一、前言二、Windows入侵排查  检查系统账号安全  检查异常端口、进程  检查启动项、计划任务、服务  检查系统相关信息  自动化查杀  日志分析三、Linux入侵排查  账号安全  历史命令  检查异常端口  检查异常进程  检查开机启动项  检查定时任务  检查服务  检查异常文件  检查系统日志四、常见Webshell查杀工具  盾：  百度WEBDIR+  河马  Web Shell Detector  CloudWalker(牧云)  Sangfor WebShellKill  深度学习模型检测PHP Webshell  PHP Malware Finder  findWebshell  在线Webshell查杀工具五、如何发现隐藏的Webshell后门  文件MD5校验  Diff命令  文件对比工具六、勒索病毒  勒索病毒搜索引擎  勒索软件解密工具集

1、定位有多少IP在爆破主机的root帐号：grep "Failed password for root" /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -nr | more定位有哪些IP在爆破：grep "Failed password" /var/log/secure|grep -E -o "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|uniq -c爆破用户名字典是什么？grep "Failed password" /var/log/secure|perl -e 'while($_=<>){ /for(.*?) from/; print "$1\n";}'|uniq -c|sort -nr 2、登录成功的IP有哪些：grep "Accepted " /var/log/secure | awk '{print $11}' | sort | uniq -c | sort -nr | more登录成功的日期、用户名、IP：grep "Accepted " /var/log/secure | awk '{print $1,$2,$3,$9,$11}' 3、增加一个用户kali日志：Jul 10 00:12:15 localhost useradd[2382]: new group: name=kali, GID=1001Jul 10 00:12:15 localhost useradd[2382]: new user: name=kali, UID=1001, GID=1001, home=/home/kali, shell=/bin/bashJul 10 00:12:58 localhost passwd: pam_unix(passwd:chauthtok): password changed for kali#grep "useradd" /var/log/secure 4、删除用户kali日志：Jul 10 00:14:17 localhost userdel[2393]: delete user 'kali'Jul 10 00:14:17 localhost userdel[2393]: removed group 'kali' owned by 'kali'Jul 10 00:14:17 localhost userdel[2393]: removed shadow group 'kali' owned by 'kali'# grep "userdel" /var/log/secure5、su切换用户：Jul 10 00:38:13 localhost su: pam_unix(su-l:session): session opened for user good by root(uid=0)sudo授权执行:sudo -lJul 10 00:43:09 localhost sudo:    good : TTY=pts/4 ; PWD=/home/good ; USER=root ; COMMAND=/sbin/shutdown -r now四、常见Webshell查杀工具D盾：

360：http://lesuobingdu.360.cn腾讯：https://guanjia.qq.com/pr/ls启明：https://lesuo.venuseye.com.cn奇安信：https://lesuobingdu.qianxin.com深信服：https://edr.sangfor.com.cn/#/information/ransom_search

腾讯哈勃：https://habo.qq.com/tool金山毒霸：http://www.duba.net/dbt/wannacry.html火绒：http://bbs.huorong.cn/forum-55-1.html瑞星：http://it.rising.com.cn/fanglesuo/index.htmlNomoreransom：https://www.nomoreransom.org/zh/index.htmlMalwareHunterTeam：https://id-ransomware.malwarehunterteam.com卡巴斯基：https://noransom.kaspersky.comAvast：https://www.avast.com/zh-cn/ransomware-decryption-toolsEmsisoft：https://www.emsisoft.com/ransomware-decryption-tools/free-downloadGithub勒索病毒解密工具收集汇总：https://github.com/jiansiting/Decryption-Tools

文章来源：FreeBuf.CO

推荐阅读