I started with /proc and talked through checking the process's file descriptors, open network connections via /proc/net, and cross-referencing with lsof and netstat.
Structure your answer around a systematic investigation process: start with non-invasive observation, then dig into process details, network activity, and persistence mechanisms. Emphasize that you would avoid tipping off the attacker and would preserve evidence for later analysis.
Pro tip: Mention that you would first capture volatile data (like process memory and network connections) before doing anything that might alter the system state, because that evidence is lost on reboot or process termination.
Use commands like `ps aux`, `top`, or `htop` to identify suspicious processes by unusual names, high resource usage, or unexpected parent-child relationships.
Examine the process's executable path, command line, environment, and open files using `/proc/<pid>/` (e.g., `ls -l /proc/<pid>/exe`, `lsof -p <pid>`).
Check for established connections, listening ports, and unusual remote addresses using `netstat`, `ss`, or `lsof -i` to see if the process is communicating externally.
Look for mechanisms that would restart the process: cron jobs (`crontab -l`, `/etc/cron*`), systemd services, init scripts, and startup files like `.bashrc` or `/etc/rc.local`.
Review system logs (`/var/log/auth.log`, `syslog`, `journalctl`), audit logs, and file timestamps to understand how the process started and what it has done.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.