Lion Cipher Lab
Triage a live Linux host — the first responder's read-only sweep
- Digital Forensics & IR (DFIR)
- Beginner
- ~30 min
- Free · no account required
Why it matters
When a responder is handed a machine that might be compromised, the first thing they do is not run a scanner or pull a disk image — it is a fast, careful look at the live system to decide what is going on and what to preserve. That live triage answers a handful of questions in order: who is on this box, what is running, what is it talking to, what changed recently, and what is set to run later. Volatile evidence — the process list, open network connections, logged-in sessions — exists only while the machine is running and is gone the moment it powers off, so a responder captures it first and…
What you'll learn
- live response
- read-only host triage
- reading logged-in users with who/w
- reviewing processes with ps
- listing network connections and listening ports with ss
- finding recently modified files with find
- checking cron and systemd timers
- recording command output
- knowing your baseline
Steps in this lab
- Two rules before you touch the box: read only, and record everything
- Who is on this machine right now?
- What is running? Read the process list
- What is it talking to? Connections and listening ports
- What changed recently? Find files by modification time
- What is scheduled to run later? Cron jobs
- The other scheduler and the auto-start spots: systemd timers and enabled services
- Why the sweep works — and why you practised it on a machine you trust