Linux Duplicate User Password Hash Attack

Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated

Videos Malware Linux Forensics Education
Linux Duplicate User Password Hash Attack

Publication Date: 02 December 2024

 

Duplicate password hashes on Linux are a tactic for attackers to drop backdoor accounts in an automated way. In this video we explain what a duplicate password hash attack is, and how you can find it with command line tools as well as automatically with Sandfly's agentless EDR for Linux.

Find out if your systems have duplicate password hashes, plus thousands of other attack traces instantly. Sandfly's agentless EDR for Linux deploys rapidly without any endpoint agents and without drama. Get a free license today to try it out.

 

Post Tags:

Videos Linux Forensics Malware Education

Share this post:

← Return to Blog
Linux EDR nologin Shell Rename Backdoor Attack Detection and Forensics

Linux EDR nologin Shell Rename Backdoor Attack Detection and Forensics

Sandfly Security - Agentless Linux EDR and Incident Response : 04 December 2024

Learn how to look for backdoor attacks that replace /sbin/nologin on Linux.

Videos Malware Linux Forensics Education
Read More
Linux Obsolete Password Hash Risks

Linux Obsolete Password Hash Risks

Craig Rowland, Founder and CEO, Sandfly Security : 05 December 2024

Obsolete password hashes on Linux leave users vulnerable to brute force attack. Learn how to find them here.

Videos Malware Linux Forensics Education
Read More
Linux Default User Password Attack Detection and Forensics

Linux Default User Password Attack Detection and Forensics

Sandfly Security - Agentless Linux EDR and Incident Response : 03 December 2024

Learn how to search for and identify default Linux users that have been given backdoor access to systems.

Videos Malware Linux Forensics Education
Read More