Investigation Scenario 🔎

You receive an alert that a Linux system is experiencing consistently high CPU usage. Running crontab -l for the related user, you see the pictured entry...

However, when you check again, the crontab entry is gone.

The file listed in the cron job is not currently available at that URL.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC