Finding a system breach

  • Check the logs
    • /home/user/logs/
    • /var/log/apache2/access.log
    • /var/log/apache2/error.log
  • Check .bash_history for any recently run commands