Linux Root-Level Compromise — Disk Imaging and Deep Forensic Analysis
When evidence of root access is found on a Linux system (new sudoers entry, SUID binary, kernel module, rootkit indicator), a disk image is acquired, deep forensic analysis is performed, and the system is rebuilt.
Prepare
4 steps- Disk image capacity
Verify that evidence storage (external disk or network share) equal to or larger than the target system's disk size is available and ready; and that `dc3dd` or `dd` tools are accessible
- Out-of-band access
Confirm with L2/IR lead that an out-of-band channel such as KVM, IPMI, serial console, or hypervisor console is available for accessing the system during disk imaging and isolation; without this, `systemctl stop sshd` will cut the connection
- Escalation and rebuild approval
System rebuild and broad network isolation affects production services; document the L2/IR lead + system owner + CISO approval chain; these actions cannot be initiated by L1 alone
- Forensic toolkit
Verify accessibility of `dd`, `dc3dd`, `sha256sum`, `strings`, `ldd`, `file`, `debugfs`, `lsmod`, `getcap`, `ausearch`, `journalctl`, `Velociraptor` on the target system or IR station
Detect & Analyze
5 steps- Confirm root compromise class