The 10 Commands · lesson 11 · 2026-09-16

10 Linux Commands That Expose Hidden Malware

▶

Before you start

• A Linux machine you own, or better a disposable Kali container or VM. The video runs the commands inside a throwaway container with a few harmless planted artifacts, never on a real host.
• Standard tools: ps, ss (iproute2), crontab, find, awk, dpkg.
• A working folder: cd /tmp.
• Only test systems you own or are authorized to test.

You do not need antivirus software to notice something is wrong on a Linux system. You need ten ordinary commands, and today we run every one of them for real, on a machine that is quietly infected right now.

One rule before anything else. This machine has a handful of planted, harmless test artifacts on it, standing in for what a real infection leaves behind, so it is completely safe to follow along on your own system. None of the ten commands here execute or download anything new.

Step one. Start with what is actually running right now.

1 — Check the busiest processes

ps aux --sort=-%cpu

Malware often shows up here as a process you do not recognize, especially one quietly burning CPU in the background or running from a folder programs do not normally run from.

ps aux --sort=-%cpu | head -n 8

Right there, a process running straight out of a temp folder. A real program almost never lives there. That alone is worth a closer look.

Step two. That temp folder deserves its own look.

2 — Look inside the temp folder

ls -la /tmp

Every user can write to this folder, which makes it a favorite hiding spot. Anything here that looks like a program, not a document, deserves an explanation.

l s, space, dash l a, space, slash t m p, and press Enter.

ls -la /tmp/.cache

A binary, hidden in a dot folder, and writable by absolutely everyone. That combination should never sit unexplained in a temp directory.

Step three. Now check what this machine is listening for.

3 — Check listening ports

ss -tulpn

Every open port is a door. If you cannot explain why a port is open, or which program opened it, that door should not exist.

s s, space, dash t u l p n, and press Enter.

A port sitting open, tied to a process that has no business accepting connections. That is a live backdoor, sitting in plain sight.

Step four. Check what this account has scheduled to run automatically.

4 — Check your own scheduled jobs

crontab -l

Cron is how Linux runs something automatically, over and over, without you doing anything. It is also exactly how malware survives a reboot, so it never has to trick you twice.

c r o n t a b, space, dash l, and press Enter.

That is the exact file we just found in the temp folder, scheduled to run again every five minutes, forever, until someone notices.

Step five. Cron persistence is not limited to one user.

5 — Check system-wide scheduled jobs

ls -la /etc/cron.d/

This folder can schedule a job for any user, including root, and most people never open it. Malware that wants to survive as an administrator often plants itself here instead.

l s, space, dash l a, space, slash e t c slash c r o n dot d, and press Enter.

Nothing unexpected in this one — and that is exactly the point of checking. A clean result here is genuinely good news, not a wasted step.

Step six. Now ask the filesystem itself what changed recently.

6 — Find recently modified system files

find /etc /usr/bin -mtime -1 -type f

System files do not normally change on their own. If a file in here was touched recently and you did not touch it, someone or something else did.

find, space, slash e t c, space, slash usr slash bin, space, dash m time, space, dash 1, and press Enter.

find /etc /usr/bin -mtime -1 -type f 2>/dev/null | head -n 10

Every one of those needs an explanation that isn’t you. A file you know you edited is fine. A file you have never touched is a finding.

Step seven. Check for programs that quietly run as an administrator.

7 — Audit SUID binaries

find /usr/bin /usr/sbin /bin /sbin -perm -4000 -type f

A handful of these are completely normal — passwd and sudo both need this to work. But every extra one on this list is a program that runs with elevated power the instant anyone launches it, which makes it a prime attacker target.

find, space, the bin folders, space, dash perm, space, dash 4000, and press Enter.

find /usr/bin /usr/sbin /bin /sbin -perm -4000 -type f 2>/dev/null | head -n 10

Most of that list is boring on purpose. Scan it for the one entry that is not a name you recognize from this list on any other machine.

Step eight. Check exactly who is even allowed to log in.

8 — Audit login-capable accounts

awk -F: '$7 ~ /sh$/' /etc/passwd

Most accounts on a Linux system exist only to own a background service and can never log in at all. An account that can log in, that you did not create, is one of the clearest signs of a break-in there is.

awk, space, dash capital F, space, colon, space, then the filter, space, slash etc slash passwd, and press Enter.

awk -F: '$7 ~ /sh$/ {print $1, $7}' /etc/passwd

Every name on that list should be an account you personally recognize and expect. Anything else gets investigated before it gets ignored.

Step nine. Go back to that writable folder, but with a wider net this time.

9 — Search for world-writable files

find /tmp /var/tmp -perm -0002 -type f

A world-writable file is not just readable by an attacker, it is editable by one. If malware wants to update itself without anyone noticing permissions, this is the trick.

find, space, slash t m p, space, slash var slash t m p, space, dash perm, space, dash 0002, and press Enter.

find /tmp /var/tmp -perm -0002 -type f 2>/dev/null | head -n 10

The exact same file from step two, confirmed a second way. Two different commands, two different angles, the same honest answer.

And step ten. Finally, ask the system itself whether any of its own programs have been altered.

10 — Verify installed files against the package manager

dpkg -V

On a Debian-based system, the package manager already knows the exact fingerprint of every file it installed. This command re-checks every single one of them against that record, for free, with no extra tools.

d p k g, space, dash capital V, and press Enter.

dpkg -V | head -n 10

That five right there means the file’s contents no longer match what was installed. A completely ordinary command, a program you already had, silently modified after the fact.

So that is the whole triage sweep, and every single finding pointed at the exact same quiet infection.

How the ten checks connect

• Unrecognized process → traced to a writable temp folder
• That folder holds a world-writable binary, scheduled by cron
• An open port, an extra SUID file, and one tampered system binary
• Ten separate checks, one consistent story

An unfamiliar process led us to a writable temp folder. That folder held a file scheduled to run again by cron, listening on an open port, sitting alongside an extra SUID binary and one tampered system file. Ten separate, independent checks, and every one of them agreed.

That agreement is what makes this reliable. One odd result could be a coincidence. Ten pointing the same direction is not.

And the rule that outranks every command here.

Before you go

• Run these checks on your own systems only
• A finding here is a lead to investigate, not proof of compromise on its own
• If you confirm a real infection, isolate the machine before doing anything else
• New to the terminal? Start with our beginner Nmap course, linked below

Every command today only reads information that was already sitting on the system. None of them execute or download anything. Only ever run these checks on systems you own or are authorized to examine.

If any of this moved too quickly, our beginner course starts from opening the terminal for the very first time, and it is linked below. Thanks for learning with The Exploit HQ, and I will see you in the next one.