Detect and remove trojans on Linux | Security Center - Security Center

This topic describes best practices for detecting and removing trojans on Linux.

Background

When a Linux system has security vulnerabilities or insufficient security hardening measures, trojans may be implanted. After you remove trojans, improve your security posture through security patch hardening, system permission hardening, operation auditing, and log analysis.

Step 1: Use Security Center to detect and remove trojans

Use Security Center security alerts to promptly remove trojan threats. For more information, see View and handle security alerts.
Promptly fix system vulnerabilities and harden system security. For more information, see View and handle vulnerabilities.

Step 2: Investigate indicators of compromise

Run last and lastlog to view recent login accounts and login times, and identify suspicious accounts.
Run grep -i Accepted /var/log/secure to find IP addresses of successful remote logons.

Run the following commands to check for scheduled tasks:

cat /var/spool/cron/
cat /etc/cron.hourly
cat /etc/crontab

Run find / -ctime 1 to find trojan files based on the last status change time.
Check /etc/passwd and /etc/shadow to verify whether suspicious users exist.
Check /tmp, /var/tmp, and /dev/shm for trojan files. These directories have 1777 permissions and are common targets for trojan uploads.
Check logs of internet-facing services for anomalies, such as Tomcat and NGINX.
Run service --status-all | grep running to check running services for anomalies.
Run chkconfig --list | grep :on to check auto-start services for anomalies.
Run ls -lt /etc/init.d/ | head to check for suspicious startup scripts.

Step 3: Common trojan detection commands

Command	Description
ps, top	View running processes and system resource usage to identify abnormal processes.
pstree	Display process relationships in a tree format.
lsof	View files opened by processes, identify which processes occupy specific files or directories, and check which processes opened specific ports.
netstat	View all listening ports and network connections to identify IP addresses with excessive connections.
iftop	Monitor real-time TCP network traffic, analyze inbound and outbound traffic with sorting, and identify IP addresses with abnormal traffic.
nethogs	Monitor per-process network traffic sorted from high to low to identify processes with abnormal traffic.
strace	Trace system calls made by a process to analyze trojan behavior.
strings	Output printable strings from a file for trojan analysis.