Linux Forensics
Free Sandfly Linux Incident Response License
Sandfly is offering free licenses for incident response teams. Sandfly's agentless deployment on Linux makes it compatible, fast, and safe giving it unparalleled capability for incident response. Our…
Detecting Linux Stealth Rootkits with Directory Link Errors
Detecting stealth rootkits on Linux can be done from the command line. The secret is to ask the same question multiple ways to make sure all answers agree. If they don't all agree, something is…
Evasive Linux Malware Detection Video Presentation (BPFDoor)
Sandfly founder Craig Rowland recently spoke at the Oslo Cold Incident Response Conference on evasive Linux malware. Although talks were not recorded, he made a video of the presentation he gave…
Detecting Evasive Linux Malware Presentation
Sandfly founder Craig Rowland gave a presentation for the FIRST Cold Incident Response Conference in Oslo on evasive Linux backdoors and malware below: Evasive Linux Backdoors and Malware…
SSH Key Compromise Risks and Countermeasures
When it comes to securing Linux systems, Secure Shell (SSH) has been one of the most dependable tools at a sysadmin's disposal. However, with every technology solution, there are potential pitfalls…
Linux Stealth Rootkit Process Decloaking Tool Updated
Decloaking Linux stealth rootkits that are hiding processes from view is easy with our free tool sandfly-processdecloak which has been updated below: sandfly-processdecloak on Github This free tool…