aegis-dfir-triage-linux
Adaptation note (this module remaps the fixed skill headings): What To Check = the ordered triage sequence steps. Where To Look = artifact paths on disk. Patterns & Signatures = indicator shapes (webshell greps, deleted-exe signatures, suspicious-line examples). Taint Tracing Guidance = lateral-movement reading (which artifact implicates which next hop). Exploitation & Reproduction = TABLETOP walkthrough procedures on an owned, isolated lab host - explicitly never production. Remediation = eradication/rebuild actions. Severity Assessment = incident-impact classification aid, not CVSS scoring.
Scope & Objectives
Apply this module to: suspicious ubuntu/fedora servers, bare-metal or cloud VMs, Kubernetes nodes, and hosts running internet-facing python/rust services behind cloudflare tunnels (cloudflared). Assume no EDR, no preinstalled forensics tooling, SSH access as an admin, and a small team with one responder on the keyboard.
Objectives, in order:
- Preserve volatile evidence to an EXTERNAL collector before anything mutates the host.
- Prove or disprove compromise within 60-120 minutes with concrete indicators.
- Identify the entry-vector CLASS (webshell/upload, stolen SSH key, exposed admin surface, dependency compromise) well enough to patch and sweep the fleet.
- Produce a defensible nuke-vs-investigate recommendation.
- Hand a packaged finding set to the incident-response playbooks (
incident-response.md).
Out of scope: full forensic disk analysis, malware reverse engineering, Windows/macOS hosts, formal legal chain of custody (this module provides LITE responder logging only).