Live URL: https://aminbiography.github.io/linux-cti/
This repository documents essential Linux knowledge required for Cyber Threat Intelligence (CTI), SOC operations, threat hunting, and security automation. Each section includes commands, explanations, and expected outputs.
filesystem, permissions, users, processes, networking, logs, services,
bash scripting, package management, security, monitoring
Common Linux distributions used in CTI and security:
Check OS details:
cat /etc/os-release
Output (example):
NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
Check current user:
whoami
Output:
amein
Check hostname:
hostname
Output:
cti-lab
Key directories:
| Directory | Purpose |
|---|---|
| / | Root filesystem |
| /etc | Configuration files |
| /var | Logs, spool files |
| /home | User home directories |
| /tmp | Temporary files |
| /usr | User binaries and libraries |
List root directories:
ls /
Output (example):
bin boot dev etc home lib proc tmp usr var
Create directories and files:
mkdir cti-labs
cd cti-labs
touch report.txt
List files:
ls -l
Output:
-rw-r--r-- 1 amein amein 0 report.txt
echo "Threat report draft" > report.txt
cat report.txt
Output:
Threat report draft
Other useful commands:
less report.txt
head report.txt
tail report.txt
Check permissions:
ls -l report.txt
Output:
-rw-r--r-- 1 amein amein report.txt
Change permissions:
chmod 600 report.txt
Change ownership (requires sudo):
sudo chown root:root report.txt
View current user ID:
id
Output:
uid=1000(amein) gid=1000(amein) groups=1000(amein)
List users:
cat /etc/passwd
List running processes:
ps aux
Output (sample):
root 1023 0.0 systemd
amein 2345 0.1 bash
Real-time monitoring:
top
Kill a process:
kill 2345
Check disk usage:
df -h
Output:
Filesystem Size Used Avail Use%
/dev/sda1 50G 12G 36G 25%
Check directory size:
du -sh /var/log
Check IP address:
ip a
Output (example):
inet 192.168.1.20/24
Check active connections:
ss -tulnp
ping google.com
Output:
64 bytes from google.com: icmp_seq=1 ttl=117
DNS lookup:
nslookup google.com
Update package list:
sudo apt update
Install a package:
sudo apt install curl
Verify installation:
curl --version
System logs:
ls /var/log
Authentication logs:
sudo cat /var/log/auth.log
Output (example):
Failed password for invalid user admin from 45.33.32.156
grep "Failed password" /var/log/auth.log
Output:
Failed password for root from 45.33.32.156
Recursive search:
grep -R "malware" /var/log
export CTI_LEVEL=advanced
echo $CTI_LEVEL
Output:
advanced
Create script:
nano scan.sh
Script content:
#!/bin/bash
echo "Starting CTI scan..."
date
Make executable:
chmod +x scan.sh
./scan.sh
Output:
Starting CTI scan...
Mon Dec 15 07:30:12 UTC 2025
if [ -f report.txt ]; then
echo "Report exists"
else
echo "Report missing"
fi
Output:
Report exists
for ip in 8.8.8.8 1.1.1.1; do
ping -c 1 $ip
done
Output (example):
PING 8.8.8.8
PING 1.1.1.1
Edit cron jobs:
crontab -e
Example:
0 2 * * * /home/amein/scan.sh
Runs script daily at 02:00.
Check service status:
systemctl status ssh
Start / stop service:
sudo systemctl restart ssh
sha256sum report.txt
Output:
a3f5c1e7f2d9... report.txt
Used in malware analysis and IOC validation.
tar -czvf logs.tar.gz /var/log
Extract:
tar -xzvf logs.tar.gz
Find world-writable files:
find / -perm -002 -type f 2>/dev/null
sudo tcpdump -i eth0
Save capture:
sudo tcpdump -i eth0 -w traffic.pcap
Check open ports:
sudo netstat -tulnp
Check firewall:
sudo ufw status
ssh user@192.168.1.10
Generate SSH key:
ssh-keygen
sudo -l
Output:
User amein may run the following commands
Critical for privilege escalation assessments.
Install tools:
sudo apt install strings binutils
Extract strings:
strings suspicious.bin
inotifywait -m /var/log
Detects file changes in real time.
This repository is designed to be:
Just tell me how deep you want to go.