Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-linux-log-forensics-investigation/references/standards.md

@@ -0,0 +1,15 @@
+# Standards - Linux Log Forensics
+## Standards
+- NIST SP 800-92: Guide to Computer Security Log Management
+- NIST SP 800-86: Guide to Integrating Forensic Techniques
+- RFC 5424: The Syslog Protocol
+## Key Log Locations
+- /var/log/auth.log (Debian) or /var/log/secure (RHEL): Authentication events
+- /var/log/syslog (Debian) or /var/log/messages (RHEL): System messages
+- /var/log/kern.log: Kernel messages
+- /var/log/audit/audit.log: Linux Audit Framework
+- /var/log/wtmp, /var/log/btmp, /var/log/lastlog: Login records (binary)
+## Tools
+- journalctl: Systemd journal query tool
+- ausearch/aureport: Audit log analysis
+- logwatch, lnav: Log analysis utilities

skills/performing-linux-log-forensics-investigation/references/workflows.md

@@ -0,0 +1,27 @@
+# Workflows - Linux Log Forensics
+## Workflow 1: Authentication Investigation
+```
+Collect /var/log/auth.log and rotated copies
+    |
+Parse for successful and failed SSH logins
+    |
+Identify brute force sources (>10 failures per IP)
+    |
+Trace sudo command execution by user
+    |
+Detect account creation/modification events
+    |
+Correlate with wtmp/btmp login records
+```
+## Workflow 2: Full System Timeline
+```
+Collect all logs from /var/log/
+    |
+Export systemd journal (journalctl --output=json)
+    |
+Parse audit.log for security events
+    |
+Merge into unified timeline
+    |
+Identify unauthorized access and persistence
+```