🎯 Mission Briefing: Security Sweep

An automated scanner flagged unusual CPU activity on this box overnight, and a file was recently modified in a directory nobody touches. Something — or someone — has been here.

Your objective

Sweep the system for anything suspicious: unexpected processes, oddly-permissioned files, and unfamiliar users. Lock down what you find.

Sweep toolkit

ps aux --sort=-%cpu | head       # Top CPU-consuming processes
ps aux | grep -v grep | grep <name>
who                                # Who's currently logged in
last                                # Recent login history
cat /etc/passwd | grep -E '/bin/(bash|sh)$'   # Users with shell access
find / -perm -4000 -type f 2>/dev/null        # Setuid files (privilege-escalation risk)
find /home -mtime -1 -type f       # Files modified in the last 24 hours

Lock it down

kill -9 <PID>                      # Stop a suspicious process
chmod 600 suspicious-file           # Restrict a file to owner-only
sudo userdel -r suspicious-user     # Remove an unauthorized account

Always confirm a process/file is actually malicious before killing or deleting — on a real system, some large or unfamiliar-looking things are perfectly legitimate.