Overview

• How do you know if there's been an intrusion on your network? It's not an easy task to identify all of the evidence that might point to an intrusion. In these videos I describe sources of information that can be used to identify whether a Linux system has been victim to an intrusion. Note that the same principles apply to any system, only the location of the evidence will be different.

Videos

• Gathering Evidence of an Intrusion, 1 of 2
• Gathering Evidence of an Intrusion, 2 of 2
• Indicators of an Intrusion

Notes

• Intrusion notes 

External Readings

• Dr. Craiger's Debian-based evidence commands 

• F. Imtiaz. Intrusion Detection System Logs as Evidence and legal aspects.

• SANS Intrusion Detection FAQ 

• Intrusion Detection for Windows