---
title: "Comment by Mihai_LeanZero on \"How I Investigate a Suspicious Login on a Linux Server\" | Hashnode"
description: "This is one of the most thorough triage playbooks I've read here - the ctime-vs-mtime timestomping point and catching the pty-less sshd session via ss instead o"
url: "https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab2b1502605f37864874853"
---

[Discussion](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d)

Comment [How I Investigate a Suspicious Login on a Linux Server](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d)

[Mihai\_LeanZero](https://hashnode.com/@mihaileanzero)

[Sep 22](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab2b1502605f37864874853)

This is one of the most thorough triage playbooks I've read here - the ctime-vs-mtime timestomping point and catching the pty-less sshd session via ss instead of w are both things most writeups skip entirely. One gap worth flagging for anyone running this against a cloud-hosted replica specifically: none of the persistence vectors here check the instance metadata service. If db-prod-01 is EC2, an attacker with even a few seconds of shell access can curl 169.254.169.254/latest/meta-data/iam/security-credentials/ and walk off with temporary IAM credentials that keep working long after you've frozen the box and rebuilt from known-good IaC - no local persistence needed at all. Worth checking VPC flow logs or CloudTrail for that request alongside the /proc and ld.so.preload checks (GuardDuty flags it directly as InstanceCredentialExfiltration), since the "rebuild the instance" advice at the end doesn't help if the stolen credentials are still valid off-box.

[Asep Sayyad](https://hashnode.com/@asepsayyad007)

[Oct 2](https://hashnode.com/posts/how-i-investigate-a-suspicious-login-on-a-linux-server/6ab2a68925a7eb6282aeca0d/comment/6ab2b1502605f37864874853#reply-6abfd6c4ec620802a928efaa)

Great point. I focused mainly on host-level persistence in this playbook, but cloud credentials are an important part of the investigation too. Checking the instance metadata access and CloudTrail/GuardDuty activity should definitely be added for EC2 cases. Thanks for pointing this out!