{"id":20711,"date":"2026-08-19T10:54:50","date_gmt":"2026-08-19T07:24:50","guid":{"rendered":"https:\/\/maralhost.com\/kb\/docs\/security\/%d8%b4%d9%86%d8%a7%d8%b3%d8%a7%db%8c%db%8c-backdoor-%d9%88-%d8%a7%d8%b1%d8%aa%d8%a8%d8%a7%d8%b7%d8%a7%d8%aa-%d9%85%d8%ae%d9%81%db%8c-%d8%af%d8%b1-%d8%b3%d8%b1%d9%88%d8%b1-%d9%84%db%8c%d9%86%d9%88\/"},"modified":"2026-08-19T12:54:48","modified_gmt":"2026-08-19T09:24:48","slug":"linux-backdoor","status":"publish","type":"docs","link":"https:\/\/maralhost.com\/kb\/articles\/security\/linux-backdoor\/","title":{"rendered":"\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Backdoor \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0645\u062e\u0641\u06cc \u062f\u0631 \u0633\u0631\u0648\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">\u0645\u0642\u062f\u0645\u0647<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0648\u0638\u0627\u06cc\u0641 \u0645\u062f\u06cc\u0631 \u0633\u0631\u0648\u0631\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc <strong>Backdoor\u0647\u0627\u060c \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0634\u0628\u06a9\u0647\u200c\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/strong> \u0627\u0633\u062a. Backdoor \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0639\u0627\u062f\u06cc \u0648\u0631\u0648\u062f\u060c \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0633\u0631\u0648\u0631 \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f \u06cc\u0627 \u0627\u0631\u062a\u0628\u0627\u0637\u06cc \u0645\u062e\u0641\u06cc \u0628\u0627 \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u062e\u0627\u0631\u062c\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0637\u0631\u06cc\u0642:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process \u0645\u0634\u06a9\u0648\u06a9<\/li>\n\n\n\n<li>Cron Job<\/li>\n\n\n\n<li>Systemd Service<\/li>\n\n\n\n<li>SSH Key \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u067e\u0648\u0631\u062a Listening \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647<\/li>\n\n\n\n<li>\u0627\u0631\u062a\u0628\u0627\u0637 Outbound \u0628\u0647 IP \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u0645\u062e\u0641\u06cc<\/li>\n\n\n\n<li>Web Shell<\/li>\n\n\n\n<li>User Account \u063a\u06cc\u0631\u0645\u062c\u0627\u0632<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645\u06cc<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647\u060c \u0631\u0648\u0634\u200c\u0647\u0627\u06cc \u0639\u0645\u0644\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Backdoor \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0645\u0634\u06a9\u0648\u06a9 \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0631\u0627 \u0645\u0631\u062d\u0644\u0647\u200c\u0628\u0647\u200c\u0645\u0631\u062d\u0644\u0647 \u0628\u0631\u0631\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u06cc\u0645.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0648 \u067e\u0627\u0633\u062e \u0628\u0647 \u0646\u0641\u0648\u0630 \u062f\u0631 \u0633\u0631\u0648\u0631\u0647\u0627 \u0648 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0645\u062c\u0648\u0632 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u062f\u0627\u0631\u06cc\u062f.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Backdoor \u0686\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Backdoor \u0631\u0648\u0634\u06cc \u0628\u0631\u0627\u06cc \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0627\u0633\u062a \u06a9\u0647 \u0645\u0633\u06cc\u0631 \u0639\u0627\u062f\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u06cc\u0627 \u06a9\u0646\u062a\u0631\u0644\u200c\u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0631\u0627 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0632\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u067e\u0633 \u0627\u0632 \u0646\u0641\u0648\u0630 \u0627\u0648\u0644\u06cc\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u06cc\u06a9 User \u062c\u062f\u06cc\u062f \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>SSH Key \u062e\u0648\u062f \u0631\u0627 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u06cc\u06a9 \u0633\u0631\u0648\u06cc\u0633 \u0645\u062e\u0641\u06cc \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>Cron Job \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u06cc\u06a9 \u0641\u0627\u06cc\u0644 \u0645\u062e\u0631\u0628 \u0631\u0627 \u0647\u0646\u06af\u0627\u0645 Boot \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.<\/li>\n\n\n\n<li>\u06cc\u06a9 Process \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f \u06a9\u0647 \u062f\u0627\u0626\u0645\u0627\u064b \u0628\u0647 \u06cc\u06a9 IP \u062e\u0627\u0631\u062c\u06cc \u0645\u062a\u0635\u0644 \u0634\u0648\u062f.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062d\u0641\u0638 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0633\u06cc\u0633\u062a\u0645 \u062d\u062a\u06cc \u067e\u0633 \u0627\u0632 \u0631\u0641\u0639 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc \u0627\u062d\u062a\u0645\u0627\u0644\u06cc \u0648\u062c\u0648\u062f Backdoor<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0634\u0627\u0646\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u0646\u062f \u0634\u0627\u0645\u0644:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CPU \u06cc\u0627 RAM \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc<\/li>\n\n\n\n<li>Connection\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>\u067e\u0648\u0631\u062a\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f<\/li>\n\n\n\n<li>Process\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>Restart \u0634\u062f\u0646 Process \u0628\u0639\u062f \u0627\u0632 Kill<\/li>\n\n\n\n<li>\u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062c\u062f\u06cc\u062f<\/li>\n\n\n\n<li>SSH Key \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n\n\n\n<li>Cron Job \u0645\u0634\u06a9\u0648\u06a9<\/li>\n\n\n\n<li>\u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f Systemd<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 <code>\/tmp<\/code><\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u0646\u0627\u06af\u0647\u0627\u0646\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0648\u0628\u200c\u0633\u0627\u06cc\u062a<\/li>\n\n\n\n<li>\u0627\u0641\u0632\u0627\u06cc\u0634 \u062a\u0631\u0627\u0641\u06cc\u06a9 Outbound<\/li>\n\n\n\n<li>Login \u0627\u0632 IP \u0646\u0627\u0634\u0646\u0627\u0633<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u06cc\u0686\u200c\u06a9\u062f\u0627\u0645 \u0627\u0632 \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u0627\u062b\u0628\u0627\u062a\u200c\u06a9\u0646\u0646\u062f\u0647 \u0646\u0641\u0648\u0630 \u0646\u06cc\u0633\u062a\u0646\u062f \u0648 \u0628\u0627\u06cc\u062f \u062f\u0631 \u06a9\u0646\u0627\u0631 \u0634\u0648\u0627\u0647\u062f \u062f\u06cc\u06af\u0631 \u062a\u062d\u0644\u06cc\u0644 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0631\u062d\u0644\u0647 \u0627\u0648\u0644: \u0628\u0631\u0631\u0633\u06cc \u067e\u0648\u0631\u062a\u200c\u0647\u0627\u06cc Listening<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0627\u0648\u0644\u06cc\u0646 \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tulpn\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0632\u06cc\u0631 \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TCP<\/li>\n\n\n\n<li>UDP<\/li>\n\n\n\n<li>Listening Port<\/li>\n\n\n\n<li>Process<\/li>\n\n\n\n<li>PID<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0646\u0645\u0648\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tcp LISTEN 0 128 0.0.0.0:22\ntcp LISTEN 0 511 0.0.0.0:80\ntcp LISTEN 0 511 0.0.0.0:443\ntcp LISTEN 0 128 0.0.0.0:49152\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u067e\u0648\u0631\u062a <code>49152<\/code> \u0631\u0627 \u0646\u0645\u06cc\u200c\u0634\u0646\u0627\u0633\u06cc\u062f\u060c \u0628\u0627\u06cc\u062f Process \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0622\u0646 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u067e\u0648\u0631\u062a \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -ltnp | grep :49152\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>users:((\"unknown\",pid=28451,fd=5))\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06a9\u0646\u0648\u0646 PID \u0645\u0634\u062e\u0635 \u0627\u0633\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>28451\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -fp 28451\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/28451\/exe\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Command Line:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tr '\\0' ' ' &lt; \/proc\/28451\/cmdline\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Directory \u06a9\u0627\u0631\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/28451\/cwd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Parent Process<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,ppid,user,cmd -p 28451\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 Parent PID \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u062f\u0631\u062e\u062a Process\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -p\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -ap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f Process \u0645\u0634\u06a9\u0648\u06a9 \u062a\u0648\u0633\u0637 \u0686\u0647 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0627\u06cc \u0627\u062c\u0631\u0627 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u0645\u0627\u0645 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0641\u0639\u0627\u0644<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0642\u0637 Connection\u0647\u0627\u06cc Established:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp state established\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a Outbound<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 Connection\u0647\u0627\u06cc \u062e\u0627\u0631\u062c\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0633\u062a\u0648\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Peer Address:Port\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>192.168.1.10:49134 \u2192 203.0.113.50:4444\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0634\u0646\u0627\u062e\u062a\u0647\u200c\u0634\u062f\u0647\u200c\u0627\u06cc \u0646\u0628\u0627\u06cc\u062f \u0628\u0647 \u0622\u0646 IP \u0645\u062a\u0635\u0644 \u0628\u0627\u0634\u062f\u060c Connection \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u067e\u06cc\u062f\u0627 \u06a9\u0631\u062f\u0646 Process \u0645\u062a\u0635\u0644 \u0628\u0647 IP \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp | grep 203.0.113.50\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u06cc\u06a9 IP \u062e\u0627\u0635:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i @203.0.113.50\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0634\u0628\u06a9\u0647<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i -nP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0645\u0631\u0628\u0648\u0637 \u0628\u0647:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process<\/li>\n\n\n\n<li>PID<\/li>\n\n\n\n<li>User<\/li>\n\n\n\n<li>Protocol<\/li>\n\n\n\n<li>Local Address<\/li>\n\n\n\n<li>Remote Address<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0631\u062a\u0628\u200c\u0633\u0627\u0632\u06cc \u0628\u0631 \u0627\u0633\u0627\u0633 CPU:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux --sort=-%cpu | head -20\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631 \u0627\u0633\u0627\u0633 RAM:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux --sort=-%mem | head -20\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u0632 \/tmp \u0627\u062c\u0631\u0627 \u0634\u062f\u0647\u200c\u0627\u0646\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c \u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u0648\u0642\u062a:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/var\/tmp\n\/dev\/shm\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux | grep '\/tmp'\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux | grep '\/var\/tmp'\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux | grep '\/dev\/shm'\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u062c\u0631\u0627\u06cc\u06cc \u062f\u0631 \/tmp<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/tmp -type f -executable -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/tmp -type f -executable -ls\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/dev\/shm -type f -executable -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0633\u06cc\u0631\u0647\u0627 \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a\u060c \u0627\u0645\u0627 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0627\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u062d\u0630\u0641\u200c\u0634\u062f\u0647 \u06a9\u0647 \u0647\u0646\u0648\u0632 \u0627\u062c\u0631\u0627 \u0647\u0633\u062a\u0646\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u062a\u06a9\u0646\u06cc\u06a9\u200c\u0647\u0627\u06cc \u0631\u0627\u06cc\u062c \u0627\u06cc\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u067e\u0633 \u0627\u0632 \u0627\u062c\u0631\u0627 \u062d\u0630\u0641 \u0634\u0648\u062f \u0648\u0644\u06cc Process \u0647\u0645\u0686\u0646\u0627\u0646 \u062f\u0631 Memory \u0628\u0627\u0642\u06cc \u0628\u0645\u0627\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof +L1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof | grep deleted\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0641\u0627\u06cc\u0644 \u0627\u062c\u0631\u0627\u06cc\u06cc \u0646\u0627\u0634\u0646\u0627\u0633\u06cc \u0628\u0627 <code>(deleted)<\/code> \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f\u060c \u0622\u0646 Process \u0631\u0627 \u062f\u0642\u06cc\u0642\u200c\u062a\u0631 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0633\u06cc\u0633\u062a\u0645<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0642\u0637 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0627\u0631\u0627\u06cc Shell:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$7 !~ \/(nologin|false)$\/ {print $1,$3,$6,$7}' \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u0627\u0631\u0627\u06cc UID \u0635\u0641\u0631<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>awk -F: '$3 == 0 {print $1}' \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u062d\u0627\u0644\u062a \u0639\u0627\u062f\u06cc \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0641\u0642\u0637:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>root\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u06cc\u062f UID \u0628\u0631\u0627\u0628\u0631 \u0635\u0641\u0631 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Login\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>last\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc Login\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>lastb\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0628\u0631\u062e\u06cc \u062a\u0648\u0632\u06cc\u0639\u200c\u0647\u0627 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc Root \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lastb\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0622\u0646\u0644\u0627\u06cc\u0646<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>who\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>w\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc SSH Key\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc Persistence \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0646 SSH Key \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home -name authorized_keys -type f -print\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/root\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u062f\u06cc\u06af\u0631:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/home\/USERNAME\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0631 Key \u0646\u0627\u0634\u0646\u0627\u0633 \u0628\u0627\u06cc\u062f \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSH \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la \/root\/.ssh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>stat \/root\/.ssh\/authorized_keys\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0632\u0645\u0627\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Cron Job\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u06cc\u06a9\u06cc \u0627\u0632 \u0631\u0627\u06cc\u062c\u200c\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627\u06cc Persistence \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u06a9\u0627\u0631\u0628\u0631 \u0641\u0639\u0644\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cron \u06a9\u0627\u0631\u0628\u0631 Root:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo crontab -l\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Cron\u0647\u0627\u06cc \u0633\u06cc\u0633\u062a\u0645\u06cc<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>ls -la \/etc\/cron*\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/crontab\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Cron \u062a\u0645\u0627\u0645 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>for user in $(cut -f1 -d: \/etc\/passwd); do\n    echo \"===== $user =====\"\n    crontab -u \"$user\" -l 2&gt;\/dev\/null\ndone\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u0645\u0648\u0627\u0631\u062f\u06cc \u0645\u0627\u0646\u0646\u062f \u0627\u062c\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0627\u0632:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/tmp\n\/dev\/shm\ncurl\nwget\nbash -c\npython\nperl\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627 \u062f\u0642\u062a \u0628\u06cc\u0634\u062a\u0631\u06cc \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Systemd Service\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0647\u0627\u062c\u0645 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Backdoor \u0631\u0627 \u0628\u0647 \u0634\u06a9\u0644 Service \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 Service\u0647\u0627\u06cc \u0641\u0639\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl --type=service --state=running\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 Service\u0647\u0627\u06cc \u0641\u0639\u0627\u0644\u200c\u0634\u062f\u0647 \u0647\u0646\u06af\u0627\u0645 Boot<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service | grep enabled\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Service\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Service \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0646\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/systemd\/system\/\n\/usr\/lib\/systemd\/system\/\n\/lib\/systemd\/system\/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc\/systemd\/system -type f -ls\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u062d\u062a\u0648\u0627\u06cc \u06cc\u06a9 Service \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl cat suspicious.service\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u0645\u0686\u0646\u06cc\u0646:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status suspicious.service\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u06af\u0632\u06cc\u0646\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ExecStart=\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062a\u0648\u062c\u0647 \u0648\u06cc\u0698\u0647 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Timer\u0647\u0627\u06cc Systemd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Persistence \u0641\u0642\u0637 \u0628\u0627 Service \u0627\u0646\u062c\u0627\u0645 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 Timer \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Startup Script\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/rc.local\n\/etc\/profile\n\/etc\/bash.bashrc\n\/etc\/profile.d\/\n\/root\/.bashrc\n\/root\/.profile\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/rc.local\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062a\u063a\u06cc\u06cc\u0631\u06a9\u0631\u062f\u0647 \u062f\u0631 24 \u0633\u0627\u0639\u062a \u06af\u0630\u0634\u062a\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/etc -type f -mtime -1 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc <code>\/usr\/local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/usr\/local -type f -mtime -1 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc <code>\/var\/www<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/www -type f -mtime -1 -ls\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0686\u0646\u062f \u0631\u0648\u0632 \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -xdev -type f -mtime -3 2&gt;\/dev\/null\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u0628\u0632\u0631\u06af \u062e\u0631\u0648\u062c\u06cc \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0628\u0633\u06cc\u0627\u0631 \u0632\u06cc\u0627\u062f \u0628\u0627\u0634\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0647\u062a\u0631 \u0627\u0633\u062a \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0631\u0627 \u062c\u062f\u0627\u06af\u0627\u0646\u0647 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SUID<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SUID \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0627\u0644\u0627\u062a\u0631\u06cc \u0628\u0647 Process \u0628\u062f\u0647\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -perm -4000 -type f 2&gt;\/dev\/null\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f SUID \u0628\u0647\u200c\u062e\u0648\u062f\u06cc\u200c\u062e\u0648\u062f \u0645\u062e\u0631\u0628 \u0646\u06cc\u0633\u062a \u0648 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f \u0633\u06cc\u0633\u062a\u0645 \u0686\u0646\u06cc\u0646 Permission\u06cc \u062f\u0627\u0631\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u062f\u0641 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc <strong>\u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u06cc\u0627 \u062c\u062f\u06cc\u062f<\/strong> \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc SGID<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -perm -2000 -type f 2&gt;\/dev\/null\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc Hidden \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/tmp \/var\/tmp \/dev\/shm -type f -name \".*\" -ls\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Web Shell<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc Web Server\u0647\u0627 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 Backdoor\u0647\u0627 Web Shell \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 \u0633\u0627\u06cc\u062a \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/www -type f -mtime -7 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc PHP:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/var\/www -type f -name \"*.php\" -mtime -7 -ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0627\u062e\u06cc\u0631\u0627\u064b \u062a\u063a\u06cc\u06cc\u0631 \u06a9\u0631\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u0627\u06cc\u062f \u0628\u0627 \u0646\u0633\u062e\u0647 \u0633\u0627\u0644\u0645 \u06cc\u0627 Backup \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Pattern\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u062f\u0631 PHP<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u0627\u0648\u0644\u06cc\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep -RniE 'base64_decode|eval\\(|shell_exec|system\\(|passthru|proc_open|popen' \/var\/www 2&gt;\/dev\/null\n<\/code><\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u0648\u062c\u0648\u062f \u0627\u06cc\u0646 \u062a\u0648\u0627\u0628\u0639 \u0627\u0644\u0632\u0627\u0645\u0627\u064b \u0628\u0647 \u0645\u0639\u0646\u06cc Web Shell \u0646\u06cc\u0633\u062a. \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627\u06cc \u0633\u0627\u0644\u0645 \u0646\u06cc\u0632 \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0622\u0646\u200c\u0647\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u0646\u062f. \u0646\u062a\u06cc\u062c\u0647 \u0628\u0627\u06cc\u062f \u062f\u0633\u062a\u06cc \u062a\u062d\u0644\u06cc\u0644 \u0634\u0648\u062f.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Log\u0647\u0627\u06cc SSH<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu \/ Debian:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo grep sshd \/var\/log\/auth.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AlmaLinux \/ Rocky Linux:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo grep sshd \/var\/log\/secure\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Login \u0645\u0648\u0641\u0642<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep \"Accepted\" \/var\/log\/auth.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AlmaLinux:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep \"Accepted\" \/var\/log\/secure\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Failed Login<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>grep \"Failed password\" \/var\/log\/auth.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep \"Failed password\" \/var\/log\/secure\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Journal<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -p warning\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc SSH:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u ssh\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl -u sshd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0627\u062a\u0635\u0627\u0644\u200c\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u0628\u0627 tcpdump<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0646\u0627\u0634\u0646\u0627\u0633\u06cc \u0645\u0631\u062a\u0628\u0627\u064b \u0627\u0631\u062a\u0628\u0627\u0637 Outbound \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u062a\u0631\u0627\u0641\u06cc\u06a9 \u0631\u0627 Capture \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u062b\u0644\u0627\u064b \u0628\u0631\u0627\u06cc IP \u0645\u0634\u06a9\u0648\u06a9:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -i any host 203.0.113.50\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0630\u062e\u06cc\u0631\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -i any host 203.0.113.50 -w suspicious.pcap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 \u0641\u0627\u06cc\u0644 \u0631\u0627 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646 \u0628\u0627 Wireshark \u062a\u062d\u0644\u06cc\u0644 \u06a9\u0631\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc DNS Query\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u062e\u06cc \u0628\u062f\u0627\u0641\u0632\u0627\u0631\u0647\u0627 \u0628\u0631\u0627\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0628\u0627 \u0633\u0631\u0648\u0631 \u062e\u0627\u0631\u062c\u06cc \u0627\u0632 DNS \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Capture:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -i any port 53\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0628\u0627 TShark:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tshark -i any -f \"port 53\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0647 \u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u0639\u0645\u0648\u0644 \u06cc\u0627 Query\u0647\u0627\u06cc \u062a\u06a9\u0631\u0627\u0631\u0634\u0648\u0646\u062f\u0647 \u062a\u0648\u062c\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0627\u062a\u0635\u0627\u0644\u200c\u0647\u0627\u06cc \u062f\u0648\u0631\u0647\u200c\u0627\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Process \u0647\u0631 \u0686\u0646\u062f \u062f\u0642\u06cc\u0642\u0647 \u06cc\u06a9 Connection \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u062d\u062a\u0645\u0627\u0644\u0627\u064b \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cron Job<\/li>\n\n\n\n<li>Timer<\/li>\n\n\n\n<li>Service<\/li>\n\n\n\n<li>Agent<\/li>\n\n\n\n<li>Monitoring Software<\/li>\n\n\n\n<li>Malware<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0632\u0645\u0627\u0646 Connection \u0631\u0627 \u0628\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>journalctl\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648 Cron\u0647\u0627 \u0645\u0642\u0627\u06cc\u0633\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Network Namespace\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc \u062f\u0627\u0631\u0627\u06cc Docker \u06cc\u0627 Container \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Process\u0647\u0627 \u062f\u0627\u062e\u0644 Namespace \u062f\u06cc\u06af\u0631\u06cc \u0628\u0627\u0634\u0646\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip netns list\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Docker:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker ps\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker network ls\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Connection \u0645\u0634\u06a9\u0648\u06a9 \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 Container \u0628\u0627\u0634\u062f\u060c \u0646\u0647 Host \u0627\u0635\u0644\u06cc.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Container\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>docker ps -a\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc Image\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker images\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0631\u0633\u06cc Process\u0647\u0627\u06cc \u062f\u0627\u062e\u0644 Container:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>docker top CONTAINER_NAME\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Mount\u0647\u0627\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>mount\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>findmnt\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Mount \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0646\u0634\u0627\u0646\u0647\u200c\u0627\u06cc \u0627\u0632 Container\u060c Network Storage \u06cc\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u063a\u06cc\u0631\u0645\u0646\u062a\u0638\u0631\u0647 \u0628\u0627\u0634\u062f \u0648 \u0628\u0627\u06cc\u062f \u0628\u0627 \u0633\u0627\u062e\u062a\u0627\u0631 \u0639\u0627\u062f\u06cc \u0633\u0631\u0648\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Package\u0647\u0627\u06cc \u0646\u0635\u0628\u200c\u0634\u062f\u0647 \u0627\u062e\u06cc\u0631<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Debian \/ Ubuntu:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>grep \" install \" \/var\/log\/dpkg.log\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc DNF:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf history\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf history info\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0635\u062d\u062a Package\u0647\u0627<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0647\u0627\u06cc RPM:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rpm -Va\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 Debian \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u06cc\u062f \u0627\u0632 \u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f <code>debsums<\/code> \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06cc\u0646 \u0631\u0648\u0634 \u0628\u0631\u0627\u06cc \u0628\u0631\u0631\u0633\u06cc \u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 Package\u0647\u0627 \u0645\u0641\u06cc\u062f \u0627\u0633\u062a.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Rootkit \u0628\u0627 RKHunter<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0631 \u0635\u0648\u0631\u062a \u0646\u0635\u0628:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo rkhunter --check\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc \u0628\u0627 Chkrootkit<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo chkrootkit\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0647\u06cc\u0686\u200c\u06a9\u062f\u0627\u0645 \u0627\u0632 \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631\u0647\u0627 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u062a\u0636\u0645\u06cc\u0646 \u0646\u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u0633\u06cc\u0633\u062a\u0645 \u0633\u0627\u0644\u0645 \u0627\u0633\u062a\u061b \u062e\u0631\u0648\u062c\u06cc \u0622\u0646\u200c\u0647\u0627 \u0628\u0627\u06cc\u062f \u0647\u0645\u0631\u0627\u0647 \u0628\u0627 \u0628\u0631\u0631\u0633\u06cc \u062f\u0633\u062a\u06cc \u062a\u062d\u0644\u06cc\u0644 \u0634\u0648\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u06a9\u0646 \u0628\u0627 ClamAV<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0645\u062b\u0627\u0644:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo clamscan -r \/var\/www\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo clamscan -r \/tmp\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Lynis<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lynis audit system\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Lynis \u0628\u06cc\u0634\u062a\u0631 \u0627\u0628\u0632\u0627\u0631 Security Auditing \u0648 Hardening \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0636\u0639\u06cc\u0641 \u06cc\u0627 \u0645\u0648\u0627\u0631\u062f \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u0628\u0631\u0631\u0633\u06cc \u0631\u0627 \u0645\u0634\u062e\u0635 \u06a9\u0646\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Integrity \u0628\u0627 AIDE<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 AIDE \u0627\u0632 \u0642\u0628\u0644 \u0631\u0648\u06cc \u0633\u06cc\u0633\u062a\u0645 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo aide --check\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">AIDE \u0632\u0645\u0627\u0646\u06cc \u0628\u06cc\u0634\u062a\u0631\u06cc\u0646 \u0627\u0631\u0632\u0634 \u0631\u0627 \u062f\u0627\u0631\u062f \u06a9\u0647 Database \u0633\u0627\u0644\u0645 \u0622\u0646 <strong>\u0642\u0628\u0644 \u0627\u0632 \u062d\u0627\u062f\u062b\u0647<\/strong> \u0627\u06cc\u062c\u0627\u062f \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0631\u0631\u0633\u06cc Auditd<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Auditd \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status auditd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0634\u0627\u0647\u062f\u0647 Event\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -ts today\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u0627 \u0628\u0631\u0627\u06cc \u0641\u0627\u06cc\u0644 \u0645\u0634\u062e\u0635:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ausearch -f \/etc\/passwd\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0627\u0631\u062a\u0628\u0627\u0637 \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0627 \u06cc\u06a9 \u0631\u0648\u0634 \u0633\u0631\u06cc\u0639<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0628\u062a\u062f\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 Connection \u0646\u0627\u0634\u0646\u0627\u0633\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i -nP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0633\u067e\u0633 PID \u0631\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -fp PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0633\u06cc\u0631 Process:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>readlink -f \/proc\/PID\/exe\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>tr '\\0' ' ' &lt; \/proc\/PID\/cmdline\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Parent:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps -o pid,ppid,user,cmd -p PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0639\u062f Persistence \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>crontab -l\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-unit-files --type=service | grep enabled\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u06af\u0631 Backdoor \u067e\u06cc\u062f\u0627 \u0634\u062f \u0686\u0647 \u06a9\u0646\u06cc\u0645\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0634\u0648\u0627\u0647\u062f \u0642\u0648\u06cc \u0627\u0632 \u0646\u0641\u0648\u0630 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f\u060c \u0641\u0642\u0637 \u062d\u0630\u0641 \u0641\u0627\u06cc\u0644 \u0645\u0634\u06a9\u0648\u06a9 \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0627\u0648\u0644\u06cc\u0647:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\u0633\u0631\u0648\u0631 \u0631\u0627 \u0627\u0632 \u0634\u0628\u06a9\u0647 \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc \u0627\u06cc\u0632\u0648\u0644\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0642\u0628\u0644 \u0627\u0632 \u062d\u0630\u0641 \u0634\u0648\u0627\u0647\u062f\u060c Log \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0644\u0627\u0632\u0645 \u0631\u0627 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>IP\u0647\u0627 \u0648 Process\u0647\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0631\u0627 \u062b\u0628\u062a \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Credential\u0647\u0627\u06cc \u062f\u0631 \u0645\u0639\u0631\u0636 \u062e\u0637\u0631 \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u06cc\u062f.<\/li>\n\n\n\n<li>SSH Key\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>User\u0647\u0627\u06cc \u063a\u06cc\u0631\u0645\u062c\u0627\u0632 \u0631\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Persistence Mechanism \u0631\u0627 \u062d\u0630\u0641 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0627\u0648\u0644\u06cc\u0647 \u0631\u0627 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0633\u06cc\u0633\u062a\u0645 \u0648 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u0647\u0627 \u0631\u0627 Patch \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u062f\u0631 \u0646\u0641\u0648\u0630\u0647\u0627\u06cc \u062c\u062f\u06cc\u060c Rebuild \u0633\u0631\u0648\u0631 \u0627\u0632 \u0645\u0646\u0628\u0639 \u0633\u0627\u0644\u0645 \u0631\u0627 \u062f\u0631 \u0646\u0638\u0631 \u0628\u06af\u06cc\u0631\u06cc\u062f.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u0631\u0627 \u0641\u0642\u0637 Kill \u06a9\u0631\u062f\u0646 Process \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a\u061f<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>kill PID\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a Process \u0686\u0646\u062f \u062b\u0627\u0646\u06cc\u0647 \u0628\u0639\u062f \u062f\u0648\u0628\u0627\u0631\u0647 \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u062f\u0644\u06cc\u0644 \u0622\u0646 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cron<\/li>\n\n\n\n<li>Systemd<\/li>\n\n\n\n<li>Supervisord<\/li>\n\n\n\n<li>Docker<\/li>\n\n\n\n<li>Kubernetes<\/li>\n\n\n\n<li>Startup Script<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0627\u0634\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0628\u0627\u06cc\u062f <strong>\u0645\u0646\u0628\u0639 \u0627\u062c\u0631\u0627\u06cc Process<\/strong> \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u0648\u062f\u060c \u0646\u0647 \u0641\u0642\u0637 \u062e\u0648\u062f Process.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0627\u0634\u062a\u0628\u0627\u0647\u0627\u062a \u0631\u0627\u06cc\u062c<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kill \u06a9\u0631\u062f\u0646 Process \u0628\u062f\u0648\u0646 \u0628\u0631\u0631\u0633\u06cc Parent<\/li>\n\n\n\n<li>\u062d\u0630\u0641 \u0641\u0627\u06cc\u0644 \u0642\u0628\u0644 \u0627\u0632 \u062b\u0628\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a<\/li>\n\n\n\n<li>\u0641\u0631\u0636 \u0645\u062e\u0631\u0628 \u0628\u0648\u062f\u0646 \u0647\u0631 Connection \u062e\u0627\u0631\u062c\u06cc<\/li>\n\n\n\n<li>\u0627\u0639\u062a\u0645\u0627\u062f \u06a9\u0627\u0645\u0644 \u0628\u0647 \u06cc\u06a9 Antivirus<\/li>\n\n\n\n<li>\u0646\u0627\u062f\u06cc\u062f\u0647 \u06af\u0631\u0641\u062a\u0646 Cron Job\u0647\u0627<\/li>\n\n\n\n<li>\u0628\u0631\u0631\u0633\u06cc \u0646\u06a9\u0631\u062f\u0646 SSH Key\u0647\u0627<\/li>\n\n\n\n<li>\u067e\u0627\u06a9 \u06a9\u0631\u062f\u0646 Log\u0647\u0627<\/li>\n\n\n\n<li>Reboot \u06a9\u0631\u062f\u0646 \u0633\u0631\u0648\u0631 \u0642\u0628\u0644 \u0627\u0632 \u062c\u0645\u0639\u200c\u0622\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a<\/li>\n\n\n\n<li>\u062a\u0635\u0648\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0628\u0633\u062a\u0647 \u0628\u0648\u062f\u0646 \u067e\u0648\u0631\u062a\u200c\u0647\u0627\u06cc \u0648\u0631\u0648\u062f\u06cc \u06cc\u0639\u0646\u06cc Backdoor \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0628\u0647\u062a\u0631\u06cc\u0646 \u0631\u0648\u0634\u200c\u0647\u0627<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Baseline \u0645\u0634\u062e\u0635\u06cc \u0627\u0632 \u067e\u0648\u0631\u062a\u200c\u0647\u0627 \u0648 Process\u0647\u0627\u06cc \u0639\u0627\u062f\u06cc \u0633\u0631\u0648\u0631 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f.<\/li>\n\n\n\n<li>\u0627\u0632 Auditd \u0648 AIDE \u0642\u0628\u0644 \u0627\u0632 \u0631\u062e\u062f\u0627\u062f \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Log\u0647\u0627 \u0631\u0627 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u062f\u06cc\u06af\u0631\u06cc \u0646\u06cc\u0632 \u0630\u062e\u06cc\u0631\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Login\u0647\u0627\u06cc SSH \u0631\u0627 \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u062a\u063a\u06cc\u06cc\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>Outbound Traffic \u0631\u0627 \u0646\u06cc\u0632 \u0645\u0627\u0646\u0646\u062f Inbound Traffic \u0645\u0627\u0646\u06cc\u062a\u0648\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0636\u0631\u0648\u0631\u06cc \u0631\u0627 \u063a\u06cc\u0631\u0641\u0639\u0627\u0644 \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>SSH Key\u0647\u0627 \u0648 User\u0647\u0627 \u0631\u0627 \u062f\u0648\u0631\u0647\u200c\u0627\u06cc Audit \u06a9\u0646\u06cc\u062f.<\/li>\n\n\n\n<li>\u0627\u0632 EDR\/HIDS \u062f\u0631 \u0633\u0631\u0648\u0631\u0647\u0627\u06cc \u062d\u0633\u0627\u0633 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0686\u06a9\u200c\u0644\u06cc\u0633\u062a \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Backdoor<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Listening Port\u0647\u0627<\/li>\n\n\n\n<li>Established Connection\u0647\u0627<\/li>\n\n\n\n<li>Outbound Traffic<\/li>\n\n\n\n<li>Process\u0647\u0627<\/li>\n\n\n\n<li>Parent Process<\/li>\n\n\n\n<li><code>\/proc\/PID\/exe<\/code><\/li>\n\n\n\n<li>Cron Jobs<\/li>\n\n\n\n<li>Systemd Services<\/li>\n\n\n\n<li>Systemd Timers<\/li>\n\n\n\n<li>SSH Keys<\/li>\n\n\n\n<li>User Accounts<\/li>\n\n\n\n<li>UID 0 Accounts<\/li>\n\n\n\n<li>Login Logs<\/li>\n\n\n\n<li><code>\/tmp<\/code><\/li>\n\n\n\n<li><code>\/var\/tmp<\/code><\/li>\n\n\n\n<li><code>\/dev\/shm<\/code><\/li>\n\n\n\n<li>Web Root<\/li>\n\n\n\n<li>\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SUID<\/li>\n\n\n\n<li>Package Integrity<\/li>\n\n\n\n<li>Docker Containers<\/li>\n\n\n\n<li>DNS Query\u0647\u0627<\/li>\n\n\n\n<li>Audit Logs<\/li>\n\n\n\n<li>File Integrity<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062f\u0633\u062a\u0648\u0631\u0627\u062a \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u062f\u0631 \u06cc\u06a9 \u0646\u06af\u0627\u0647<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u067e\u0648\u0631\u062a\u200c\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tulpn\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connection\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tnp state established\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process\u0647\u0627\u06cc \u0634\u0628\u06a9\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i -nP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ps aux\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Process Tree:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>pstree -ap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cron:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo crontab -l\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Service\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl --type=service --state=running\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Timer\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl list-timers --all\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Login\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>last\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">SSH Key\u0647\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/root \/home -name authorized_keys -type f -print\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062d\u0630\u0641\u200c\u0634\u062f\u0647 \u062f\u0631 \u062d\u0627\u0644 \u0627\u062c\u0631\u0627:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof +L1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Capture \u0634\u0628\u06a9\u0647:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo tcpdump -i any\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u0645\u0637\u0627\u0644\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/systemd.io\/\" data-type=\"link\" data-id=\"https:\/\/systemd.io\/\" target=\"_blank\" rel=\"noopener\">\u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0631\u0633\u0645\u06cc systemd \u0628\u0631\u0627\u06cc Service \u0648 Timer\u0647\u0627<\/a><\/li>\n\n\n\n<li><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u062c\u0645\u0639\u200c\u0628\u0646\u062f\u06cc<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Backdoor \u062f\u0631 \u0644\u06cc\u0646\u0648\u06a9\u0633 \u0641\u0642\u0637 \u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9 Antivirus \u06cc\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06cc\u06a9 Process \u0627\u0646\u062c\u0627\u0645 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f. \u0628\u0631\u0631\u0633\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u0628\u0627\u06cc\u062f \u0686\u0646\u062f\u06cc\u0646 \u0628\u062e\u0634 \u0633\u06cc\u0633\u062a\u0645 \u0634\u0627\u0645\u0644 <strong>\u0634\u0628\u06a9\u0647\u060c Process\u0647\u0627\u060c \u06a9\u0627\u0631\u0628\u0631\u0627\u0646\u060c SSH\u060c Cron\u060c Systemd\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0648 Log\u0647\u0627<\/strong> \u0631\u0627 \u067e\u0648\u0634\u0634 \u062f\u0647\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06cc\u06a9\u06cc \u0627\u0632 \u0628\u0647\u062a\u0631\u06cc\u0646 \u0646\u0642\u0627\u0637 \u0634\u0631\u0648\u0639\u060c \u0627\u062c\u0631\u0627\u06cc:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ss -tunap\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0648:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo lsof -i -nP\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0634\u0628\u06a9\u0647\u200c\u0627\u06cc \u0648 \u0633\u067e\u0633 \u0628\u0631\u0631\u0633\u06cc PID\u060c Parent Process \u0648 Persistence Mechanism \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 \u0647\u0631 Connection \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0633\u062a.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0627\u06af\u0631 \u0634\u0648\u0627\u0647\u062f \u0646\u0641\u0648\u0630 \u062c\u062f\u06cc \u0645\u0634\u0627\u0647\u062f\u0647 \u0634\u0648\u062f\u060c \u062d\u0630\u0641 \u0641\u0627\u06cc\u0644 \u06cc\u0627 Process \u0645\u0634\u06a9\u0648\u06a9 \u0628\u0647\u200c\u062a\u0646\u0647\u0627\u06cc\u06cc \u06a9\u0627\u0641\u06cc \u0646\u06cc\u0633\u062a \u0648 \u0628\u0627\u06cc\u062f \u0639\u0644\u062a \u0627\u0648\u0644\u06cc\u0647 \u0646\u0641\u0648\u0630\u060c \u0631\u0648\u0634 Persistence \u0648 \u0645\u06cc\u0632\u0627\u0646 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0647\u0627\u062c\u0645 \u0646\u06cc\u0632 \u0628\u0631\u0631\u0633\u06cc \u0634\u0648\u062f.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u06a9\u06cc\u0627\u0646 \u067e\u0648\u0631<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0642\u062f\u0645\u0647 \u06cc\u06a9\u06cc \u0627\u0632 \u0645\u0647\u0645\u200c\u062a\u0631\u06cc\u0646 \u0648\u0638\u0627\u06cc\u0641 \u0645\u062f\u06cc\u0631 \u0633\u0631\u0648\u0631\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc Backdoor\u0647\u0627\u060c \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0646\u0627\u0634\u0646\u0627\u0633 \u0648 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0634\u0628\u06a9\u0647\u200c\u0627\u06cc \u0645\u0634\u06a9\u0648\u06a9 \u0627\u0633\u062a. Backdoor \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0639\u0627\u062f\u06cc \u0648\u0631\u0648\u062f\u060c \u062f\u0648\u0628\u0627\u0631\u0647 \u0628\u0647 \u0633\u0631\u0648\u0631 \u062f\u0633\u062a\u0631\u0633\u06cc \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f \u06cc\u0627 \u0627\u0631\u062a\u0628\u0627\u0637\u06cc \u0645\u062e\u0641\u06cc \u0628\u0627 \u06cc\u06a9 \u0633\u06cc\u0633\u062a\u0645 \u062e\u0627\u0631\u062c\u06cc \u0628\u0631\u0642\u0631\u0627\u0631 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0627\u0631\u062a\u0628\u0627\u0637\u0627\u062a \u0645\u0645\u06a9\u0646 \u0627\u0633\u062a \u0627\u0632 \u0637\u0631\u06cc\u0642: \u0627\u06cc\u062c\u0627\u062f \u0634\u0648\u0646\u062f. \u062f\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647\u060c \u0631\u0648\u0634\u200c\u0647\u0627\u06cc [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":20714,"parent":17595,"menu_order":49,"comment_status":"open","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","_llm_markdown_disabled":false},"doc_tag":[],"doc_badge":[],"class_list":["post-20711","docs","type-docs","status-publish","has-post-thumbnail","hentry"],"acf":[],"author_avatar":"https:\/\/maralhost.com\/kb\/wp-content\/litespeed\/avatar\/c59fc140fa83b542ed78a005738a60da.jpg?ver=1794183946","author_name":"Shayan Kianpoor","_links":{"self":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/20711","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/comments?post=20711"}],"version-history":[{"count":4,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/20711\/revisions"}],"predecessor-version":[{"id":20740,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/20711\/revisions\/20740"}],"up":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/docs\/17595"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media\/20714"}],"wp:attachment":[{"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/media?parent=20711"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_tag?post=20711"},{"taxonomy":"doc_badge","embeddable":true,"href":"https:\/\/maralhost.com\/kb\/wp-json\/wp\/v2\/doc_badge?post=20711"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}