Linux incident response (IR) is the process of collecting volatile evidence, identifying persistence mechanisms, and recovering from a server compromise β in that specific order. Each step is designed to preserve evidence that would be destroyed by the next step.
Volatile evidence first. Running processes, network connections, and logged-in sessions exist only in RAM. A reboot β or even killing one process β destroys this evidence permanently. Run the Process & Network section before you do anything else.
Collect before you clean. Removing a webshell before logging its hash, owner, and modification time means losing evidence. Run the Files section and hash everything suspicious before you delete it.
Find persistence before you patch. If you patch the entry point without removing the backdoor, the attacker re-enters the same day. The Persistence Mechanisms section must complete before you block the original attack vector.
Linux Incident Response Toolkit β https://ordinarymantrying.com/tools/toolkit/toolkit-linux-ir.html