Linux系统入侵取证深度分析

#!/bin/bash
OUTDIR="/evidence/volatile_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTDIR"

ps auxf --width=256 > "$OUTDIR/ps_full.txt"
ss -tunapw > "$OUTDIR/ss_full.txt"
ip route show > "$OUTDIR/routes.txt"
ip neigh show > "$OUTDIR/arp.txt"
ip addr show > "$OUTDIR/interfaces.txt"
mount > "$OUTDIR/mounts.txt"
lsmod > "$OUTDIR/lsmod.txt"
who -a > "$OUTDIR/who.txt"
w > "$OUTDIR/w.txt"
last -50 > "$OUTDIR/last50.txt"
cat /proc/modules > "$OUTDIR/proc_modules.txt"
cat /proc/cmdline > "$OUTDIR/cmdline.txt"
df -hT > "$OUTDIR/df.txt"
ls -la /dev/shm/ > "$OUTDIR/dev_shm.txt"
ls -la /tmp/ > "$OUTDIR/tmp.txt"
find /tmp /dev/shm /run -type f -exec md5sum {} \; > "$OUTDIR/tmp_hashes.txt" 2>/dev/null
cat /proc/net/tcp /proc/net/tcp6 > "$OUTDIR/proc_net_tcp.txt"
cat /proc/net/udp /proc/net/udp6 > "$OUTDIR/proc_net_udp.txt"

dd if=/dev/sda of=/evidence/disk_image.raw bs=4M conv=noerror,sync status=progress
md5sum /evidence/disk_image.raw > /evidence/disk_image.raw.md5
sha256sum /evidence/disk_image.raw > /evidence/disk_image.raw.sha256

dc3dd if=/dev/sda of=/evidence/disk_image.dd3dd \
  hash=md5,sha256 \
  hof=/evidence/disk_image.hash \
  log=/evidence/dc3dd_log.txt \
  progress=yes

ewfacquire /dev/sda -t /evidence/disk_image -f encase6 -b 64 \
  -S sparse -u -l /evidence/ewf_log.txt

echo "=== 原始镜像哈希验证 ==="
md5sum -c /evidence/disk_image.raw.md5
sha256sum -c /evidence/disk_image.raw.sha256

echo "=== 挂载只读分析 ==="
mkdir -p /mnt/evidence
ro-mount /evidence/disk_image.raw /mnt/evidence -o loop,ro,noexec

echo "=== 使用 losetup 挂载分区 ==="
losetup -r -P /dev/loop0 /evidence/disk_image.raw
mount -o ro /dev/loop0p1 /mnt/evidence

/proc/[PID]/
├── cmdline        进程启动命令行参数（以 null 分隔）
├── environ        进程环境变量
├── exe            指向可执行文件的符号链接
├── fd/            文件描述符目录（每个文件描述符一个符号链接）
├── maps           内存映射区域
├── mem            进程内存（需 root 权限）
├── status         进程状态信息（人类可读）
├── stat           进程统计信息（机器可读）
├── cwd            当前工作目录符号链接
├── root           进程根目录符号链接
├── task/          线程信息（每个线程一个子目录）
├── net/           网络命名空间信息
├── cgroup         控制组信息
├── mountinfo      挂载信息
└── comm           命令名（可被修改）

cat /proc/[PID]/cmdline | tr '\0' ' '
cat /proc/[PID]/status
ls -la /proc/[PID]/exe
ls -la /proc/[PID]/fd/
cat /proc/[PID]/maps
cat /proc/[PID]/environ | tr '\0' '\n'
ls -la /proc/[PID]/cwd
ls -la /proc/[PID]/root

pstree -p -a -u -U

for pid in $(ls /proc/ | grep -E '^[0-9]+$'); do
  exe=$(readlink /proc/$pid/exe 2>/dev/null)
  comm=$(cat /proc/$pid/comm 2>/dev/null)
  if [[ "$comm" == \[*\] ]] && [[ "$exe" != "" ]]; then
    echo "[SUSPICIOUS] PID=$pid COMM=$comm EXE=$exe"
  fi
done

ps -eo pid --no-headers | sort -n > /tmp/ps_pids.txt
ls -d /proc/[0-9]* 2>/dev/null | sed 's|/proc/||' | sort -n > /tmp/proc_pids.txt
comm -13 /tmp/ps_pids.txt /tmp/proc_pids.txt

cat /proc/kallsyms | grep "T init_task"

cat /proc/kallsyms | grep sys_call_table
cat /proc/kallsyms | grep sys_getdents

grep sys_call_table /boot/System.map-$(uname -r)
grep sys_call_table /proc/kallsyms

#!/bin/bash

echo "====== Linux 隐藏进程检测脚本 ======"
echo "检测时间: $(date)"
echo ""

echo "[1] ps 与 /proc PID 交叉比对"
ps -eo pid --no-headers | sort -n > /tmp/ps_pids.txt
ls -d /proc/[0-9]* 2>/dev/null | sed 's|/proc/||' | sort -n > /tmp/proc_pids.txt
HIDDEN=$(comm -13 /tmp/ps_pids.txt /tmp/proc_pids.txt)
if [ -n "$HIDDEN" ]; then
    echo "[!] 发现隐藏进程:"
    for pid in $HIDDEN; do
        echo "  PID=$pid COMM=$(cat /proc/$pid/comm 2>/dev/null) EXE=$(readlink /proc/$pid/exe 2>/dev/null)"
    done
else
    echo "[-] 未发现隐藏进程"
fi
echo ""

echo "[2] 内核线程伪装检测"
for pid in $(ls -d /proc/[0-9]* 2>/dev/null | sed 's|/proc/||'); do
    comm=$(cat /proc/$pid/comm 2>/dev/null)
    exe=$(readlink /proc/$pid/exe 2>/dev/null)
    if [[ "$comm" == \[*\] ]] && [[ -n "$exe" ]]; then
        echo "[!] PID=$pid 伪装为内核线程 COMM=$comm EXE=$exe"
    fi
done
echo ""

echo "[3] 异常网络连接进程"
ss -tunap | grep -v "127.0.0.1" | grep ESTAB | while read line; do
    pid=$(echo "$line" | grep -oP 'pid=\K[0-9]+')
    if [ -n "$pid" ]; then
        exe=$(readlink /proc/$pid/exe 2>/dev/null)
        echo "  PID=$pid EXE=$exe CONN=$(echo $line | awk '{print $4" -> "$5}')"
    fi
done
echo ""

echo "[4] /dev/shm 可疑文件"
find /dev/shm -type f -executable 2>/dev/null | while read f; do
    echo "[!] /dev/shm 可执行文件: $f ($(file "$f"))"
done

echo ""
echo "====== 检测完成 ======"

grep "sshd" /var/log/auth.log | tail -50
grep "sudo" /var/log/auth.log | grep -v "session opened\|session closed"
grep "CRON" /var/log/syslog
grep "module\|insmod\|modprobe" /var/log/kern.log

journalctl --since "2026-06-30 00:00:00" --until "2026-07-01 00:00:00"
journalctl -u sshd --since today
journalctl _PID=1234
journalctl _COMM=sshd _EXE=/usr/sbin/sshd
journalctl -k --since "1 hour ago"
journalctl --list-boots
journalctl -b -1
journalctl -b 0 --priority=0..3
journalctl -b 0 _SYSTEMD_UNIT=ssh.service
journalctl --output=json-pretty -b 0 _SYSTEMD_UNIT=ssh.service | head -100

journalctl -D /evidence/var/log/journal/ -b 0 -u sshd

-a always,exit -F arch=b64 -S execve -k exec_monitor
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -k file_deletion
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/ssh/sshd_config -p wa -k sshd_config_changes
-w /etc/crontab -p wa -k crontab_changes
-w /var/log/ -p wa -k log_tampering
-a always,exit -F arch=b64 -S setuid,setgid -k privilege_escalation
-a always,exit -F arch=b64 -S mount,umount2 -k mount_operations
-a always,exit -F arch=b64 -S init_module,finit_module -k module_loading

ausearch -k exec_monitor --start today
ausearch -k passwd_changes --start this-week
ausearch -m USER_LOGIN --start today
ausearch -m EXECVE -i --start today | head -100
ausearch -m MODULE_LOAD --start today
aureport --summary
aureport --failed
aureport --auth
aureport --exec --summary

stat /var/log/auth.log
ls -la /var/log/ | awk '{print $5, $9}' | sort -n
journalctl --verify
systemctl status rsyslog auditd
cat /etc/rsyslog.conf | grep -v "^#\|^$"
cat /etc/logrotate.d/rsyslog

log2timeline.py --storage-file timeline.plaso /evidence/disk_image/
psort.py --output-format l2t_csv timeline.plaso -o timeline.csv

fls -r -m / /evidence/disk_image.raw > bodyfile.txt
mactime -b bodyfile.txt 2026-06-01 > timeline_mactime.csv

#!/bin/bash

echo "====== 日志异常检测 ======"
echo ""

echo "[1] 日志文件完整性检查"
for logfile in /var/log/auth.log /var/log/syslog /var/log/kern.log; do
    if [ -f "$logfile" ]; then
        size=$(stat -c%s "$logfile" 2>/dev/null)
        mtime=$(stat -c%y "$logfile" 2>/dev/null)
        if [ "$size" -eq 0 ] 2>/dev/null; then
            echo "[!] $logfile 文件大小为 0（可能被清空）"
        else
            echo "[-] $logfile 大小=${size} 修改时间=${mtime}"
        fi
    else
        echo "[!] $logfile 不存在（可能被删除）"
    fi
done
echo ""

echo "[2] 日志时间跳跃检测"
if [ -f /var/log/auth.log ]; then
    prev_ts=""
    while IFS= read -r line; do
        ts=$(echo "$line" | awk '{print $1, $2, $3}')
        if [ -n "$prev_ts" ]; then
            prev_epoch=$(date -d "$prev_ts" +%s 2>/dev/null)
            curr_epoch=$(date -d "$ts" +%s 2>/dev/null)
            if [ -n "$prev_epoch" ] && [ -n "$curr_epoch" ]; then
                diff=$((curr_epoch - prev_epoch))
                if [ "$diff" -gt 86400 ] || [ "$diff" -lt -3600 ]; then
                    echo "[!] 时间跳跃: $prev_ts -> $ts (差值: ${diff}s)"
                fi
            fi
        fi
        prev_ts="$ts"
    done < <(tail -500 /var/log/auth.log)
fi
echo ""

echo "[3] auditd 状态检查"
systemctl is-active auditd 2>/dev/null || echo "[!] auditd 未运行"
augenrules --status 2>/dev/null
auditctl -l 2>/dev/null | head -20
echo ""

echo "[4] journal 完整性"
journalctl --verify 2>&1 | grep -v "PASS\|OK" | head -10
echo ""

echo "[5] 认证失败统计"
grep -c "Failed password" /var/log/auth.log 2>/dev/null
grep "Failed password" /var/log/auth.log 2>/dev/null | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10

dumpe2fs /dev/sda1 2>/dev/null | head -50
dumpe2fs /dev/sda1 2>/dev/null | grep -i "created\|mount count\|last mounted"
debugfs -R "stat <inode_number>" /dev/sda1
debugfs -R "ls -l <inode_number>" /dev/sda1
debugfs -R "logdump -a" /dev/sda1

xfs_info /dev/sda1
xfs_db -c "sb 0" -c "p" /dev/sda1
xfs_db -c "inode <inode_number>" -c "p" /dev/sda1
xfs_logrecover -n /dev/sda1

btrfs subvolume list /
btrfs subvolume show /
btrfs inspect-internal inode /path/to/file
btrfs filesystem show

stat /etc/passwd
debugfs -R "stat <$(stat -c %i /etc/passwd)>" /dev/sda1 | grep crtime
xfs_db -c "inode $(stat -c %i /etc/passwd)" -c "p" /dev/sda1 | grep -i "crtime\|mtime\|atime\|ctime"

debugfs -R "logdump -a" /dev/sda1 > jbd2_dump.txt
debugfs -R "logdump -b <block_number>" /dev/sda1
debugfs -R "ls -d /path/to/deleted/dir" /dev/sda1
debugfs -R "dump <inode_number> /recovery/output_file" /dev/sda1

fls -r -d /dev/sda1 | grep "(deleted)"
icat /dev/sda1 <inode_number> > recovered_file
blkls /dev/sda1 > unallocated_space.raw
strings unallocated_space.raw | grep -i "password\|key\|token"

file /tmp/suspicious_file
xxd /tmp/suspicious_file | head -5
xxd -l 32 /tmp/suspicious_file

lsmod > /tmp/lsmod_output.txt
cat /proc/modules > /tmp/proc_modules.txt
diff <(awk '{print $1}' /tmp/lsmod_output.txt | sort) <(awk '{print $1}' /tmp/proc_modules.txt | sort)

cat /proc/kallsyms | grep "sys_call_table"
cat /proc/kallsyms | grep " T sys_getdents64"
cat /proc/kallsyms | grep " T sys_getdents"

grep sys_call_table /boot/System.map-$(uname -r)
grep sys_call_table /proc/kallsyms

cat /proc/kallsyms | grep " idt_table"
cat /proc/kallsyms | grep " first_cpu_"
sidt_output=$(cat /proc/kallsyms | grep "idt")

cat /sys/kernel/debug/tracing/enabled
cat /sys/kernel/debug/tracing/available_filter_functions | wc -l
cat /sys/kernel/debug/tracing/set_ftrace_filter
cat /sys/kernel/debug/kprobes/list

echo $LD_PRELOAD
cat /etc/ld.so.preload 2>/dev/null
cat /etc/ld.so.conf /etc/ld.so.conf.d/*.conf 2>/dev/null
ldd /bin/ls | grep -v "libc\|ld-linux"
strace -f /bin/ls 2>&1 | grep -i "open\|read\|write" | head -30

grep "T " /proc/kallsyms | sort > /tmp/runtime_symbols.txt
nm /boot/vmlinux-$(uname -r) 2>/dev/null | grep " T " | sort > /tmp/boot_symbols.txt
diff /tmp/runtime_symbols.txt /tmp/boot_symbols.txt | head -50

#!/bin/bash

echo "====== Rootkit 快速检测 ======"
echo ""

echo "[1] 内核模块交叉验证"
lsmod_pids=$(awk '{print $1}' <(lsmod) | sort -u)
proc_pids=$(awk '{print $1}' /proc/modules | sort -u)
diff_result=$(diff <(echo "$lsmod_pids") <(echo "$proc_pids"))
if [ -n "$diff_result" ]; then
    echo "[!] lsmod 与 /proc/modules 不一致:"
    echo "$diff_result"
fi
echo ""

echo "[2] LD_PRELOAD 检查"
if [ -f /etc/ld.so.preload ]; then
    echo "[!] /etc/ld.so.preload 存在:"
    cat /etc/ld.so.preload
fi
env_preload=$(env | grep LD_PRELOAD)
if [ -n "$env_preload" ]; then
    echo "[!] LD_PRELOAD 环境变量: $env_preload"
fi
echo ""

echo "[3] 可疑内核模块"
find /lib/modules/$(uname -r) -name "*.ko" -newer /boot/vmlinuz-$(uname -r) 2>/dev/null | while read mod; do
    echo "[!] 可疑模块: $mod (修改时间晚于内核)"
done
echo ""

echo "[4] ftrace hook 检测"
if [ -f /sys/kernel/debug/tracing/set_ftrace_filter ]; then
    filters=$(cat /sys/kernel/debug/tracing/set_ftrace_filter 2>/dev/null | wc -l)
    if [ "$filters" -gt 0 ]; then
        echo "[!] ftrace 过滤器非空 ($filters 条):"
        cat /sys/kernel/debug/tracing/set_ftrace_filter 2>/dev/null
    fi
fi
echo ""

echo "[5] 已知 rootkit 文件检测"
rootkit_files=(
    "/lib/kmod.ko"
    "/etc/ld.so.preload"
    "/usr/lib/libhk0.so"
    "/dev/.blkfn"
)
for f in "${rootkit_files[@]}"; do
    if [ -f "$f" ]; then
        echo "[!] 已知 rootkit 文件: $f"
    fi
done
echo ""

echo "[6] SUID/SGID 异常检测"
find / -perm -4000 -type f 2>/dev/null | while read f; do
    echo "  SUID: $f"
done
find / -perm -2000 -type f 2>/dev/null | while read f; do
    echo "  SGID: $f"
done
echo ""

echo "====== 检测完成 ======"

git clone https://github.com/504ensicsLabs/LiME
cd LiME/src
make
insmod lime-$(uname -r).ko "path=/evidence/memdump.lime format=lime"

insmod lime-$(uname -r).ko "path=tcp:4444 format=lime"
nc attacker_ip 4444 > memdump.lime

vol -f /evidence/memdump.lime linux.pslist
vol -f /evidence/memdump.lime linux.psaux
vol -f /evidence/memdump.lime linux.pstree
vol -f /evidence/memdump.lime linux.check_syscall
vol -f /evidence/memdump.lime linux.check_idt
vol -f /evidence/memdump.lime linux.malfind
vol -f /evidence/memdump.lime linux.proc_maps
vol -f /evidence/memdump.lime linux.kernel_open_files
vol -f /evidence/memdump.lime linux.elfs
vol -f /evidence/memdump.lime linux.envars
vol -f /evidence/memdump.lime linux.tty_check
vol -f /evidence/memdump.lime linux.check_modules
vol -f /evidence/memdump.lime linux.lsmod
vol -f /evidence/memdump.lime linux.vmaregexscan --regex "password|secret|token"

vol -f memdump.lime linux.malfind
vol -f memdump.lime linux.vadyarascan --yara-rules /rules/linux_malware.yar
vol -f memdump.lime linux.vmaregexscan --regex "bash\s+-i\s+>&\s+/dev/tcp"
vol -f memdump.lime linux.vmaregexscan --regex "eval\(base64_decode"

find / -name "authorized_keys" -type f 2>/dev/null
find / -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" 2>/dev/null
cat /etc/ssh/sshd_config | grep -v "^#\|^$"

grep -i "permitrootlogin\|passwordauthentication\|pubkeyauthentication\|authorizedkeysfile\|port\|listenaddress\|allowusers\|allowgroups\|match\|forcecommand\|x11forwarding" /etc/ssh/sshd_config

grep "sshd" /var/log/auth.log | grep -E "Accepted|Failed|Invalid|error|break-in"
grep "sshd" /var/log/auth.log | grep "Accepted" | awk '{print $9, $11}' | sort | uniq -c | sort -rn
grep "sshd" /var/log/auth.log | grep "Failed" | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
grep "sshd" /var/log/auth.log | grep "Invalid user" | awk '{print $8}' | sort | uniq -c | sort -rn | head -20

ss -tunap | grep ssh
netstat -tunap | grep ":22\|ssh"
ps aux | grep "ssh.*-[LRD]\|ssh.*tunnel\|ssh.*forward"
grep -r "LocalForward\|RemoteForward\|DynamicForward" /etc/ssh/ ~/.ssh/ 2>/dev/null

find / -name "authorized_keys" -type f -exec stat -c "%U:%G %n %y" {} \; 2>/dev/null
find / -name "authorized_keys" -type f -exec wc -l {} \; 2>/dev/null
find / -name "authorized_keys" -type f -exec md5sum {} \; 2>/dev/null

tmux list-sessions 2>/dev/null
screen -ls 2>/dev/null
ps aux | grep -E "vnc\|novnc\|x11vnc\|tigervnc"
ps aux | grep -E "rdesktop\|xfreerdp\|xrdp"
ls -la /tmp/.X11-unix/

#!/bin/bash

echo "====== SSH 异常检测 ======"
echo ""

echo "[1] authorized_keys 全面扫描"
find / -name "authorized_keys" -type f 2>/dev/null | while read f; do
    owner=$(stat -c "%U" "$f")
    count=$(wc -l < "$f")
    mtime=$(stat -c "%y" "$f")
    echo "  文件: $f | 所有者: $owner | 密钥数: $count | 修改时间: $mtime"
done
echo ""

echo "[2] sshd_config 异常配置"
grep -i "permitrootlogin yes\|passwordauthentication yes\|permitemptylogin yes" /etc/ssh/sshd_config 2>/dev/null
grep -i "Match\|ForceCommand\|AuthorizedKeysFile" /etc/ssh/sshd_config 2>/dev/null | grep -v "^#"
echo ""

echo "[3] SSH 隧道检测"
ps aux | grep -E "ssh.*-[LRD]" | grep -v grep
ss -tunap | grep -E "ssh|:22" | grep -v "sshd"
echo ""

echo "[4] SSH 暴力破解检测"
grep "Failed password" /var/log/auth.log 2>/dev/null | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10
echo ""

echo "[5] 异常 SSH 连接"
grep "Accepted" /var/log/auth.log 2>/dev/null | awk '{print $1, $2, $3, $9, $11}' | sort | uniq -c | sort -rn | head -20
echo ""

echo "[6] 非标准 SSH 密钥文件"
find / -name "*.pub" -not -path "*/proc/*" -not -path "*/sys/*" 2>/dev/null | while read f; do
    echo "  $f"
done
echo ""

echo "====== 检测完成 ======"

cat /etc/crontab
ls -la /etc/cron.d/
ls -la /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/
for user in $(cut -f1 -d: /etc/passwd); do echo "=== $user ==="; crontab -u "$user" -l 2>/dev/null; done
ls -la /var/spool/cron/crontabs/
cat /var/spool/cron/crontabs/* 2>/dev/null

systemctl list-timers --all
systemctl list-unit-files --type=service | grep enabled
find /etc/systemd/system/ /usr/lib/systemd/system/ /run/systemd/system/ -name "*.service" -newer /etc/hostname 2>/dev/null
find /etc/systemd/system/ /usr/lib/systemd/system/ -name "*.timer" 2>/dev/null

grep -rl "ExecStart\|ExecStartPre\|ExecStartPost" /etc/systemd/system/ 2>/dev/null | while read f; do
    exec_line=$(grep "ExecStart" "$f" | head -1)
    echo "$f: $exec_line"
done

for f in /etc/profile /etc/bash.bashrc /etc/profile.d/*.sh; do
    [ -f "$f" ] && echo "=== $f ===" && tail -5 "$f"
done
for user in $(cut -f1 -d: /etc/passwd); do
    home=$(getent passwd "$user" | cut -d: -f6)
    for rc in .bashrc .bash_profile .profile .zshrc .cshrc; do
        [ -f "$home/$rc" ] && echo "=== $user: $home/$rc ===" && tail -5 "$home/$rc"
    done
done

cat /etc/pam.d/common-auth
cat /etc/pam.d/common-password
cat /etc/pam.d/sshd
cat /etc/pam.d/system-auth 2>/dev/null
find /lib/x86_64-linux-gnu/security/ /lib64/security/ -name "pam_*.so" -newer /etc/pam.d/ 2>/dev/null

cat /etc/ld.so.preload 2>/dev/null
cat /etc/ld.so.conf
cat /etc/ld.so.conf.d/*.conf 2>/dev/null
ldconfig -p | head -30

cat /etc/apt/sources.list
ls /etc/apt/sources.list.d/
cat /etc/apt/sources.list.d/*
cat /etc/yum.repos.d/*.repo 2>/dev/null
dpkg -l | tail -30
rpm -qa --last | head -30

ls -la /var/lib/dkms/
dkms status 2>/dev/null
find /usr/src/ -name "dkms.conf" 2>/dev/null

cat /proc/cmdline
cat /boot/grub/grub.cfg 2>/dev/null | grep -E "linux\s|linux16\s|linuxefi"
cat /boot/grub2/grub.cfg 2>/dev/null | grep -E "linux\s|linux16\s|linuxefi"

#!/bin/bash

echo "====== 持久化全面扫描 ======"
echo ""

echo "[1] cron 任务扫描"
echo "--- /etc/crontab ---"
cat /etc/crontab 2>/dev/null | grep -v "^#\|^$"
echo "--- /etc/cron.d/ ---"
ls -la /etc/cron.d/ 2>/dev/null
echo "--- 用户 crontab ---"
for user in $(cut -f1 -d: /etc/passwd); do
    ct=$(crontab -u "$user" -l 2>/dev/null)
    if [ -n "$ct" ]; then
        echo "  [$user] $ct"
    fi
done
echo ""

echo "[2] systemd 持久化检测"
systemctl list-unit-files --type=service --state=enabled 2>/dev/null | grep -v "systemd\|dbus\|ssh\|cron\|network\|getty"
systemctl list-timers --all 2>/dev/null | head -20
echo ""

echo "[3] 启动脚本检测"
for f in /etc/profile /etc/bash.bashrc /etc/profile.d/*.sh; do
    [ -f "$f" ] && grep -l "curl\|wget\|nc\|bash -i\|python\|perl\|ruby" "$f" 2>/dev/null
done
echo ""

echo "[4] PAM 后门检测"
grep "pam_" /etc/pam.d/common-auth /etc/pam.d/common-password 2>/dev/null | grep -v "^#\|pam_unix\|pam_deny\|pam_permit\|pam_env\|pam_succeed_if\|pam_cap\|pam_systemd"
echo ""

echo "[5] LD_PRELOAD 劫持检测"
[ -f /etc/ld.so.preload ] && echo "[!] /etc/ld.so.preload:" && cat /etc/ld.so.preload
env | grep LD_PRELOAD && echo "[!] LD_PRELOAD 环境变量已设置"
echo ""

echo "[6] 包管理器异常"
apt-key list 2>/dev/null | grep -E "uid|pub" | head -20
cat /etc/apt/sources.list 2>/dev/null | grep -v "^#\|^$"
echo ""

echo "[7] 内核命令行"
cat /proc/cmdline
echo ""

echo "====== 扫描完成 ======"

last -f /var/log/wtmp -a -i
last -f /var/log/wtmp | grep -v "reboot\|shutdown"
lastb -a -i
lastlog
lastlog -u root
lastlog -t 7

last | awk '{print $1, $3}' | sort | uniq -c | sort -rn | head -20
last | grep "pts/" | awk '{print $1, $3, $9}' | sort | uniq -c | sort -rn
lastb | awk '{print $1, $3}' | sort | uniq -c | sort -rn | head -20

grep "sudo" /var/log/auth.log | grep -v "session opened\|session closed\|pam_unix"
grep "COMMAND=" /var/log/auth.log
grep "sudo" /var/log/auth.log | awk '{print $1, $2, $3, $6, $8}' | head -50

awk -F: '$3==0 {print "UID 0 账户: "$1}' /etc/passwd
awk -F: '$2!="x" && $2!="*" && $2!="!" {print "可疑密码字段: "$1" -> "$2}' /etc/passwd
cat /etc/shadow | awk -F: '$2!="" && $2!="*" && $2!="!" {print "可登录账户: "$1}'
awk -F: '$7=="" {print "无过期策略: "$1}' /etc/shadow
getent passwd | awk -F: '$3>=1000 && $3<65534 {print $1, $3, $6, $7}'

#!/usr/bin/env python3
import struct
import socket
import sys
from datetime import datetime

WTMP_FILE = "/var/log/wtmp"
WTMP_FORMAT = "hi32s4s32s256shhiii4i20x"
WTMP_SIZE = struct.calcsize(WTMP_FORMAT)

USER_LOGIN = 7
USER_LOGOUT = 8

def parse_wtmp(filepath):
    records = []
    with open(filepath, "rb") as f:
        while True:
            data = f.read(WTMPT_SIZE)
            if len(data) < WTMPT_SIZE:
                break
            fields = struct.unpack(WTMPT_FORMAT, data)
            ut_type = fields[0]
            ut_pid = fields[1]
            ut_line = fields[2].rstrip(b'\x00').decode('utf-8', errors='ignore')
            ut_id = fields[3].rstrip(b'\x00').decode('utf-8', errors='ignore')
            ut_user = fields[4].rstrip(b'\x00').decode('utf-8', errors='ignore')
            ut_host = fields[5].rstrip(b'\x00').decode('utf-8', errors='ignore')
            ut_tv_sec = fields[7]
            timestamp = datetime.fromtimestamp(ut_tv_sec)
            records.append({
                "type": ut_type,
                "user": ut_user,
                "host": ut_host,
                "line": ut_line,
                "timestamp": timestamp
            })
    return records

def detect_anomalies(records):
    login_hours = {}
    login_sources = {}
    for r in records:
        if r["type"] == USER_LOGIN and r["user"]:
            hour = r["timestamp"].hour
            login_hours.setdefault(r["user"], []).append(hour)
            login_sources.setdefault(r["user"], set()).add(r["host"])

    print("=== 非工作时间登录检测 (22:00-06:00) ===")
    for user, hours in login_hours.items():
        off_hours = [h for h in hours if h >= 22 or h < 6]
        if off_hours:
            print(f"  [!] {user}: {len(off_hours)} 次非工作时间登录")
            print(f"      时间分布: {sorted(set(off_hours))}")

    print("\n=== 多来源 IP 登录检测 ===")
    for user, sources in login_sources.items():
        if len(sources) > 3:
            print(f"  [!] {user}: 来自 {len(sources)} 个不同来源")
            for s in sorted(sources):
                print(f"      {s}")

if __name__ == "__main__":
    wtmp_path = sys.argv[1] if len(sys.argv) > 1 else WTMPT_FILE
    records = parse_wtmp(wtmp_path)
    print(f"共解析 {len(records)} 条记录\n")
    detect_anomalies(records)

ps auxf | grep -v "\[" | head -50
cat /proc/1/cgroup
cat /proc/1/mountinfo | head -30

cat /proc/1/mountinfo | grep -E "overlay|docker|containerd"
mount | grep -E "ext4|xfs" | grep -v "overlay"
findmnt --target /host

cat /proc/1/cgroup
cat /sys/fs/cgroup/*/notify_on_release 2>/dev/null
cat /sys/fs/cgroup/*/release_agent 2>/dev/null

grep Seccomp /proc/1/status
cat /proc/1/status | grep -E "Cap|Seccomp"
aa-status 2>/dev/null

journalctl -u docker --since "24 hours ago"
journalctl -u containerd --since "24 hours ago"
journalctl -u cri-o --since "24 hours ago"
cat /var/log/containers/*.log | tail -100
docker events --since 24h

docker history <image_id>
docker inspect <image_id>
docker save <image_id> -o image.tar
mkdir /tmp/image_analysis && tar xf image.tar -C /tmp/image_analysis
cat /tmp/image_analysis/manifest.json
for layer in $(cat /tmp/image_analysis/manifest.json | python3 -c "import json,sys; [print(l) for l in json.load(sys.stdin)[0]['Layers']]"); do
    echo "=== $layer ==="
    tar tf /tmp/image_analysis/$layer 2>/dev/null | head -20
done

docker network ls
docker network inspect <network_name>
iptables -t nat -L -n -v
iptables -t filter -L -n -v
ip link show | grep veth
brctl show 2>/dev/null

时间关联: auth.log 登录成功 -> auditd EXECVE 命令执行 -> syslog 服务异常
进程关联: ps 异常进程 -> /proc/PID/fd 打开的文件 -> /proc/PID/net 网络连接
用户关联: last 登录记录 -> sudo 日志 -> .bash_history 命令历史
文件关联: 新创建文件 -> crontab 引用 -> 网络连接目标

title: Linux Suspicious Process Execution via Auditd
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: 检测通过 auditd 日志发现的可疑进程执行
author: Security Team
date: 2026/07/02
logsource:
    product: linux
    service: auditd
detection:
    selection_execve:
        type: "EXECVE"
    selection_suspicious_commands:
        a0|contains:
            - "bash -i"
            - "/dev/tcp"
            - "/dev/udp"
            - "nc -e"
            - "ncat -e"
            - "python -c"
            - "perl -e"
            - "ruby -e"
            - "wget http"
            - "curl http"
            - "base64"
            - "chmod 777"
            - "insmod"
            - "modprobe"
    condition: selection_execve and selection_suspicious_commands
level: high
tags:
    - attack.execution
    - attack.t1059

title: Linux Kernel Module Loading Detection
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: 检测 Linux 内核模块加载行为
author: Security Team
date: 2026/07/02
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: "SYSCALL"
        syscall: "init_module"
    filter_known_modules:
        exe|startswith:
            - "/usr/lib/modules/"
            - "/lib/modules/"
    condition: selection and not filter_known_modules
level: critical
tags:
    - attack.persistence
    - attack.t1547.006

title: Linux Privilege Escalation via SUID
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: 检测 SUID/SGID 位设置行为
author: Security Team
date: 2026/07/02
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: "SYSCALL"
        syscall: "chmod"
        a1|endswith: "4000"
    filter_standard:
        exe|startswith:
            - "/usr/bin/"
            - "/usr/sbin/"
    condition: selection and not filter_standard
level: high
tags:
    - attack.privilege_escalation
    - attack.t1548.001

title: Linux SSH Authorized Keys Modification
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: 检测 SSH authorized_keys 文件修改
author: Security Team
date: 2026/07/02
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: "PATH"
        name|contains: "authorized_keys"
    condition: selection
level: high
tags:
    - attack.persistence
    - attack.t1098.004

title: Linux Log Tampering Detection
id: e5f6a7b8-c9d0-1234-efab-345678901234
status: experimental
description: 检测日志文件篡改行为
author: Security Team
date: 2026/07/02
logsource:
    product: linux
    service: auditd
detection:
    selection_write:
        type: "SYSCALL"
        syscall: "unlink"
    selection_target:
        dir|startswith: "/var/log/"
    condition: selection_write and selection_target
level: critical
tags:
    - attack.defense_evasion
    - attack.t1070.002

#!/bin/bash

echo "====== Linux 威胁狩猎综合脚本 ======"
echo "执行时间: $(date)"
echo "主机名: $(hostname)"
echo ""

echo "[1] 反弹 Shell 检测"
grep -rP "bash\s+-i\s+>&\s+/dev/tcp\|/dev/tcp/\|/dev/udp/" /proc/*/cmdline 2>/dev/null | while read match; do
    pid=$(echo "$match" | cut -d: -f1 | cut -d/ -f3)
    echo "[!] PID=$pid 疑似反弹 Shell: $(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')"
done
echo ""

echo "[2] 挖矿指标检测"
ss -tunap | grep -E ":3333|:4443|:4444|:5555|:8888|:9999|:14444|:45700" | while read line; do
    echo "[!] 可疑矿池连接: $line"
done
ps aux | grep -iE "xmrig|minerd|cpuminer|ethminer|stratum" | grep -v grep
echo ""

echo "[3] 异常 SUID 文件"
KNOWN_SUID="/usr/bin/sudo /usr/bin/passwd /usr/bin/chsh /usr/bin/chfn /usr/bin/newgrp /usr/bin/gpasswd /usr/bin/su /usr/bin/mount /usr/bin/umount /usr/bin/pkexec"
find / -perm -4000 -type f 2>/dev/null | while read f; do
    if ! echo "$KNOWN_SUID" | grep -q "$f"; then
        echo "[!] 非标准 SUID: $f ($(stat -c '%U:%G %A' "$f"))"
    fi
done
echo ""

echo "[4] 异常 cron 任务"
find /etc/cron* /var/spool/cron -type f 2>/dev/null | while read f; do
    if grep -qE "curl|wget|bash -c|python -c|perl -e|nc |ncat " "$f" 2>/dev/null; then
        echo "[!] 可疑 cron 文件: $f"
        cat "$f" | grep -v "^#\|^$"
    fi
done
echo ""

echo "[5] 异常网络连接"
ss -tunap | grep ESTAB | grep -v "127.0.0.1\|::1" | while read line; do
    pid=$(echo "$line" | grep -oP 'pid=\K[0-9]+')
    if [ -n "$pid" ]; then
        exe=$(readlink /proc/$pid/exe 2>/dev/null)
        if echo "$exe" | grep -qE "nc|ncat|socat|curl|wget|python|perl|ruby|php"; then
            echo "[!] 可疑连接 PID=$pid EXE=$exe LINE=$line"
        fi
    fi
done
echo ""

echo "[6] /tmp 和 /dev/shm 可疑文件"
find /tmp /dev/shm -type f \( -name "*.sh" -o -name "*.py" -o -name "*.pl" -o -executable \) 2>/dev/null | while read f; do
    echo "[!] 可疑文件: $f ($(file "$f"))"
done
echo ""

echo "[7] 异常用户账户"
awk -F: '$3==0 && $1!="root" {print "[!] 非 root UID0 账户: "$1}' /etc/passwd
awk -F: '$2!~/^[x*!]$/ && $2!="" {print "[!] 可疑密码条目: "$1}' /etc/passwd
echo ""

echo "[8] 最近修改的系统文件"
find /etc /usr/bin /usr/sbin /bin /sbin -mtime -7 -type f 2>/dev/null | head -30
echo ""

echo "====== 狩猎完成 ======"

rule Linux_ReverseShell_ELF {
    meta:
        description = "检测包含反弹 Shell 特征的 ELF 文件"
        author = "Security Team"
        date = "2026-07-02"
    strings:
        $bash_tcp = "bash -i >& /dev/tcp/" ascii
        $bash_udp = "bash -i >& /dev/udp/" ascii
        $nc_reverse = "nc -e /bin/sh" ascii wide
        $python_reverse = "socket.socket" ascii
        $python_bind = "socket.bind" ascii
        $perl_reverse = "IO::Socket::INET" ascii
        $mknod = "mknod /tmp/" ascii
        $elf_magic = { 7F 45 4C 46 }
    condition:
        $elf_magic at 0 and any of ($bash_tcp, $bash_udp, $nc_reverse, $python_reverse, $perl_reverse, $mknod)
}

rule Linux_CryptoMiner_Indicators {
    meta:
        description = "检测加密货币挖矿软件特征"
        author = "Security Team"
        date = "2026-07-02"
    strings:
        $stratum = "stratum+tcp://" ascii wide
        $xmrig = "xmrig" ascii wide nocase
        $minerd = "minerd" ascii wide nocase
        $cpuminer = "cpuminer" ascii wide nocase
        $pool_addr = /pool\.[a-z]+\.(com|net|org)/ ascii
        $wallet = /[13][a-km-zA-HJ-NP-Z1-9]{25,34}/ ascii
        $hash_algo = "cryptonight" ascii wide nocase
        $hash_algo2 = "randomx" ascii wide nocase
        $hash_algo3 = "ethash" ascii wide nocase
    condition:
        any of ($stratum, $xmrig, $minerd, $cpuminer) or ($pool_addr and any of ($hash_algo, $hash_algo2, $hash_algo3))
}

rule Linux_LKM_Rootkit_Pattern {
    meta:
        description = "检测 LKM rootkit 常见模式"
        author = "Security Team"
        date = "2026-07-02"
    strings:
        $syscall_table = "sys_call_table" ascii
        $orig_getdents = "orig_getdents" ascii
        $orig_getdents64 = "orig_getdents64" ascii
        $hide_pid = "hide_pid" ascii
        $hide_file = "hide_file" ascii
        $magic_string = "magic_string" ascii
        $module_init = "module_init" ascii
        $cleanup_module = "cleanup_module" ascii
        $kprobe = "register_kprobe" ascii
        $ftrace = "ftrace_set_filter" ascii
        $proc_root = "proc_root" ascii
    condition:
        4 of them
}

rule Linux_Webshell_PHP {
    meta:
        description = "检测 PHP Webshell 特征"
        author = "Security Team"
        date = "2026-07-02"
    strings:
        $eval_base64 = /eval\s*\(\s*base64_decode/ ascii
        $eval_gzinflate = /eval\s*\(\s*gzinflate/ ascii
        $system_cmd = /system\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/ ascii
        $passthru = /passthru\s*\(\s*\$_(GET|POST|REQUEST)/ ascii
        $shell_exec = /shell_exec\s*\(\s*\$_(GET|POST|REQUEST)/ ascii
        $assert_php7 = /assert\s*\(\s*\$_(GET|POST|REQUEST)/ ascii
        $preg_replace_e = /preg_replace\s*\(.*\/e/ ascii
    condition:
        any of them
}

filebeat.inputs:
- type: auditd
  enabled: true
  audit.rules: |
    -a always,exit -F arch=b64 -S execve -k exec_monitor
    -w /etc/passwd -p wa -k passwd_changes
    -w /etc/shadow -p wa -k shadow_changes
    -w /etc/ssh/sshd_config -p wa -k sshd_config

output.elasticsearch:
  hosts: ["https://elasticsearch:9200"]
  index: "auditd-%{+yyyy.MM.dd}"

初始访问 -> Web 应用漏洞利用 -> Webshell 植入 -> 权限提升 -> 横向移动 -> 数据外泄

供应链投毒 -> 恶意 Docker 镜像 -> 容器内挖矿 -> 容器逃逸 -> 宿主机持久化

漏洞利用 -> 植入 BPFDoor -> eBPF 程序加载 -> 被动嗅探 + 主动 Shell -> 数据窃取