Linux Triage Commands

Process and persistence

ps auxf
systemctl list-units --type=service --state=running
crontab -l
ls -la /etc/cron.*

Info Prefer capturing command output to a timestamped file rather than copy/paste.

ss -tulpen
ip a
ip r
lsof -i -n -P | head

last -a | head
journalctl -S "-2h" --no-pager | tail -200
grep -R "Accepted" /var/log/auth.log | tail -50