LinTriage

Technical Summary

lin-triage.sh is a lightweight, highly portable Bash script designed to gather forensic evidence and indicators of compromise (IOCs) in enterprise Linux systems. The tool performs a baseline scan in less than 10 seconds, outputting a structured Markdown report ready for analyst review or import into SIEM/SOC tools.

Security Objectives

During active incident response, the first few hours are vital. Data collection must be rapid, reliable, and non-destructive, preserving file states and memory indicators without triggering heavy resource footprints on the production host.

Forensic & Collection Architecture

The utility automates triage across five core forensic vectors:

1. Identity & Account Audits: Scans active logged-in users, audits /etc/passwd for unauthorized UID 0 (root-level) accounts, reviews user SSH authorized_keys, and processes recent login histories (last / lastb).
2. Socket & Port Reconnaissance: Identifies active listening TCP/UDP sockets mapped to active PIDs and process names, as well as active outbound established connections.
3. System Persistence Inspection: Reviews system crontabs, user cron jobs, and scheduled directories to locate backdoor vectors.
4. File System Modification Audit: Automatically locates files modified within the last 7 days in temp paths (/tmp, /var/tmp, /dev/shm) and public web root directories.
5. Event Log Scraping: Searches system authorization logs (auth.log, secure) for brute-force attacks and elevated commands run via `sudo`.

Operational Guide & Commands

The tool is designed to run directly with no compiled dependency requirements:

# 1) Download directly and set execute permissions
curl -O https://perciocastelo.com.br/assets/downloads/lin-triage.sh
chmod +x lin-triage.sh

# 2) Run the script to produce a formatted Markdown report
./lin-triage.sh

# 3) Secure inline execution directly via Curl
bash <(curl -fsSL https://perciocastelo.com.br/assets/downloads/lin-triage.sh)

Operational Safety

• Read-Only Baseline: The script performs audit scans and does not delete or alter any files.
• Privilege Isolation: Can run as an unprivileged user, safely skipping tests that require root permissions (e.g. reading log files).
• No Dependencies: Written in pure POSIX Bash using native utilities.