When you log into a Linux system, make it a habit to look at the processes with this command:

ps -auxwf

This will list out all processes in tree format. It makes it easy to spot unusual activity.

For instance, this is what a PHP reverse bindshell backdoor will look like.

When investigating a suspicious process on Linux, try this:

strings /proc/<PID>/environ

For example, a socat command was used to spawn a reverse bindshell backdoor. Environ entry shows SSH connection data and traces to the socat comand. Some versions of netcat do similar.

Many attackers do not wipe their process environment and this can leave behind high fidelity forensics to help investigate. Many programs leave really obvious data in the process environment. It's there for the asking on Linux.