= checklist server hacked
  * ''w''
  * ''last''
  * ''history''
  * ''top''
  * ''strace -d -p <PID>''
    * apt install strace
  * ''ps auxf''
    * ''kill -9 <PID>''
  * ''iftop''
    * apt install iftop
  * ''netstat -plunt''
  * ''lsof -l''
  * ''chrootkit''
    * apt install chrootkit

/via: [[https://noticiasseguridad.com/tutoriales/como-verificar-si-su-servidor-linux-ha-sido-hackeado/]]