Every Hacker Leaves Traces: Linux Log Investigation (journalctl)

Every hacker leaves traces. In this video, you'll learn where Linux stores evidence and how to use journalctl and /var/log to catch what an attacker leaves behind. We simulate a backdoor user in a lab VM, then track it down using only logs, the way a security analyst would. ⏱️ Timestamps 0:00 Every hacker leaves traces 0:30 Where does the evidence live? (/var/log) 1:30 Meet journalctl 2:30 Watching the system live 3:30 Filter like an analyst 4:30 Hacker simulation: the backdoor user 5:30 Catching the attacker in the logs 7:30 Gaps in the logs: why missing evidence is a clue 8:30 The analyst's workflow 9:00 Next video 💻 Commands used in this video ls -lah /var/log journalctl | wc -l journalctl -n 20 journalctl -f logger "KernelPath log test" journalctl -p err -b -n 10 journalctl -u ssh -n 10 sudo useradd -m support_tmp sudo journalctl -t sudo --since "10 minutes ago" | tail -5 sudo journalctl -t useradd --since "10 minutes ago" grep support_tmp /etc/passwd sudo userdel -r support_tmp 📌 This is part of a series where KernelPath teaches Linux for cybersecurity, step by step. Previous videos covered processes, network connections, services, and finding files. Subscribe and follow the series so you don't miss the next video: finding failed login attempts and spotting brute-force attacks in Linux logs. ⚠️ All demonstrations are performed on my own lab VM for educational purposes. Never test on systems you don't own or have permission to investigate. #Linux #Cybersecurity #LinuxLogs