@chrissanders88@infosec.exchange
2026-07-07 14:02 UTC
Investigation Scenario 🔎
You’ve found ~/.config/systemd/user/dbus-update.service enabled for a user account on an Ubuntu system. The service executes ~/.local/bin/dbus-update, an ELF binary that isn’t owned by any installed package.
What do you look for to investigate whether an incident occurred?
#InvestigationPath #DFIR #SOC
Replies (1)
-
@chrissanders88@infosec.exchange 2026-07-07 14:02
If you're not familiar with these files or Linux persistence, this scenario is a good opportunity to practice your research skills. Good analysts take novelty cues like this and leverage them to build their tradecraft knowledge.