Analyzing malicious activity

Let's take a closer look at the last example. We saw that we had several SSH connections. We can analyze the processes that might be related to that. To do that, let's use the linux_pstree plugin and add sshd process identifiers – 29897 and 23251:

Figure 9.12 – Volatility linux_pstree

In Figure 9.12, we can see that the child processes of sshd are bash as well as sudo, which means that elevated privileges were used. In this case, we can search the bash history as well as dump and analyze the memory of these processes.

We start with the bash history. For this, we will use the linux_bash plugin:

Figure 9.13 – Bash history

Here, we can see that someone was working with MySQL and WordPress, and we can see the interaction with the site-info.php file, as well as the nyan-cat.gif download associated with the bash process with the 30112 PID.

We can check which user ran bash...