Linux forensics - The forgotten crime scene

With the ever expanding use of EDR, telemetry generating products, and SIEM solutions in the Windows and MacOS spaces, this talk aims to look a little more closely at the often forgotten Linux space. As Linux is still used extensively within organisations, especially in the web server hosting space, and comes in many different flavours, we as security minded individuals should understand the limitations that arise within these systems. This is especially true in the event that a linux-based incident required further forensic work and analysis.

Although not necessarily common knowledge, security products are often not as extensive within the Linux space, as most user workstations in typical organisations run Windows or MacOS, resulting in larger research budget and more well crafted solutions for these operating systems. This leaves detection and security visibility in the Linux space as an unknown for many organisations, both surrounding common attacker techniques, the likely paths of compromise, as well as the detections that can occur within these environments. This talk ultimately aims to educate individuals on the telemetry that is available natively on a Linux machine in the event of a compromise, which is used to build a baseline understanding, highlighting the inadequate nature of native logging. This also highlights what needs to happen to ensure sufficient visibility is achieved in this space.

We will run through a full compromise of a web server from both the responder's and threat actor's perspective to show the exact actions that were taken and what could be seen natively. Using this approach, individuals in any space, not even exclusively cyber security, can get a taste of what it's like to be both a red or blue teamer. Following this, both EDR products as well as enhanced logging packages provided in Linux package repositories will be used to further highlight the visibility that exists within these environments when using these products.

This talk will not only bring to light limitations that exist in the Linux space during investigations, but will also assist organisations with ensuring that they are taking the necessary steps to ensure that they have significant visibility on all infrastructure within their estate.