Forem

Faruk profile picture

Faruk

InfoSec Analyst | 10+ yrs in DLP, CrowdStrike, QRadar, Qualys, Linux Admin, WebLogic Admin | Python & Bash Enthusiast | Passionate about cybersecurity, automation, and continuous learning.

Joined Joined on  Personal website https://nextgenthreat.com

Education

BS

Pronouns

fa-rook

Work

Cyber security with backend support with Python and bash scripting

The First 24 Hours After a Linux Breach — My Incident Response Playbook | by Faruk Ahmed | nextgenthreat | Aug, 2025

The First 24 Hours After a Linux Breach — My Incident Response Playbook | by Faruk Ahmed | nextgenthreat | Aug, 2025

1
Comments
1 min read
Why I Never Trust Default Linux User Accounts (And Neither Should You) | by Faruk Ahmed | Aug, 2025 | AWS in Plain English

Why I Never Trust Default Linux User Accounts (And Neither Should You) | by Faruk Ahmed | Aug, 2025 | AWS in Plain English

1
Comments
1 min read
Why I Use Read-Only Partitions on My Linux Servers (And You Should Too) | by Faruk Ahmed | Aug, 2025

Why I Use Read-Only Partitions on My Linux Servers (And You Should Too) | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
The Hidden Risks of SSH Agent Forwarding (And How I Avoid Them) | by Faruk Ahmed | Aug, 2025

The Hidden Risks of SSH Agent Forwarding (And How I Avoid Them) | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
Why I Run Multiple SSH Keys Instead of Just One | by Faruk Ahmed | Aug, 2025

Why I Run Multiple SSH Keys Instead of Just One | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
What I Do the Moment I Suspect My Ubuntu Server Has Been Compromised | by Faruk Ahmed | Aug, 2025

What I Do the Moment I Suspect My Ubuntu Server Has Been Compromised | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
The One Linux Security Habit That Exposes You — And How I Fixed It | by Faruk Ahmed | Aug, 2025

The One Linux Security Habit That Exposes You — And How I Fixed It | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
Immutable Infrastructure on Linux: Why I Don’t Modify Servers After Deployment | by Faruk Ahmed | Aug, 2025

Immutable Infrastructure on Linux: Why I Don’t Modify Servers After Deployment | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
How I Hunt for Silent Rootkits on Linux (Before They Hunt Me) | by Faruk Ahmed | Aug, 2025

How I Hunt for Silent Rootkits on Linux (Before They Hunt Me) | by Faruk Ahmed | Aug, 2025

1
Comments
1 min read
Why I No Longer Trust “Secure by Default” in Linux Server Installs | by Faruk Ahmed | Jul, 2025

Why I No Longer Trust “Secure by Default” in Linux Server Installs | by Faruk Ahmed | Jul, 2025

1
Comments
1 min read
Why You Should Never Trust Default Configurations on a Fresh Linux Install | by Faruk Ahmed | Jul, 2025

Why You Should Never Trust Default Configurations on a Fresh Linux Install | by Faruk Ahmed | Jul, 2025

Comments
1 min read
The Ultimate Fusion: Linux, Ubuntu, and Cybersecurity | by Faruk Ahmed | Jun, 2025

The Ultimate Fusion: Linux, Ubuntu, and Cybersecurity | by Faruk Ahmed | Jun, 2025

1
Comments
1 min read
The Linux Service That Almost Let Attackers Slip In (And How I Found It Just in Time) | by Faruk Ahmed | Jun, 2025

The Linux Service That Almost Let Attackers Slip In (And How I Found It Just in Time) | by Faruk Ahmed | Jun, 2025

Comments
1 min read
How I Use aide to Detect Unauthorized Changes on My Linux and Ubuntu Servers | by Faruk Ahmed | Jul, 2025

How I Use aide to Detect Unauthorized Changes on My Linux and Ubuntu Servers | by Faruk Ahmed | Jul, 2025

Comments
1 min read
How I Harden My Linux Server in 30 Minutes After Every Fresh Install (Ubuntu & Red Hat) | by Faruk Ahmed | Jul, 2025

How I Harden My Linux Server in 30 Minutes After Every Fresh Install (Ubuntu & Red Hat) | by Faruk Ahmed | Jul, 2025

Comments
1 min read
How I Found a Hidden Reverse Shell Running as www-data (And What I Did About It) | by Faruk Ahmed | Jul, 2025

How I Found a Hidden Reverse Shell Running as www-data (And What I Did About It) | by Faruk Ahmed | Jul, 2025

Comments
1 min read
How I Found a Hidden Backdoor User Account on My Ubuntu Server (And What I Did About It) | by Faruk Ahmed | Jun, 2025

How I Found a Hidden Backdoor User Account on My Ubuntu Server (And What I Did About It) | by Faruk Ahmed | Jun, 2025

Comments
1 min read
7 Things I Check Immediately After Logging Into a Linux Server I Didn’t Set Up | by Faruk Ahmed | Jul, 2025

7 Things I Check Immediately After Logging Into a Linux Server I Didn’t Set Up | by Faruk Ahmed | Jul, 2025

Comments
1 min read
7 Hidden Backdoors I’ve Found on Compromised Linux Servers (And How to Remove Them) | by Faruk Ahmed | Jul, 2025

7 Hidden Backdoors I’ve Found on Compromised Linux Servers (And How to Remove Them) | by Faruk Ahmed | Jul, 2025

Comments
1 min read
Why I Set Email Alerts for Every New User Added to My Linux Server (And How You Can Too) | by Faruk Ahmed | Jul, 2025

Why I Set Email Alerts for Every New User Added to My Linux Server (And How You Can Too) | by Faruk Ahmed | Jul, 2025

Comments
1 min read
Why I Always Check /etc/sudoers.d on a Compromised Linux Server | by Faruk Ahmed | Jun, 2025

Why I Always Check /etc/sudoers.d on a Compromised Linux Server | by Faruk Ahmed | Jun, 2025

Comments
1 min read
What I Check Every Week to Keep My Linux Servers Safe and Stable | by Faruk Ahmed | Jul, 2025

What I Check Every Week to Keep My Linux Servers Safe and Stable | by Faruk Ahmed | Jul, 2025

Comments
1 min read
The Linux Rootkit That Hid in Plain Sight: How I Finally Detected It | by Faruk Ahmed | Jun, 2025

The Linux Rootkit That Hid in Plain Sight: How I Finally Detected It | by Faruk Ahmed | Jun, 2025

Comments
1 min read
How I Use netstat and ss to Catch Suspicious Connections on Linux | by Faruk Ahmed | Jul, 2025

How I Use netstat and ss to Catch Suspicious Connections on Linux | by Faruk Ahmed | Jul, 2025

Comments
1 min read
How a Controlled Breach Test Helped Me Harden My Linux Server Instantly | by Faruk Ahmed | Jun, 2025

How a Controlled Breach Test Helped Me Harden My Linux Server Instantly | by Faruk Ahmed | Jun, 2025

Comments
1 min read
Why I Never Trust Pre-Installed Packages on Linux or Ubuntu Servers | by Faruk Ahmed | Jun, 2025

Why I Never Trust Pre-Installed Packages on Linux or Ubuntu Servers | by Faruk Ahmed | Jun, 2025

Comments 1
1 min read
Why I Check for Hidden Processes Every Week on My Linux Servers (And You Should Too) | by Faruk Ahmed | Jun, 2025

Why I Check for Hidden Processes Every Week on My Linux Servers (And You Should Too) | by Faruk Ahmed | Jun, 2025

Comments
1 min read
How I Found an Unknown Cron Job Mining Crypto on My Ubuntu Server | by Faruk Ahmed | Jun, 2025

How I Found an Unknown Cron Job Mining Crypto on My Ubuntu Server | by Faruk Ahmed | Jun, 2025

Comments
2 min read
7 CIS Security Best Practices I Apply on Every Linux Server I Set Up | by Faruk Ahmed | Jun, 2025

7 CIS Security Best Practices I Apply on Every Linux Server I Set Up | by Faruk Ahmed | Jun, 2025

Comments
1 min read
How I Use auditd to Catch Hidden Changes on My Linux Server | by Faruk Ahmed | Jun, 2025

How I Use auditd to Catch Hidden Changes on My Linux Server | by Faruk Ahmed | Jun, 2025

Comments 2
1 min read
How I Spot a Suspicious Process on My Linux Server (Before It Does Damage) | by Faruk Ahmed | Jun, 2025

How I Spot a Suspicious Process on My Linux Server (Before It Does Damage) | by Faruk Ahmed | Jun, 2025

Comments 1
1 min read
Why I Never Trust Pre-Installed Packages on Linux or Ubuntu Servers | by Faruk Ahmed | Jun, 2025

Why I Never Trust Pre-Installed Packages on Linux or Ubuntu Servers | by Faruk Ahmed | Jun, 2025

Comments
1 min read
What I Do Before Letting Any App Run as Root on My Linux Server | by Faruk Ahmed | Jun, 2025

What I Do Before Letting Any App Run as Root on My Linux Server | by Faruk Ahmed | Jun, 2025

Comments
1 min read
How to Automatically Lock Out SSH Brute-Force Attacks on Ubuntu and Red Hat | by Faruk Ahmed | Jun, 2025

How to Automatically Lock Out SSH Brute-Force Attacks on Ubuntu and Red Hat | by Faruk Ahmed | Jun, 2025

Comments
1 min read
What I Learned Publishing 5 Technical Blogs in 7 Days on Medium | by Faruk Ahmed | May, 2025

What I Learned Publishing 5 Technical Blogs in 7 Days on Medium | by Faruk Ahmed | May, 2025

Comments
1 min read
Why I Treat Every New Linux Server as Already Compromised | by Faruk Ahmed | May, 2025

Why I Treat Every New Linux Server as Already Compromised | by Faruk Ahmed | May, 2025

Comments
1 min read
What I Check First When a Linux Server Starts Acting Suspicious | by Faruk Ahmed | May, 2025

What I Check First When a Linux Server Starts Acting Suspicious | by Faruk Ahmed | May, 2025

Comments
1 min read
The One Linux Security Habit That Saved Me From a Silent Breach | by Faruk Ahmed | May, 2025

The One Linux Security Habit That Saved Me From a Silent Breach | by Faruk Ahmed | May, 2025

Comments
1 min read
The 5 Most Dangerous Linux Services If Left Unsecured | by Faruk Ahmed | May, 2025

The 5 Most Dangerous Linux Services If Left Unsecured | by Faruk Ahmed | May, 2025

Comments
1 min read
I Taught My Linux Server to Feel Regret — Then Watched It Apologize in Real-Time | by Faruk Ahmed | May, 2025

I Taught My Linux Server to Feel Regret — Then Watched It Apologize in Real-Time | by Faruk Ahmed | May, 2025

Comments
1 min read
How to Detect Suspicious Activity on a Linux Server in Under 5 Minutes | by Faruk Ahmed | May, 2025

How to Detect Suspicious Activity on a Linux Server in Under 5 Minutes | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Use Bash Scripts to Save Time and Earn More as a Linux Freelancer | by Faruk Ahmed | May, 2025

How I Use Bash Scripts to Save Time and Earn More as a Linux Freelancer | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Use AuditD to Catch Silent Security Threats on Linux | by Faruk Ahmed | May, 2025

How I Use AuditD to Catch Silent Security Threats on Linux | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Caught a Suspicious Shell Script Running in /tmp (And What It Taught Me) | by Faruk Ahmed | May, 2025

How I Caught a Suspicious Shell Script Running in /tmp (And What It Taught Me) | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Accidentally Left a Port Open on My Linux Server (And How I Caught It) | by Faruk Ahmed | May, 2025

How I Accidentally Left a Port Open on My Linux Server (And How I Caught It) | by Faruk Ahmed | May, 2025

Comments
1 min read
7 Windows Server Defaults You Should Change Right After Installation | by Faruk Ahmed | May, 2025

7 Windows Server Defaults You Should Change Right After Installation | by Faruk Ahmed | May, 2025

Comments
1 min read
5 Windows Defender Features You’re Probably Not Using (But Should Be) | by Faruk Ahmed | May, 2025

5 Windows Defender Features You’re Probably Not Using (But Should Be) | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Rebuild a Linux Server After a Suspected Compromise (Step by Step) | by Faruk Ahmed | May, 2025

How I Rebuild a Linux Server After a Suspected Compromise (Step by Step) | by Faruk Ahmed | May, 2025

Comments
1 min read
How I Use Fail2Ban on Ubuntu and Linux to Block Attackers Before They Get In | by Faruk Ahmed | May, 2025

How I Use Fail2Ban on Ubuntu and Linux to Block Attackers Before They Get In | by Faruk Ahmed | May, 2025

Comments
1 min read
How to Audit a Linux or Ubuntu Server Like a Security Consultant | by Faruk Ahmed | May, 2025

How to Audit a Linux or Ubuntu Server Like a Security Consultant | by Faruk Ahmed | May, 2025

Comments
1 min read
The One Log Entry That Made Me Realize My Linux Server Was Being Scanned | by Faruk Ahmed | May, 2025

The One Log Entry That Made Me Realize My Linux Server Was Being Scanned | by Faruk Ahmed | May, 2025

Comments
1 min read
Why I Use Read-Only Partitions on My Linux Servers (And You Should Too) | by Faruk Ahmed | May, 2025

Why I Use Read-Only Partitions on My Linux Servers (And You Should Too) | by Faruk Ahmed | May, 2025

Comments
1 min read
7 Critical Linux Logs You Should Review After a Security Incident | by Faruk Ahmed | nextgenthreat | Apr, 2025

7 Critical Linux Logs You Should Review After a Security Incident | by Faruk Ahmed | nextgenthreat | Apr, 2025

Comments
1 min read
6 Signs Your Linux Server Might Be Compromised (And What to Do Next) | by Faruk Ahmed | May, 2025

6 Signs Your Linux Server Might Be Compromised (And What to Do Next) | by Faruk Ahmed | May, 2025

Comments
1 min read
5 Linux Commands Hackers Use (And How to Detect Them on Your Server) | by Faruk Ahmed | Apr, 2025

5 Linux Commands Hackers Use (And How to Detect Them on Your Server) | by Faruk Ahmed | Apr, 2025

Comments
1 min read
1 Linux Command That Saved Me From a Server Meltdown | by Faruk Ahmed | Apr, 2025

1 Linux Command That Saved Me From a Server Meltdown | by Faruk Ahmed | Apr, 2025

Comments
1 min read
The 5 Most Overlooked Linux Files That Could Expose Your Server to Hackers | by Faruk Ahmed | Apr, 2025

The 5 Most Overlooked Linux Files That Could Expose Your Server to Hackers | by Faruk Ahmed | Apr, 2025

Comments
1 min read
Secure Your Digital Vault: A Personal Safe for Your Passwords | by Faruk Ahmed

Secure Your Digital Vault: A Personal Safe for Your Passwords | by Faruk Ahmed

Comments
1 min read
I Tried Breaking Into My Own Linux Server — Here’s What I Learned About Real-World Security | by Faruk Ahmed | Apr, 2025

I Tried Breaking Into My Own Linux Server — Here’s What I Learned About Real-World Security | by Faruk Ahmed | Apr, 2025

Comments
1 min read
How to Use APIs to Build Money-Making Tools (With Python Examples) | by Faruk Ahmed | Apr, 2025

How to Use APIs to Build Money-Making Tools (With Python Examples) | by Faruk Ahmed | Apr, 2025

Comments
1 min read
loading...