Linux Log Analysis

# Count failed SSH attempts by source IP
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

# Show all successful logins
grep "Accepted" /var/log/auth.log

# Show all sudo commands executed
grep "sudo:" /var/log/auth.log | grep "COMMAND"

# Show new user accounts created
grep "useradd\|new user" /var/log/auth.log

# View all logs, newest first
journalctl -r

# View logs for a specific service
journalctl -u sshd
journalctl -u cron

# View logs since a specific time
journalctl --since "2024-01-15 08:00:00" --until "2024-01-15 12:00:00"

# View kernel messages only
journalctl -k

# Follow live (like tail -f)
journalctl -f

# Show logs for a specific user (by UID)
journalctl _UID=1001

# View boot-specific logs
journalctl -b -1    # previous boot
journalctl -b 0     # current boot

# Export to JSON for SIEM ingestion
journalctl -o json-pretty --since "1 hour ago"

# Show all logins in the last 7 days with source IPs
last -w -F | head -50

# Show failed logins
sudo lastb | head -30

# Show dormant accounts that recently became active
lastlog | grep -v "Never logged in" | sort -k4

# Top attacking IPs by failed attempts
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -10

# All unique usernames targeted in brute force
# Note: "for invalid user" entries shift the field position � use a pattern match instead
grep "Failed password" /var/log/auth.log | awk '{for(i=1;i<=NF;i++) if($i=="for"){print $(i+1); break}}' | sort | uniq -c | sort -rn

# Find where a successful login came from
grep "Accepted" /var/log/auth.log | grep "username"

# Who is logged in right now
w && who

# Recent logins
last -20

# Currently running processes (with full command lines)
ps auxf

# Network connections
ss -tulnp
netstat -tulnp

# Listening ports
ss -lntp

# Established outbound connections (possible C2)
ss -tnp state established

# Files modified in the last 24 hours (exclude /proc /sys /dev)
find / -mtime -1 -type f 2>/dev/null | grep -v "^/proc\|^/sys\|^/dev"

# Recently created files (possible dropped malware)
find /tmp /var/tmp /dev/shm -type f -ls 2>/dev/null

# Check for unusual SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Check crontabs for all users
for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l 2>/dev/null | grep -v "^#"; done

# Check authorized_keys for all users
find /home /root -name "authorized_keys" -exec cat {} + 2>/dev/null

# Check for new systemd services
systemctl list-units --type=service --state=running

# Hash all running executables (for threat intel lookups)
ls -la /proc/*/exe 2>/dev/null | awk '{print $NF}' | sort -u | xargs -I{} sha256sum {} 2>/dev/null