Blog
Christchurch HackerCon 2018 Presentation – Insider’s History of Intrusion Detection Technology
Sandfly founder Craig Rowland did a presentation on the insider’s history of Intrusion Detection Systems at the Christchurch HackerCon. His slides are below and a video will be released when it is…
Linux Cryptomining Malware Podcast Interview
Sandfly founder Craig Rowland discusses Linux cryptomining malware on the Digital Forensics Survival Podcast with host Michael. They go over what this class of malware does, how it gets onto Linux…
Why Agentless Security is Needed on Linux
When looking to secure Linux, you may be wondering: What is the main advantage of an agentless product like Sandfly over agent-based security solutions that exist? The answer is simple: It’s…
Linux Malware Cryptominer Detection and Forensics
This year we have seen a huge uptick in cryptomining malware against Linux servers. The usual attack vector is the following: A brute force attack against SSH accounts. Automated install of a pre…
The Pyramid of Pain and Sandfly
There is a great post called The Pyramid of Pain by David Blanco that details the six ways to cause adversaries the most trouble when attacking your network. The Pyramid of Pain is below: We’ve been…
Detecting Linux Binary File Poisoning
Let’s talk about Linux binary poisoning. Binary poisoning is tampering with a system command and replacing it with a malicious version. This can be a wholesale replacement with a new file designed to…