{"id":1719,"date":"2026-01-24T19:50:00","date_gmt":"2026-01-24T19:50:00","guid":{"rendered":"https:\/\/zombierollz.blog\/?p=1719"},"modified":"2026-01-24T14:50:37","modified_gmt":"2026-01-24T14:50:37","slug":"linux-threat-detection-1","status":"publish","type":"post","link":"https:\/\/zombierollz.blog\/?p=1719","title":{"rendered":"Linux Threat Detection 1"},"content":{"rendered":"\n

https:\/\/tryhackme.com\/room\/linuxthreatdetection1<\/a>
Created by: tryhackme, TactfulTurtle<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“When did the ubuntu user log in via SSH for the first time?
Answer Example: 2023-09-16.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Did the ubuntu user use SSH keys instead of a password\u00a0for the above found date? (Yea\/Nay)”

Yea!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 3, Detecting SSH Attacks!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“When did the SSH password brute force start?
Answer Format: 2023-09-15.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which four users did the botnet attempt to breach?
Answer Format: Separate by a comma, in alphabetical order.”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

“Finally, which IP managed to breach the root user?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 4, Initial Access via Services!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Thanks to THM, we know that the IP address of 10.14.105.255 is likely the attackers. We can confirm that by looking at the log.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the path to the Python file the attacker attempted to open?”

I used grep to help with this. If you didn’t know, Python files end in .py.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Looking inside the opened file, what’s the flag you see there?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 5, Building Process Tree!<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“What is the PPID of the suspicious whoami command?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Moving up the tree, what is the PID of the TryPingMe app?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

“Which program did the attacker use to open a reverse shell?”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On to Task 6, Advanced Initial Access! We are completed with the VM tasks(Good job!), and THM now covers Human-Led Attacks. Initially, you would think of USB and phishing, but as they point out, Linux is primarily a server OS run by technical people(humble brag). Below are examples, and they also bring up supply chain compromises.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

https:\/\/tryhackme.com\/room\/linuxthreatdetection1Created by: tryhackme, TactfulTurtle “When did the ubuntu user log in via SSH for the first time?Answer Example: 2023-09-16.” “Did the ubuntu user use SSH keys instead of a password\u00a0for the above found date? (Yea\/Nay)” Yea! On to Task 3, Detecting SSH Attacks! “When did the SSH password brute force start?Answer Format: 2023-09-15.” “Which four […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1719","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1719"}],"version-history":[{"count":3,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1719\/revisions"}],"predecessor-version":[{"id":1745,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=\/wp\/v2\/posts\/1719\/revisions\/1745"}],"wp:attachment":[{"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zombierollz.blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}