GIAC Linux Incident Responder

Time is short in the first hour of an incident. You build triage workflows, script the collection of what matters, and decide what to capture before it changes or disappears.

• Triage goals and questions to answer first
• Order of volatility on Linux
• Collection scripts and their risks
• Remote triage across many hosts
• Recording commands and outputs for evidence
• Choosing between triage and a full image

You build A triage script and a runbook that collect volatile and key persistent data from a Linux host.

How Linux manages memory shapes what you can capture. You learn the kernel architecture relevant to forensics, then collect physical, virtual and volatile evidence and mount it safely for analysis.

• Linux memory management and kernel architecture
• Acquiring memory from physical and virtual hosts
• Disk imaging for physical and virtual systems
• Collecting from cloud and container hosts
• Mounting images read-only and safely
• Verifying and documenting acquisitions

You build A memory capture and disk image from a lab host, mounted read-only and verified.

Files remember what happened to them. You use The Sleuth Kit to examine Linux file system artifacts, find modified and deleted files, hunt for persistence, and notice changes to account and password files.

• Linux file system structures: inodes and journals
• The Sleuth Kit toolset and workflow
• Finding deleted and recently modified files
• Hunting persistence in startup and scheduled locations
• Changes to password and authentication files
• Recovering files and their metadata

You build A file system analysis of a compromised host, with persistence mechanisms and altered files documented.

A timeline connects files, logs and memory into one sequence. You build timelines from Linux sources, understand how timestamps behave on Linux file systems, and read the result for the order of an intrusion.

• Timestamps on Linux file systems
• Generating a timeline from a file system image
• Adding logs and artifacts to a timeline
• Filtering and pivoting to the incident window
• Interpreting patterns of activity
• Presenting a timeline to an incident lead

You build A combined timeline of a compromised host that marks the initial access and each later action.

System logs say who did what, if they are configured and read correctly. You examine the audit framework and the system journal, online and offline, and the authentication records that show logins and privilege use.

• The audit framework: rules and records
• Reading the systemd journal with journalctl
• Authentication and sudo logs
• Login records and last-login databases
• Reviewing logs offline from an image
• Detecting log gaps and tampering

You build A log analysis of suspicious logins and privilege use, with the queries used.

Attackers often arrive through a service. You examine web server, database and file sharing logs and host firewall records to see what was requested, what answered and what left the machine.

• Web server access and error logs
• Database server logs and query evidence
• File sharing service logs
• Host firewall logs and connection records
• Correlating application logs with system events
• Extending logging for future incidents

You build A service log investigation that traces an intrusion from a web request to a system change.

Live memory shows what files and logs may have lost. You analyze live memory, profile devices and running binaries, and learn how attackers conceal activity with deleted files, altered timestamps and similar tricks.

• Analyzing Linux memory images
• Processes, network connections and loaded modules in memory
• Profiling running binaries and device information
• Deleted executables still running
• Timestamp alteration and log cleaning
• Cross-checking memory against disk

You build A memory and disk comparison on one host that exposes a concealed process and altered timestamps.

Hunting finds what alerts do not, and playbooks make the response repeatable. You use threat intelligence to hunt across Linux systems, then structure the response with playbooks and defined workflows.

• Threat intelligence for Linux environments
• Hypothesis-driven hunts on Linux hosts
• Hunting across a fleet at scale
• Writing response playbooks for Linux incidents
• Containment and eradication on Linux systems
• Feeding findings back into detection

You build A Linux hunt plan and a response playbook for a compromised internet-facing server.

Bring triage, evidence, logs, timelines and memory into one case. You investigate a compromised Linux host, write the timeline of the intrusion and report what the response team should do next.

• Triage and scoping
• Evidence acquisition and mounting
• File system, log and memory analysis
• Timeline and findings
• Response recommendations

You build A complete Linux incident investigation report with timeline, evidence and recommendations.