Audit what commands users ran on your server
Shell history is not an audit trail. Compare sudo logging, session recording, shell hooks and auditd execve rules, then ship the logs off the box.
#forensics
Filtering by topic #forensics · clear
What to Do If Your VPS Is Hacked
Your VPS is compromised. Isolate it at the provider firewall, snapshot the disk as evidence, rotate every key it held, then rebuild from a clean image.