Re:Fishing for Hackers: Analysis of a Linux Server Attack
by pmh on Tuesday May 06, 2014 @01:58PM
(#7706057)
Since you hadn't heard of sysdig before, you might also be interested in this article posted[1] a couple of weeks ago: http://bencane.com/2014/04/18/using-sysdig-to-troubleshoot-l...
Based on the timestamps of the entered commands, I guess one of the takeaways for the attacker is to look into config management tools (eg ansible) :)