Recommended Free Tools
If you suspect a Linux server has been compromised, coordinate the response, limit attacker access, preserve useful evidence, and establish the scope before cleaning up or rebuilding. Do not automatically shut the server down: the right first move depends on whether you can isolate it safely, what evidence may be lost, and how urgently the service must stay available.
What should I do first if my Linux server may have been hacked?
Start the incident process rather than making ad hoc changes. CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks set out a response lifecycle—preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. They formally address federal executive branch agencies handling confirmed malicious activity with major-incident potential, so other organizations should adapt the process to their own incident plans, contracts, and legal obligations.
As an Amazon Associate I earn from qualifying purchases.
- Declare and coordinate. Notify the people responsible for security, system operations, business continuity, legal advice, and communications as appropriate. Assign decision owners and keep a timeline of discoveries and response actions.
- Use a trusted channel. Avoid discussing sensitive response plans through the suspected server or another potentially compromised system. CISA’s ransomware guidance recommends out-of-band communication and coordinated isolation because attackers may monitor organizational activity.
- Set priorities. Identify the affected service, its dependencies, business criticality, and the likely impact of isolation or downtime. Decide who can authorize disruptive changes.
Keep a running record of alert and discovery times, affected hosts and accounts, observed indicators, actions taken, and who approved each decision. This helps responders correlate events and explain later why a service was isolated, left online for collection, or rebuilt.
How do I contain a compromised Linux server?
Containment should reduce an attacker’s ability to act or move to other systems without needlessly destroying evidence or disrupting dependent services. CISA’s incident-response playbooks identify options such as network or host isolation, filtering exposed paths, and changing administrator passwords or rotating keys and service secrets when compromise is suspected. Choose measures for the incident’s scope and expected duration rather than applying every change indiscriminately.
#1 Best Overall
| Choice | What it can help with | Main trade-off |
|---|---|---|
| Network isolation | Can restrict the server’s communication and reduce opportunities for attacker movement while keeping the host available for coordinated response. | It may interrupt services or dependencies; confirm that isolation can be applied safely and does not leave another exposed path. |
| Powering down | May be necessary when network isolation cannot be achieved by other means. | Shutdown loses volatile-memory artifacts and stops the service. CISA gives this advice in ransomware guidance, so apply it to the circumstances rather than treating it as a universal Linux rule. |
| Live evidence collection | Can preserve volatile information and support investigation before cleanup. | Collection requires appropriate expertise and coordination; responders must weigh its value against operational urgency and the risks of leaving a live host connected. |
| Immediate rebuild | Can restore a trusted system when operational urgency outweighs the value or feasibility of live collection. | Rebuilding before relevant evidence is preserved can remove artifacts needed to understand access, impact, or persistence. |
Do not treat an account or key rotation as a substitute for isolation or scope analysis. Coordinate credential changes with the teams that own affected services so they do not inadvertently break dependencies, and preserve relevant evidence where feasible before making changes that could alter it.
Should I shut down a hacked server?
Not automatically. First consider whether responders can isolate the host through the network, whether an attacker may still be active, whether volatile evidence matters, and what downtime would affect. CISA’s ransomware guide says powering down is appropriate when network isolation cannot be achieved by other means, while warning that shutdown loses volatile-memory artifacts. That is ransomware-focused guidance, not a rule that every suspected Linux intrusion should be handled the same way.
Rank #2
- If safe network isolation is available, coordinate it and assess whether the affected service can tolerate the change.
- If isolation cannot be achieved and ongoing access presents an unacceptable risk, shutdown may be the practical containment choice; record the decision and its expected evidence and service consequences.
- If responders need live evidence, arrange qualified collection as soon as feasible while balancing the risk of keeping the host running.
How do I preserve evidence before cleanup?
Preserve information that could establish what happened and when before it expires, is overwritten, or is changed by response work. CISA’s compromise advisory recommends reviewing relevant data and artifacts and capturing memory and forensic images. Its ransomware guide also lists memory, system images, logs, and malware samples among evidence to collect when initial mitigation is not possible.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Preserve relevant logs and host artifacts, along with available network evidence.
- Where feasible and appropriate, capture volatile memory and forensic images before cleanup or rebuilding.
- Protect original evidence and work from copies where the response process supports it.
- Record who collected each item, when and from which host, and how it was transferred or stored.
These sources recommend evidence preservation and forensic capture but do not establish a Linux-specific chain-of-custody procedure or universally authoritative command sequence. Follow your organization’s forensic process and involve qualified responders when collection must support legal, regulatory, or contractual needs.
How do I investigate the scope and find persistence?
Build a timeline from host and network evidence to determine likely initial access, affected accounts and services, possible lateral movement, data access or exfiltration, and mechanisms that could allow re-entry. CISA’s compromise advisory advises assuming possible lateral movement in the incident it describes and investigating connected systems. That is a reason to check dependencies and neighboring assets, not proof that every Linux compromise has spread.
Look beyond the first visible malicious file or process. Establish which systems, credentials, services, and exposed paths may be involved before deciding the incident is contained; otherwise, an overlooked access route can undermine cleanup and recovery.
CISA describes Velociraptor as a tool for rapid collection and examination of artifacts across a network, including targeted hunts and file analysis. CISA also says it does not endorse commercial products or attest to their suitability. It is one example for qualified responders to evaluate, not a required tool or a guarantee that it fits a particular environment.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow do I eradicate the intrusion and recover services?
Base eradication on the scope you established. Remove known malicious artifacts, correct the exploited condition, rotate credentials suspected of compromise, and reimage or rebuild affected systems from clean sources where appropriate. CISA’s playbook emphasizes coordinated eradication, clean-source reimaging when suitable, and continued monitoring for re-entry.
Best Value
- Account for known access and persistence. Use the investigation to identify the affected systems, accounts, services, and other access paths that must be addressed.
- Choose a clean recovery path. Reimage or rebuild where appropriate, and restore data from backups believed to be clean. CISA’s ransomware guidance recommends restoring from offline, encrypted backups according to critical-service priorities and cautions against reinfecting clean recovery systems.
- Prioritize service restoration. Bring back critical services in an order agreed by business and technical owners, accounting for their dependencies.
- Validate and monitor. Check system function, strengthen relevant access and network controls, and watch for renewed activity. If suspicious activity returns, resume technical analysis and revise the incident scope rather than treating recovery as complete.
When should I bring in outside incident responders?
Consider third-party incident-response support when the incident’s scope exceeds internal expertise or capacity, the business impact is significant, or specialist investigation is needed. CISA’s compromise advisory recommends considering outside help. The decision should also account for legal or regulatory needs; applicable reporting duties depend on the organization and jurisdiction, so confirm them with the appropriate legal or compliance advisers.
What should happen after recovery?
Close out the incident with a record of what happened, the response decisions and actions, and lessons that can improve plans, controls, and exercises. CISA recommends documenting lessons learned and associated response activities. Decide separately whether reporting or information-sharing is appropriate under the organization’s obligations and circumstances.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
