Hacker News Reader

Beyond normal system logs --- you can set up auditd to track very specific things, like executables, files being written to, copied, modified.

I work on endpoint protection software that goes deeper, using ebpf and a driver for older kernels to track specific syscalls, and look for things like permission escalations, forking and then doing naughty things, for instance. It's more meant for aggregating this data to a backend that then analyzes it and provides a panel that alerts security folks to unusual behavior.

Network throughput logs? System logs and events sent to a separate log aggregator? System metric logs showing disk i/o? There is some commands in here https://www.sans.org/reading-room/whitepapers/incident/paper...

centralized logging of various stuff: /var/log/messages, /var/log/secure, /var/log/audit, intrusion detection systems reporting abnormal network traffic, etc.

If there is no centralized logging/alerting, it is very hard to detect.

I’ve wondered this as well