Linux EDR nologin Shell Rename Backdoor Attack Detection and Forensics

Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated

Videos Malware Linux Forensics Education
Linux EDR nologin Shell Rename Backdoor Attack Detection and Forensics

Publication Date: 04 December 2024

 

Ever wondered what would happen if you replaced the Linux /sbin/nologin with a valid shell? Attackers have and it gives them a persistent backdoor on supposedly disabled accounts. In this video we go over this attack and how to find it on your systems with command line tools and agentless Sandfly.

Find out if your systems have been backdoored, plus thousands of other attack traces instantly. Sandfly's agentless EDR for Linux deploys rapidly without any endpoint agents. Get a free license today to try it out.

 

Post Tags:

Videos Linux Forensics Malware Education

Share this post:

← Return to Blog
Linux Duplicate User Password Hash Attack

Linux Duplicate User Password Hash Attack

Sandfly Security - Agentless Linux EDR and Incident Response : 02 December 2024

Learn what duplicate password hash attacks are on Linux and how to detect them.

Videos Malware Linux Forensics Education
Read More
Evasive Linux Malware and Backdoor Detection Presentation

Evasive Linux Malware and Backdoor Detection Presentation

Sandfly Security - Agentless Linux EDR and Incident Response : 14 November 2023

Evasive Linux malware and backdoor detection presentation featuring BPFDoor and command line forensics.

Videos Malware Linux Security Linux Forensics Education Presentations
Read More
Linux Obsolete Password Hash Risks

Linux Obsolete Password Hash Risks

Craig Rowland, Founder and CEO, Sandfly Security : 05 December 2024

Obsolete password hashes on Linux leave users vulnerable to brute force attack. Learn how to find them here.

Videos Malware Linux Forensics Education
Read More