forensics-investigation-forensic

Filesystem Recon

Purpose: Focused, fast filesystem triage with forensic-safe defaults. Baseline comparison, anomaly detection, and timeline-first evidence collection.

---

Core Focus Areas

• Baseline delta: Compare live state against stored PersistenceBaseline/FilesystemBaseline
• SUID/SGID audit: All setuid/setgid binaries, world-writable directories
• Hidden files: . prefix, unusual names, high-entropy filenames, files in /dev, /proc, /tmp
• Inode anomalies: Hardlinks to privileged files, inode number gaps, journal inconsistencies
• Extended attributes: lsattr/getfattr for hidden immutable/append-only flags
• Deleted-but-open files: lsof +L1 for malware keeping deleted files open
• Timeline forensics: mtime/atime/ctime analysis, MAC time tampering detection
• Temporary directories: Executable payloads in /tmp, /var/tmp, /dev/shm, /run

---

Key Techniques & Tools

SUID/SGID & Permission Audit

# All SUID binaries (compare against baseline)
find / -xdev -perm /4000 -type f 2>/dev/null | sort > /tmp/suid_live.txt
diff /tmp/suid_baseline.txt /tmp/suid_live.txt 2>/dev/null || \
  cat /tmp/suid_live.txt | head -30

# SGID binaries
find / -xdev -perm /2000 -type f 2>/dev/null | sort | head -20

# World-writable files outside /tmp (suspicious)
find / -xdev -perm /0002 -not -path "*/proc/*" -not -path "*/tmp/*" \
  -not -path "*/sys/*" -type f 2>/dev/null | head -20

# World-writable directories
find / -xdev -perm /0002 -type d -not -path "*/proc/*" \
  -not -path "*/tmp" -not -path "*/sys/*" 2>/dev/null | head -15

# Files owned by root but writable by others
find /usr /bin /sbin /etc -xdev -writable -not -user root 2>/dev/null | head -10

Hidden & Suspicious Files

# Executable files in temp directories
find /tmp /var/tmp /dev/shm /run -type f -executable 2>/dev/null | \
  while read f; do
    echo "EXEC in tmp: $f ($(stat -c '%a %U %G' "$f"))"
    file "$f" 2>/dev/null | grep -v "ASCII\|text"
  done

# High-entropy filenames (base64/hex names)
find / -maxdepth 5 -name "*=*" -o -name ".[a-f0-9][a-f0-9][a-f0-9][a-f0-9]*" \
  2>/dev/null | grep -v "/proc\|/sys" | head -20

# Files with spaces or unusual characters in name
find /tmp /var/tmp /home /etc -name "* *" -o -name "*[[:cntrl:]]*" 2>/dev/null | \
  head -10

# Dot-files in unusual system directories
find /bin /sbin /usr/bin /usr/sbin -name ".*" 2>/dev/null | head -10

# Files in /dev that aren't devices
find /dev -not -type b -not -type c -not -type d -not -type l \
  -not -name "fd" -not -name "stdin" -not -name "stdout" 2>/dev/null | head -10

Inode & Extended Attributes

# Files with multiple hardlinks (potential rootkit technique)
find / -xdev -links +3 -type f -not -path "*/proc/*" 2>/dev/null | \
  while read f; do
    n=$(stat -c '%h' "$f")
    echo "HARDLINKS($n): $f"
  done | head -20

# Extended attributes (hidden data, immutable flags)
lsattr -R /etc /bin /sbin /usr/bin 2>/dev/null | grep -v "^lsattr\|^---" | \
  grep -E "^.{4}i|^.{4}a|^.{4}s" | head -20

# User extended attributes (xattr) — can hide data
getfattr -R -n user.* /home /tmp 2>/dev/null | head -20

# Immutable system files that shouldn't be
lsattr /etc/passwd /etc/shadow /etc/sudoers 2>/dev/null

Deleted-But-Open Files

# Files deleted but kept open by processes (rootkit/malware pattern)
lsof +L1 2>/dev/null | grep -v "^lsof" | head -30

# Cross-reference PIDs with process info
lsof +L1 2>/dev/null | awk 'NR>1 {print $2}' | sort -u | \
  while read pid; do
    echo "PID $pid: $(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')"
  done

Timeline Analysis

# Recently modified files (last 24 hours) — anomaly detection
find / -xdev -newer /tmp/baseline_marker -type f \
  -not -path "*/proc/*" -not -path "*/sys/*" 2>/dev/null | \
  xargs stat -c "%Y %n" 2>/dev/null | sort -rn | head -30

# Create fresh marker for delta baseline
touch -t "$(date -d '24 hours ago' '+%Y%m%d%H%M.%S')" /tmp/baseline_marker

# MAC time on critical files
stat /etc/passwd /etc/shadow /etc/crontab \
  /etc/sudoers /bin/bash /bin/sh /sbin/init 2>/dev/null | \
  grep -E "(File:|Modify:|Change:|Access:)"

# Files modified after package install timestamps (potential tampering)
LATEST_PKG=$(stat -c "%Y" /var/libs/pacman/local/*/desc 2>/dev/null | sort -rn | head -1)
find /bin /sbin /usr/bin /usr/libs -newer /tmp/pkg_marker \
  -type f 2>/dev/null | head -20

Filesystem Integrity

# AIDE integrity check (if installed)
aide --check 2>/dev/null | tail -20

# Verify package file checksums (pacman)
pacman -Qk 2>/dev/null | grep "warning\|error" | head -20

# Check for modified ELF binaries in system paths
for bin in /bin /sbin /usr/bin /usr/sbin; do
  find "$bin" -type f -name "*.so*" -newer /tmp/baseline_marker 2>/dev/null | head -5
done

# /proc consistency — hidden processes (compare /proc PIDs vs ps)
ps -eo pid --no-headers | sort > /tmp/ps_pids.txt
ls /proc | grep -E '^[0-9]+$' | sort > /tmp/proc_pids.txt
comm -23 /tmp/proc_pids.txt /tmp/ps_pids.txt | head -10  # PIDs in /proc but not in ps

---

MITRE ATT&CK Mapping

Finding	Technique
SUID binary added	T1548.001 – Setuid and Setgid
Executable in /tmp / /dev/shm	T1059 – Command and Scripting Interpreter
Deleted-but-open malware file	T1070.004 – File Deletion
MAC time tampering	T1070.006 – Timestomping
Hidden file in system directory	T1564.001 – Hidden Files and Directories
Immutable flag on malicious file	T1562 – Impair Defenses
Hardlink to privileged binary	T1548 – Abuse Elevation Control Mechanism

---

Rules for Agents

1. Always compare against stored FilesystemBaseline — changes without known updates = MEDIUM+
2. SUID binaries not in baseline = HIGH immediately
3. Executables in /tmp, /dev/shm, /run = HIGH unless explicitly whitelisted
4. Log all anomalous files with SHA-256 hash, path, permissions, and owner to iocs.md
5. Never delete suspicious files — preserve with cp --preserve=all
6. Sync all filesystem IOCs to shared memory at session end