3.2Identifying OS components (Windows/Linux)

When investigating a host compromise, what determines your speed is being able to answer per OS, instantly: "where do I look to see running processes, auto-start mechanisms, config changes, and history?" Windows and Linux differ in philosophy and naming, but once you grasp the functional correspondence of "processes," "services/daemons," "persistence (auto-start)," "configuration," and "logs," you can map knowledge of one onto the other. This section aims not at memorizing terms but at mapping where artifacts live across both operating systems.

3.2.1Windows components

• Processes and services—running programs are seen with tasklist or Task Manager, and resident services with services.msc/sc query. Suspicious parent-child relationships (e.g., cmd.exe/powershell.exe as a child of winword.exe) are investigative leads. Open connections can be tied to a PID with netstat -ano.
• The registry is a hierarchical database holding OS and application settings. For auto-start, malware often registers under Run keys such as HKLM\...\Run/HKCU\...\Run, making them a primary persistence artifact.
• Event logs and scheduled tasks—the Event Viewer holds the System/Application/Security logs, and the Security log records logon/privilege use (e.g., event ID 4624 logon success, 4625 failure). Periodic scheduled tasks (schtasks/Task Scheduler) are also abused for persistence.

3.2.2Linux components

• Processes and daemons—running processes are seen with ps aux/top, and resident services (daemons) are managed on most distros by systemd (systemctl status). Open connections mapped to processes are checked with ss -tulpn (legacy netstat). /proc/<PID> lets you trace the executable and launch arguments.
• Configuration and persistence—system/service configuration is mainly in text files under /etc (e.g., /etc/passwd, /etc/ssh/sshd_config). Periodic execution is handled by cron (crontab -l, /etc/cron.*) or systemd timers/units, which are targets for persistence abuse.
• Logs—mostly text under /var/log. Authentication is in /var/log/auth.log (Debian family) or /var/log/secure (RHEL family); general logs in /var/log/syslog//var/log/messages. journalctl searches the systemd journal, and last/lastb show login history.

You are investigating in parallel two hosts—one Windows server and one Linux server—on which NetFlow found periodic connections to an external C2. The C2 occurs "briefly at the same time every day," a classic sign of scheduled persistence. Thinking "look in the same place on both OSes" is wrong; the crux of investigative judgment is that the function is the same but the location differs per OS. On Windows, first identify with tasklist and netstat -ano the PID of the process holding the external connection at that time, then check whether it is launched from a scheduled task (schtasks /query) and whether there are suspicious entries in the auto-start Run keys (HKCU/HKLM\...\Run). Also correlate the Security event log for logons (4624) or privilege use at that time. On Linux, from the same "same time daily" lead, first check crontab -l and /etc/cron.* and systemd timers (systemctl list-timers), find the source process with ps aux/ss -tulpn, and trace suspicious authentication in /var/log/auth.log (or /var/log/secure). If you mix up the OS—"search Linux /var/log on a Windows box," or "hunt registry Run keys on Linux"—the artifact is not there and you waste time. In short, translate the same attack concept ("scheduled persistence") into that OS's implementation—tasks/Run keys/Security log on Windows, cron/systemd timers/auth.log on Linux—and search there; being able to make this mapping determines your investigative speed in mixed-OS environments.

3.2.3Section summary

• Identify processes/connections with Windows = tasklist/netstat -ano and Linux = ps/ss, tracking suspicious parent-child relationships and the source of external connections
• Persistence is Windows = Run keys/scheduled tasks and Linux = cron/systemd timers—look here when you suspect periodic C2 or survival after reboot
• Config/logs are Windows = registry/event logs (Security 4624, 4625) and Linux = /etc//var/log (auth.log, secure); same function, different location per OS