---
title: "Discussion on \"Hunting IOCs in Linux: From Cryptominers to C2 Persistence\" | Hashnode"
description: "Discussion on \"Hunting IOCs in Linux: From Cryptominers to C2 Persistence\". Learn to identify Linux IOCs: track cryptominers, find backdoors, trace C2 persistence in rc.local, and clean malware artifacts."
url: "https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Hunting IOCs in Linux: From Cryptominers to C2 Persistence](https://michaelbestman.hashnode.dev/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence?utm_source=hashnode&utm_medium=feed)

Learn to identify Linux IOCs: track cryptominers, find backdoors, trace C2 persistence in rc.local, and clean malware artifacts.

Aug 8 · 4 min read · michaelbestman.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#linux](https://hashnode.com/tag/linux)
-   [#linux-for-beginners](https://hashnode.com/tag/linux-for-beginners)
-   [#incident-response](https://hashnode.com/tag/incident-response)
-   [#blueteam](https://hashnode.com/tag/blueteam)
-   [#sysadmin](https://hashnode.com/tag/sysadmin)

## Written by

[Michael Bestman Osemudiamen](https://hashnode.com/@mileonx)

@mileonx

  
[View profile](https://hashnode.com/@mileonx)

My Journey in Cybersecurity Labs: Securing Systems and Writing the Playbook

Technical & Creative Writer | Cybersecurity Analyst | Linux & Network Security I am a technical communicator moving into the cybersecurity field, where I will focus on Linux administration and other foundational concepts. Because I have a background in mass communication and journalism, I can break down complicated security holes into clear, useful documentation. Right now, I'm writing about my hands-on experience with OverTheWire and different security labs to improve my technical skills and way of working. I think that security is only as strong as how well we can understand and talk about it.

## Responses 1

Markdown supported · ⌘↵ to post

[Furqan Ashraf](https://hashnode.com/@jfreaks)

[Oct 6](https://hashnode.com/posts/hunting-iocs-in-linux-from-cryptominers-to-c2-persistence/6a77a3e9bdb63b025294e575/comment/6ac4edfec5f96136f734bb23)

Nice hunt. One step I'd add once you find the C2 IP: check it against a known C2 list. A confirmed match tells you whether it's commodity malware with documented behavior or something targeted, and that changes how deep the remediation needs to go.

Disclosure: I work on WhoisFreaks; our Threat Intelligence Feed includes a daily C2 IP list for exactly that lookup: [whoisfreaks.com/products/threat-intelligence-feed](https://whoisfreaks.com/products/threat-intelligence-feed)