Rastislav ₡ore rastislavcore

Linux Weird-Behavior Impact Check

Use this checklist when a Linux host shows unexplained or suspicious behavior and you need to determine what was impacted. The goal is triage and evidence collection: identify active sessions, suspicious processes/connections, persistence, credential exposure, and the likely timeline.

Important: If compromise is plausible, avoid making unnecessary changes before collecting evidence. Commands can alter timestamps, logs, process state, or other evidence. For important systems, consider isolating the host at the network layer and preserving a disk/memory image before remediation.

1. Who is on the system right now?

Check before changing anything. An active intruder may be able to observe commands you run.

	#!/usr/bin/env bash
	set -euo pipefail

	latest_branch=$(
	git for-each-ref refs/heads \
	--sort=-committerdate \
	--format='%(refname:short)' \
	\| grep -E '.+/.+-[0-9]+$' \
	\| head -n 1 \|\| true
	)

	# Ask for ICAN Address input
	$ICAN_ADDRESS = Read-Host "Enter ICAN Address for validation"
	$CLEANED_ICAN = $ICAN_ADDRESS.ToUpper().Replace(" ", "")

	# Validate format
	if (-not $CLEANED_ICAN -match '^(CB\|CE\|AB)[0-9]{2}[A-F0-9]{40}$') {
	Write-Host "Invalid ICAN Address format!"
	exit 1
	}

	#!/bin/bash

	read -p "Enter ICAN Address for validation: " ICAN_ADDRESS
	CLEANED_ICAN=$(echo $ICAN_ADDRESS \| tr '[:lower:]' '[:upper:]')
	CLEANED_ICAN=${CLEANED_ICAN//[[:blank:]]/}

	if ! [[ $CLEANED_ICAN =~ ^(CB\|CE\|AB)[0-9]{2}[A-F0-9]{40}$ ]]; then
	echo "Invalid ICAN Address format!"
	exit 1
	fi

	<!DOCTYPE html>
	<html>
	<head>
	<title>GitHub User Search</title>
	</head>
	<body>
	<h1>GitHub User Search</h1>
	<form id="searchForm">
	<label for="username">Username:</label>
	<input type="text" id="username" name="username" required>

	<?xml version="1.0" encoding="UTF-8"?>
	<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
	<plist version="1.0">
	<dict>
	<key>BackgroundAlphaInactive</key>
	<real>0.6973314606741573</real>
	<key>BackgroundBlurInactive</key>
	<real>0.30358146365438954</real>
	<key>BackgroundColor</key>
	<data>

	#!/bin/bash

	echo "$(tput setaf 3)●$(tput sgr 0) We will start the script with the SUDO mode! You can stop it and proceed manually if needed."
	sudo -v

	echo "$(tput setaf 3)●$(tput sgr 0) Stopping the service."
	systemctl stop coreverif.service

	echo "$(tput setaf 3)●$(tput sgr 0) Disabling the service."
	systemctl disable coreverif.service

	#!/bin/bash
	curl https://raw.githubusercontent.com/bchainhub/core-license/master/LICENSE -o LICENSE
	git init
	git add LICENSE
	git commit -m "CORE License"
	git branch -M main
	git remote add origin git@github.com:username/repo.git
	git push -u origin main

	#!/bin/bash
	echo "# Readme" >> README.md
	git init
	git add Readme.md
	git commit -m "Readme file"
	git branch -M main
	git remote add origin git@github.com:username/repo.git
	git push -u origin main

	parse_json()
	{
	echo $1 \| \
	sed -e 's/[{}]/''/g' \| \
	sed -e 's/", "/'\",\"'/g' \| \
	sed -e 's/" ,"/'\",\"'/g' \| \
	sed -e 's/" , "/'\",\"'/g' \| \
	sed -e 's/","/'\"---SEPERATOR---\"'/g' \| \
	awk -F=':' -v RS='---SEPERATOR---' "\$1~/\"$2\"/ {print}" \| \
	sed -e "s/\"$2\"://" \| \