How to check for suspicious activity on your Ubuntu system (Part 1)

Hello everyone.

I will make this topic for who is interested on malware/rootkit analysis, or checking suspicious activities on Linux.

We'll obtain superuser acces with one of these commands/parameters :

• sudo su
• sudo -i
• su username

1. Check for suspicious users logged into your machine

w

or

who

2. Check your login sessions

last

3. Check your bash shell (Terminal) history

history

4. Monitor your network traffic

netstat -ls

or

netstat -la

5. Enable Chkrootkit for anti-rootkit protection/scan for threats

apt install chkrootkit

Then scan :

sudo chkrootkit

You can export your result report with :

sudo chkrootkit > results

I hope it helps. Let me know if it works.