Malware
Hunting for Linux Intrusion Tactics is Better than Searching for Exploit Signatures
When the NSA and CIA source code leaked a couple years back, Sandfly founder Craig Rowland ignored the zero day attacks they had and studied their tactics in the code instead. In this video he’ll…
Why You Should Be Searching for Linux Anti-Forensics
In this video Sandfly founder Craig Rowland discusses why it's important to hunt for anti-forensics on Linux. Anti-forensics are techniques intruders and malware use on Linux hosts to conceal their…
Linux Malware Cryptominer Detection and Forensics
This year we have seen a huge uptick in cryptomining malware against Linux servers. The usual attack vector is the following: A brute force attack against SSH accounts. Automated install of a pre…
Detecting Linux Binary File Poisoning
Let’s talk about Linux binary poisoning. Binary poisoning is tampering with a system command and replacing it with a malicious version. This can be a wholesale replacement with a new file designed to…
Linux Malware Persistence with Cron
If malware is anything at all, it’s persistent. On Linux, just like Windows, malware once loaded wants to stay loaded. On Windows systems this is usually done with a variety of registry mechanisms.…
Detect Linux Loadable Kernel Module Stealth Rootkits Agentlessly with Sandfly
Watch Sandfly’s agentless intrusion detection and threat hunting technology detect a Linux stealth rootkit. Sandfly automates the investigation and alerting of Linux rootkit compromises so you can…