Linux File System Hierarchy: A Practical Guide for SOC Analysts

A SOC-focused guide explains the Linux File System Hierarchy and its critical role in cybersecurity investigations, including log analysis, incident response, and threat hunting. Key directories such as /var/log serve as the primary source of authentication and event evidence, while /tmp is flagged as a common malware staging area due to its world-writable nature. Directories like /root and /etc are highlighted as indicators of privilege escalation and attacker persistence respectively, and /proc offers a live view of running processes that may reveal memory-only malware. The guide emphasizes that unlike Windows, Linux consolidates everything under a single root directory, meaning all forensic evidence resides within this unified hierarchy. Understanding these directory roles is presented as a foundational requirement before advancing to tools like SIEM or EDR platforms.