Linux forensics

After a breach, Linux systems hide attacker traces in SSH keys, cron jobs, and systemd services — even when bash history is wiped. Here is how to find them using real commands before the trail goes cold.