The SysGoRAT report is a good reminder that attackers don’t just get in. They set things up so they can keep coming back. Here’s the quick sweep I run on my Linux boxes. Run it as root, and save the output so you can compare next time.
1. systemd services and timers
systemctl list-timers --all
systemctl list-unit-files --state=enabled
find /etc/systemd /usr/lib/systemd /home/*/.config/systemd -newer /etc/os-release -type f 2>/dev/nullLook for names you don’t recognize and units that changed recently.
2. cron
ls -la /etc/cron.* /var/spool/cron* 2>/dev/null
for u in $(cut -d: -f1 /etc/passwd); do crontab -l -u "$u" 2>/dev/null | sed "s/^/$u: /"; done3. Shell startup files
SysGoRAT’s crew swapped out .bashrc. Check the dates and contents:
ls -la /root/.bashrc /home/*/.bashrc /home/*/.profile /etc/profile.d/4. Web login pages
List PHP files changed in the last week:
find /var/www -name '*.php' -mtime -7 -ls5. Package integrity
Check files against the package database: pacman -Qkk (Arch/Omarchy), debsums -c (Debian/Ubuntu) or rpm -Va (Fedora/RHEL).
6. SSH keys
See my SSH keys how-to.
If anything looks off, don’t just delete it. Take an image of the box first, then rebuild from a known good state.
God Bless, and Use the Source!
