Ninjas on Rooftops – A Better Approach to Linux Threat Hunting

Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated

Linux Security
Ninjas on Rooftops – A Better Approach to Linux Threat Hunting
Sandfly Blog

Ninjas on Rooftops – A Better Approach to Linux Threat Hunting

11 February 2019

Linux Security

Intrusion detection thought for the day: Someone trying to hide is a signature.

In this video, Sandfly founder Craig Rowland discusses why hunting for hiding tactics vs. specific exploit signatures is an effective way to find intruders on Linux. Sandfly has a lot of investigation capability around finding malicious hiding activity and tampering on Linux for this reason.

Post Tags:

Linux Security

Share this post:

← Return to Blog
Linux Stealth Rootkit Hunting Presentation

Linux Stealth Rootkit Hunting Presentation

Sandfly Security - Agentless Linux EDR and Incident Response : 09 October 2025

Hunting Linux stealth rootkits with command line tools from the Cold Incident Response Conference 2025.

Malware Linux Security Linux Forensics Presentations
Read More
Linux Stealth Rootkit Hunting Video Presentation

Linux Stealth Rootkit Hunting Video Presentation

Sandfly Security - Agentless Linux EDR and Incident Response : 03 November 2025

Video of hunting Linux stealth rootkits with command line tools from the Cold Incident Response Conference 2025.

Malware Linux Security Linux Forensics Presentations
Read More

Why You Should Be Searching for Linux Anti-Forensics

Sandfly Security - Agentless Linux EDR and Incident Response : 09 February 2019

Hunting for Linux anti-forensic techniques can often lead you to a compromised host without needing to know specific exploits used to gain access.

Videos Rootkits Malware Linux Security Linux Forensics
Read More