Deleted Process Binary Attack on Linux
Linux malware often deletes its binary from the disk to evade detection and analysis. Learn how to detect and respond to this attack in this video.
Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated
Publication Date: 19 December 2024
The Linux RAM disk in /dev/shm is a favorite place for malware to hide. The RAM disk is not frequently checked and is volatile so the malware can be sure it leaves not traces on disk if the system reboots. In this video we go over this attack, how to find it with Sandfly agentless Linux EDR, and command line forensics you can use to help investigate what may be happening
Sandfly is able to find this and many other types of Linux attacks without deploying any endpoint agents. Get your free license today or contact us for more information.
Linux malware often deletes its binary from the disk to evade detection and analysis. Learn how to detect and respond to this attack in this video.
A Linux process running from temporary directories is often malware. Learn about this Linux threat and how to detect it here.
Default Linux users can be used for persistent backdoors. Learn how to spot this risk with command line forensics and automatic threat detection.