Observe and back up
Notice unexpected change
Establish a baseline for users, services, listeners, packages, scheduled jobs, files, and resource use so suspicious drift becomes visible.
8 minute lesson
You cannot recognize unusual server behavior without a picture of normal behavior. Keep the baseline small enough to review.
Watch new accounts, authorized keys, sudo rules, enabled units, listeners, packages, cron jobs, application files, CPU, disk, and outbound traffic. Configuration management and deployment manifests make unexpected differences easier to see.
A new cron job may be a deployment change or attacker persistence. A reviewed baseline provides the evidence needed to distinguish expected work from drift.
Exclude expected volatile data such as temporary files and counters. A smaller, deliberate baseline makes a changed key or unit visible instead of burying it in harmless differences.
Save a small baseline of users, keys, sudo rules, listeners, units, packages, and scheduled jobs. Add one harmless unauthorized change and prove the comparison names it without flooding the report with normal log growth.
Lesson completed