Area 07

Live Response

When a host cannot be taken offline, live response captures volatile state before it disappears. This area shows how to work from trusted binaries, what /proc reveals about each process, how to recover a deleted running binary, and why userland tools can lie on a rootkitted host.

/proc/<pid>/exe
ss -tanp
/proc/modules

Guides in this area

07 · Live Response

Linux Live Response: Triage Through /proc and Volatile Data

A practical Linux live response workflow: trusted binaries, logging your actions, and triaging processes, sockets and modules through /proc before shutdown.

live-responseproctriage

Sep 28, 2026

Artifact cheat sheets

Where each artifact lives, what it proves, its timestamps and the tools to parse it.

/proc Live Artifacts: Processes, Sockets and Deleted FilesThe /proc pseudo-filesystem on a live Linux host: process command lines, environments, open files, memory maps, sockets and deleted binaries.
Linux Kernel Modules: lsmod, Taint Flags and Boot ConfigLoaded and configured Linux kernel modules (/proc/modules, /sys/module, modules-load.d, modprobe.d, taint flags) for spotting rootkits and module persistence.
/tmp, /var/tmp and /dev/shm: Linux Staging DirectoriesWorld-writable Linux directories attackers use to stage tools: tmpfs versus disk, cleanup ages, noexec, memfd fileless execution and what survives reboot.
NetworkManager Profiles and State: Linux Network HistoryNetworkManager connection profiles, timestamps, seen BSSIDs and DHCP leases on Linux: which networks, VPNs and Wi-Fi a host joined and when.
eBPF Programs and Pinned Maps: Linux Kernel ImplantsLoaded eBPF programs, pinned objects in /sys/fs/bpf and their loaders on disk: how eBPF rootkits and BPF backdoors hide on Linux and how to find them.
dmesg, kern.log and the Kernel Ring Buffer on LinuxThe Linux kernel log: dmesg ring buffer, kern.log, messages, journal and pstore, plus the segfault, OOM kill and promiscuous mode lines that matter.
sysctl, Boot Parameters and binfmt_misc on LinuxLinux kernel settings in sysctl.d, /proc/sys and the boot command line: core_pattern and modprobe hijacks, weakened protections, ip_forward, binfmt_misc.
/etc/hosts, nsswitch.conf and resolv.conf on LinuxLinux name resolution files as evidence: /etc/hosts redirects, resolv.conf and systemd-resolved DNS changes, and NSS module backdoors in nsswitch.conf.

All areas