# Files and File System

## **File and File System Analysis in Incident Response (Linux Systems)**

When investigating a security incident on Linux systems, analyzing the file system is crucial. Attackers frequently manipulate files and directories to maintain persistence, escalate privileges, or hide their activities. Here's a systematic approach to detect, analyze, and remediate malicious activity on the file system.

***

## **Key Linux Directories and Their Relevance in Incident Response**

| **Directory** | **Purpose**                 | **Risk/Notes**                                                 |
| ------------- | --------------------------- | -------------------------------------------------------------- |
| `/boot`       | Boot files, kernel images   | Rarely altered but critical for boot integrity.                |
| `/etc`        | Configuration files         | Targeted for persistence (e.g., `/etc/passwd`, `/etc/shadow`). |
| `/bin`        | Essential binaries          | Rarely changes; modifications can indicate rootkits.           |
| `/sbin`       | Superuser binaries          | Altered to replace critical admin commands.                    |
| `/tmp`        | Temporary files             | Commonly used for dropping malicious files.                    |
| `/var`        | Logs, variable data         | Stores logs that can be tampered with to hide tracks.          |
| `/home`       | User directories            | Holds user-specific data and potential malware.                |
| `/root`       | Root user’s home            | Contains sensitive root data.                                  |
| `/usr`        | User binaries and libraries | Could be targeted for persistent malicious binaries.           |
| `/dev`        | Device files                | May be used for hiding malicious payloads.                     |

***

## **Steps for File and File System Analysis**

## **1. Identify Suspicious Files**

**Target Common Exploitation Points**:

* **Temporary Directories**: `/tmp`, `/var/tmp`, `/dev/shm`
* **Web Application Directories**: `/var/www`, `/usr/share/nginx/html`

***

**Search by File Extensions**

Scan for scripts or binaries with potentially malicious extensions:

```bash
find / -type f \( -iname "*.php" -o -iname "*.sh" -o -iname "*.elf" -o -iname "*.pl" \)
```

**Extensions to watch**:

* `.php`, `.jsp`, `.asp` (Webshells)
* `.sh` (Shell scripts)
* `.elf`, `.out`, `.bin` (Executable binaries)

**Search by File Modification Time**

Find files modified in a specific timeframe:

```bash
find / -newermt "2024-11-12 00:00:00" ! -newermt "2024-11-12 23:59:59"
```

**Other time-based filters**:

*   Files modified in the last X days:

    ```bash
    find / -mtime -X
    ```
*   Files modified more than X days ago:

    ```bash
    find / -mtime +X
    ```

**Search by Ownership**

Locate files created or modified by specific users:

```bash
find / -user www-data
```

**Search Recently Changed Metadata**

Identify files with recent permission or ownership changes:

```bash
find / -ctime -X
```

***

## **2. Analyze Suspicious Files**

**Examine File Metadata**

Get detailed metadata about a file:

```bash
stat /path/to/suspicious/file
```

**Details Provided**:

* **Access, modification, and change times**.
* **Ownership**: Who owns the file?
* **Permissions**: What operations are allowed?

**Check File Contents**

For readable files (e.g., scripts, logs):

```bash
cat /path/to/suspicious/file
less /path/to/suspicious/file
```

**Identify Binaries**

For binary executables:

```bash
file /path/to/binary
```

**Hash the File**

Compare file hashes against threat intelligence or virus scanning services:

```bash
sha256sum /path/to/file
```

Use platforms like VirusTotal for quick analysis.

## **3. Remediate Malicious Files**

**Delete Malicious Files**

Once identified, remove them securely:

```bash
rm -rf /path/to/malicious/file
```

**Restore Critical System Files**

If critical files like `/etc/passwd` or binaries in `/bin` are compromised:

*   Restore from clean backups:

    ```bash
    cp /backup/etc/passwd /etc/passwd
    ```
*   Reinstall affected system components:

    ```bash
    apt reinstall coreutils  # Example for Ubuntu
    ```

**Correct File Permissions and Ownership**

Ensure correct permissions for critical files:

```bash
chmod 644 /etc/passwd
chown root:root /etc/passwd
```

## **4. Review Logs for Tampering**

**Locate and Analyze Logs**

Check logs for signs of tampering or deletion:

*   System logs:

    ```bash
    cat /var/log/syslog
    ```
*   Web server logs:

    ```bash
    cat /var/log/nginx/access.log
    ```

**Look for Gaps or Unusual Activity**

Search for log entries around the timeframe of the compromise:

```bash
grep "specific_date" /var/log/auth.log
```

***

#### **Key Commands Cheat Sheet**

| **Command**                           | **Purpose**                             |
| ------------------------------------- | --------------------------------------- |
| `find / -type f \( -iname "*.php" \)` | Find files by extension.                |
| `find /tmp -newermt "YYYY-MM-DD"`     | Find files modified in a time range.    |
| `stat /path/to/file`                  | Get detailed file metadata.             |
| `sha256sum /path/to/file`             | Hash file for verification.             |
| `cat /var/log/syslog`                 | Review system logs.                     |
| `rm -rf /path/to/malicious/file`      | Remove malicious file.                  |
| `chmod 644 /etc/passwd`               | Set proper permissions for system file. |

***

## **Key Points**

File and file system analysis are foundational in identifying and mitigating threats on compromised Linux systems. By systematically searching for unusual files, analyzing their properties, and reviewing log entries, responders can detect malicious activity, remove threats, and restore system integrity. Implementing strong monitoring and file integrity tools enhances proactive security efforts.
