" or "SOC Analyst with Wazuh" course

Who is this course for?

  • System administrators who must react when one of their servers is compromised
  • SOC analysts who want to move from an alert to an on-host investigation
  • Students and technicians aiming for an incident response role (CSIRT, CERT, security team)