Detecting Linux Stealth Rootkits with Directory Link Errors
Sandfly is an agentless Linux EDR and Incident Response platform. Sandfly finds Linux malware, rootkits, and hackers on Linux without endpoint agents.
1 min read
Sandfly founder Craig Rowland gave a presentation for the FIRST Cold Incident Response Conference in Oslo on evasive Linux backdoors and malware below:
Evasive Linux Backdoors and Malware Presentation
This talk focused on the infamous BPFDoor backdoor. BPFDoor used a combination of simple evasion techniques to avoid detection on Linux by doing the following:
- Process masquerading
- Anti-forensics
- Firewall bypasses
- Covert communications and encryption
- Professionally written and deployed
In this presentation we go over the elements that make for effective Linux malware and how to detect them using simple command line forensics such as the following:
- Discovering processes that are hiding their real names
- Anti-forensic detection
- Finding processes sniffing network traffic
- General tips and ideas to find evasive Linux malware
We thank the organizers of the conference for having us speak.
Sandfly 5.3 - Linux Host Forensics and Microsoft Sentinel Integration
Get detailed Linux host forensics and Microsoft Sentinel integration with Sandfly's agentless Linux EDR.
Evasive Linux Malware and Backdoor Detection Presentation
Evasive Linux malware and backdoor detection presentation featuring BPFDoor and command line forensics.