This is one of the most thorough triage playbooks I've read here - the ctime-vs-mtime timestomping point and catching the pty-less sshd session via ss instead of w are both things most writeups skip entirely. One gap worth flagging for anyone running this against a cloud-hosted replica specifically: none of the persistence vectors here check the instance metadata service. If db-prod-01 is EC2, an attacker with even a few seconds of shell access can curl 169.254.169.254/latest/meta-data/iam/security-credentials/ and walk off with temporary IAM credentials that keep working long after you've frozen the box and rebuilt from known-good IaC - no local persistence needed at all. Worth checking VPC flow logs or CloudTrail for that request alongside the /proc and ld.so.preload checks (GuardDuty flags it directly as InstanceCredentialExfiltration), since the "rebuild the instance" advice at the end doesn't help if the stolen credentials are still valid off-box.