Deleted Process Binary Attack on Linux

Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated

Videos Linux Forensics Education
Deleted Process Binary Attack on Linux

Publication Date :19 December 2024

 

Malware on Linux will often delete the on-disk binary to evade detection with traditional anti-virus and file integrity monitoring tools. In this video we will discuss the threat and how to find it with Sandfly's agentless Linux EDR. We'll then show you how to investigate it with command line forensics and recover the running process binary for analysis.

 

Sandfly is able to find this and many other types of Linux attacks without deploying any endpoint agents. Get your free license today or contact us for more information.

 

Post Tags:

Videos Education Linux Forensics

Share this post:

 
← Return to Blog
Linux Process Running from /dev/shm RAM Disk Attack

Linux Process Running from /dev/shm RAM Disk Attack

Sandfly Security - Agentless Linux EDR and Incident Response : 19 December 2024

Linux malware will often run from the /dev/shm RAM disk to evade detection and destroy itself to hide evidence. Learn more in this video about how to...

Videos Linux Forensics Education
Read More
Default User SSH Authorized Key Risks on Linux

Default User SSH Authorized Key Risks on Linux

Sandfly Security - Agentless Linux EDR and Incident Response : 09 December 2024

Default Linux users can be used for persistent backdoors. Learn how to spot this risk with command line forensics and automatic threat detection.

Videos Linux Forensics Education
Read More
Hidden Linux Binary Threats for Intruders and Malware

Hidden Linux Binary Threats for Intruders and Malware

Sandfly Security - Agentless Linux EDR and Incident Response : 01 January 2026

Hidden binaries on Linux are often malware or intruder activity. Learn more about this threat and how to detect it here.

Videos Linux Forensics Education
Read More