Linux Commands Every SOC Analyst Should Know

A ton of the infrastructure you'll defend runs on Linux. Servers, containers, cloud workloads — Linux everywhere. And when something looks wrong on one of them, you need to move around the command line without freezing up.

You don't need to be a Linux wizard. You need maybe 25 commands. Here they are. Bookmark it.

Why Linux Matters for SOC Work

Windows gets a lot of the attention (and PowerShell is its own must-know), but Linux runs most of the internet's backend.

When you're investigating a compromised web server, a suspicious container, or a cloud host, you're at a Linux prompt. Knowing how to quickly triage from the terminal is a core analyst skill — not a nice-to-have.

Let's break it down by what you're actually trying to do.

Getting Your Bearings

First thing on any box: figure out where you are and who you are.

- whoami — what user am I? (Am I root? Should I be?)

- id — my user and group IDs, including privileges

- hostname — which machine is this?

- pwd — what directory am I in?

- uname -a — OS and kernel details

Boring, but the first thing you do when you land somewhere unfamiliar.

Looking at Processes (What's Running?)

Malware runs as a process. This is where you find it.

- ps aux — every running process, with user and command. The aux flags show the full picture.

- ps aux --sort=-%cpu — sort by CPU usage (crypto miners love to spike this)

- top or htop — live, updating view of processes

- pstree — processes as a tree, so you can see parent-child relationships (just like process trees on Windows)

💡 Pro tip: Look for processes running from weird locations like /tmp or /dev/shm. Legitimate software rarely runs from there.

Network Connections (Who's It Talking To?)

Compromised hosts call home. This is how you catch it.

- netstat -tulpn — all listening ports and active connections with process names

- ss -tulpn — the modern, faster replacement for netstat (same idea)

- lsof -i — which processes have network connections open

An unexpected connection to a random external IP on a high port? That's your lead.

Investigating Files

- ls -la — list files including hidden ones (attackers love hidden files/dirs starting with .)

- find / -mtime -1 — files modified in the last 24 hours (great for "what changed recently")

- stat filename — full timestamps on a file (created, modified, accessed)

- file filename — what a file actually is, regardless of its extension

- md5sum filename / sha256sum filename — hash a file to check it against threat intel

Reading Logs (The Bread and Butter)

Linux logs live in /var/log. You'll spend real time here.

- cat /var/log/auth.log — authentication events (logins, sudo use)

- grep "Failed password" /var/log/auth.log — pull failed SSH logins (brute-force hunting)

- tail -f /var/log/syslog — watch a log update live

- less /var/log/auth.log — page through a big log without loading it all at once

- journalctl -u ssh — logs for a specific service on modern systems

The Text-Processing Power Tools

This is where Linux really earns its keep. These commands chained together let you carve answers out of huge logs.

- grep — search for a pattern. Your most-used tool by far.

- awk '{print $1}' — extract specific columns/fields

- sort and uniq -c — sort and count unique occurrences

- cut -d: -f1 — split lines on a delimiter and grab a field

- wc -l — count lines (how many failed logins, exactly?)

A classic one-liner — top 10 IPs with failed SSH logins:

grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head

That single line turns a giant log into a ranked list of attackers. That's the whole point of the pipe (|) — chain small tools into an answer.

Reading Linux Like an Analyst

The commands are just the vocabulary. The skill is the investigation flow: land on a host → check who you are → look at processes → check network connections → follow the suspicious one → pull the relevant logs → build the timeline.

Same instinct as reading any logs — you're narrowing from "something's wrong here" to "here's exactly what happened," one command at a time.

Quick Tips

1. Learn the pipe (|). Chaining commands is where Linux goes from useful to powerful.

2. grep is your best friend. If you learn one command deeply, make it this one.

3. man command shows the manual for anything. Forgot the flags for netstat? man netstat.

4. Be careful as root. If whoami says root, every command is loaded. Double-check before you run anything destructive.

TL;DR – The Linux Commands That Matter

Orient with whoami/id/pwd, hunt processes with ps aux and pstree, check connections with ss -tulpn, investigate files with find/stat/sha256sum, and read logs in /var/log with grep/tail/less. The real power is chaining grep, awk, sort, and uniq with pipes to carve answers out of huge logs.

---

FAQs

Do I need to be a Linux expert to be a SOC analyst?

No. You need comfortable command-line triage — moving around, checking processes and connections, reading logs, and searching text. Deep Linux administration is a bonus, not a requirement.

What's the most important Linux command for SOC work?

grep, hands down. Searching logs and output for patterns is something you'll do constantly. ps aux for processes is a close second.

Where do Linux logs live?

Mostly in /var/log — auth.log for authentication, syslog for general system events. On modern systems, journalctl reads the systemd journal.

How do I practice these commands safely?

Spin up a free Linux VM or use a browser-based Linux sandbox. To practice investigation flow (not just syntax), story-driven scenarios like beginner SIEM practice put log analysis in the context of a real case.

---

Final thought: You don't need to love Linux. You need to not panic at a terminal when a server's acting weird. Two dozen commands gets you there.

How EpicDetect Can Help

Commands are only half of it — knowing what to look for is the other half. Adventures drops you into story-driven SOC investigations where log and system evidence come together into a real case you have to work through. Season 0 is completely free, no credit card required.

Want structured lessons too? The EpicDetect Atlas covers log analysis, endpoint forensics, and detection engineering.

New here? Sign up and start for free.