Evasive Linux Malware and Backdoor Detection Presentation

Sandfly Security - Agentless Linux EDR and Incident Response Updated on September 29, 2026

Videos Malware Linux Security Linux Forensics Education Presentations
Evasive Linux Malware and Backdoor Detection Presentation

Publication Date: 14 November 2023

 

Sandfly founder Craig Rowland recently spoke at the Oslo Cold Incident Response Conference on evasive Linux malware. Although talks were not recorded, he made a video of the presentation he gave below.

 

This talk focused on the infamous BPFDoor backdoor. BPFDoor used a combination of simple evasion techniques to avoid detection on Linux by doing the following:

  • Process masquerading
  • Anti-forensics
  • Firewall bypasses
  • Covert communications and encryption
  • Professionally written and deployed

In this presentation we go over the elements that make for effective Linux malware and how to detect it using simple command line forensics.

Slides for the talk are below:

Evasive Linux Malware and Backdoors Slides

We thank the organizers of the conference for having us speak.

Post Tags:

Linux Forensics Videos Presentations Linux Security Malware Education

Share this post:

← Return to Blog