Linux Incident Surface

Walkthrough summary

Linux Incident Surface TryHackMe walkthrough with 11 answered prompts and lab methodology notes.

Sample prompts covered

• Connect with the lab. How many files and folders are in the /home/activities/processes directory?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the remote IP to which the process netcom establishes the connection?
  Open the walkthrough page to inspect the full answer and command flow.
• Update the osquery command. What is the remote port the netcom process is communicating to?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the default path that contains all the installed services in Linux?
  Open the walkthrough page to inspect the full answer and command flow.
• Which suspicious service was found to be running on the host?
  Open the walkthrough page to inspect the full answer and command flow.