Back to Portfolio DFIR Report

Linux Breach Investigation Case Study

End-to-end digital forensics and incident response investigation of a compromised Linux web server. Full attack timeline reconstructed across six evidence domains.

 Digital Forensics  ·  Incident Response 6-Part Series

Investigated a Simulated Linux Breach and Reconstructed the Full Attack Timeline Across Six Evidence Domains

Target
Linux web server (Ubuntu)
Type
Digital Forensics and IR
Evidence Sources
Logs, RAM, PCAP, Disk, Malware
Tools
Volatility3, tshark, foremost, strings
MITRE Techniques
10 ATT&CK techniques mapped
Outcome
29/30 flags, full breach reconstructed
View on GitHub Read Write-ups
Executive Summary

End-to-end forensic investigation of a compromised Linux web server across six evidence domains. A single attacker (198.51.100.47) conducted a targeted breach on 14 November 2025. Starting from DirBuster reconnaissance at 02:55 UTC, they achieved root in 36 minutes via SSH brute force, web shell upload, and privilege escalation, then installed a Cobalt Strike beacon disguised as a kernel process, created a backdoor user, loaded a rootkit to hide PID 31337, and exfiltrated credentials via DNS tunnelling. Every step was reconstructed from raw evidence: system logs, a RAM dump, a packet capture, disk images, and a custom ELF malware sample, producing a complete 12-event attack timeline mapped to 10 MITRE ATT&CK techniques.

Attack Chain: 02:55 to 03:55 UTC
DirBuster → SSH Brute Force → Web Shell Upload → Root Access → Beacon Deployed → Backdoor + Rootkit → DNS Exfiltration
Six Investigation Domains
01. Log Analysis 6/6 flags

Reconstructed initial access and persistence from apache, auth, syslog, and kern logs. Identified brute force source IP, web shell upload, privilege escalation via sudo, rootkit loading, and cron persistence.

02. Memory Forensics 6/6 flags

Used Volatility3 to expose a Cobalt Strike beacon disguised as kworker-update (PID 31337). Recovered plaintext credentials from RAM and reconstructed attacker commands from bash history in memory.

03. Network Forensics 5/5 flags

Analysed a PCAP with tshark to identify the C2 domain, count 47 scanned ports, reconstruct the reverse shell session (TCP stream 190), and decode base64-encoded credentials exfiltrated inside DNS subdomains.

04. Disk Forensics 5/5 flags

Mounted disk images read-only, used foremost to carve a PNG from raw sectors, and recovered deleted credentials and a staged exfiltration plan (OPERATION NIGHTFALL) from unallocated space using strings.

05. Malware Triage 5/5 flags

Static analysis only. Extracted C2 IP hardcoded in an ELF binary using strings, identified the beacon User-Agent, and fully reversed a two-stage VBA macro infection chain including sandbox evasion and encoded PowerShell payload.

06. Incident Timeline 2/3 flags

Correlated all five evidence sources to reconstruct a 12-event canonical attack timeline from 02:55 to 03:55 UTC. Third flag (SHA-256 timeline hash) not captured: format mismatch despite 1.3M brute-force combinations. Documented in full.

Key Findings
Initial Access Vector Identified Log Analysis

SSH brute force from 198.51.100.47 succeeded after 83 attempts targeting the admin account. Web shell uploaded to /uploads/shell.php within 2 minutes of login. Both attack vectors confirmed via apache-access.log and auth.log cross-reference.

Persistence Mechanisms Detected 3 Methods

Three independent persistence methods deployed: backdoor user svc-backup with injected SSH key, cron job running beacon every 5 minutes, and a rootkit (rootkit_mod.ko) hiding PID 31337 from process listings. Removal of any one leaves two others active.

Cobalt Strike Beacon Exposed Critical

Volatility3 process tree analysis revealed kworker-update (PID 31337) spawned from bash, not kthreadd. Wrong parent process = disguised malware. Beacon confirmed via cmdline output showing AES-256 C2 connection to 203.0.113.99:443.

DNS Exfiltration Channel Decoded Network

tshark analysis of PCAP identified base64-encoded credentials embedded inside DNS subdomain queries to evil-c2.example.com. Decoded to reveal stolen /etc/shadow hashes and SSH private keys. Exfil passed through firewalls that permitted DNS traffic.

Deleted Exfiltration Plan Recovered Disk Forensics

strings analysis on raw disk image recovered OPERATION NIGHTFALL: a deleted file staging a planned DNS tunnel exfiltration of customer database and financial records. Filesystem showed no record of the file. Raw disk sector analysis recovered it intact.

Full Attack Timeline Reconstructed Incident Timeline

All five evidence sources correlated into a single 12-event canonical timeline from 02:55 to 03:55 UTC. Attacker achieved root in 36 minutes from first recon hit. Timeline maps each event to MITRE ATT&CK technique, source log, and timestamp, ready for legal or executive reporting.

MITRE ATT&CK Coverage
T1595 Active Scanning T1110 Brute Force T1505.003 Web Shell T1136 Create Account T1098.004 SSH Auth Keys T1053.003 Cron Job T1014 Rootkit T1003 Credential Dumping T1059 Command Interpreter T1048.003 DNS Exfiltration
29/30
Flags Captured
6
Evidence Domains
10
MITRE Techniques
60 min
Full Breach Window
3
Persistence Methods
36 min
Recon to Root
Volatility3 tshark Wireshark foremost strings grep / awk sha256sum Python 3 Linux Logs Static Analysis Memory Forensics DNS Exfiltration
Why This Matters

This investigation demonstrates my ability to:

  • →Analyse real-world attack artifacts across logs, memory, network, disk, and malware, using the same tools and methodology a SOC analyst or IR responder would use on a live incident.
  • →Think like an attacker: understanding why each technique was used (beacon disguised as kworker, DNS exfil to bypass firewalls, rootkit to hide PID) makes the investigation sharper and faster.
  • →Reconstruct a complete incident narrative from raw forensic evidence and deliver a timeline that maps directly to MITRE ATT&CK, suitable for executive reporting, legal proceedings, or remediation planning.
  • →Document failures honestly: the one uncaptured flag is explained in full, with the investigation steps taken, why it failed, and what the correct approach should have been. That level of rigour is what separates a junior analyst from a trusted one.