Activity 7.2: Log Analysis, Privilege Escalation, Persistence and IOCs
This activity will present you with the opportunity to review a bash command history log file as related to a recent security issue. You will be looking for malicious commands found in the log file.
Scenario
The IT team at a company discovered that sensitive financial data from a Linux server was leaked online. This data should have only been accessible by the admin user with elevated privileges. Security logs show that the server’s web interface, running a Python-based application, was accessed by an unauthorized party using the web-service user account. According to the developers, the application has been configured to block file uploads that could introduce malicious scripts. A Bash history log from the server is available for review. Can you find out more about what happened?
You will analyze the following Bash command history log file to respond to the questions and understand more about the...
