1 min read

Why You Must Monitor Linux for Signs of Intruders

Sandfly Security - Agentless Linux EDR and Incident Response : Published Updated

Rootkits Malware Linux Security Linux Forensics

Publication Date: 20 February 2019

When Sandfly Founder Craig Rowland was brought in to do his first penetration test many years ago, one of the first systems he broke into was a Unix system that had an uptime of four years. The box was unmonitored, unpatched and unknown just sitting on the network with nobody touching it.

He used that box to bring over other tools and spread all around the enterprise without anyone noticing. This episode made it clear to him how [SENTENCE CUT OFF ON LIVE SITE – FINISH OR DELETE]

In this video Craig will explain why having no active intruder monitoring on Linux is a very bad idea and why you should be watching your Linux boxes for active intruders all the time.

The reason we focus on Linux at Sandfly is to bring active hunting for intruders to Linux which is notoriously under-monitored for a variety of reasons. We use an agentless approach so you can have visibility into Linux systems where normally you wouldn’t be able to load any software on the endpoint.
How To Decloak Stealth Linux Cryptocurrency Mining Malware

How To Decloak Stealth Linux Cryptocurrency Mining Malware

Sandfly Security - Agentless Linux EDR and Incident Response : 16 December 2019

We'll show you how to de-cloak Linux stealth malware that is mining cryptocurrency. Linux forensics is fast and easy with command line tools.

Rootkits Malware Linux Security Linux Forensics
Read More
Linux Malware Cryptominer Detection and Forensics

Linux Malware Cryptominer Detection and Forensics

Craig Rowland, Founder and CEO, Sandfly Security : 25 July 2018

This year we have seen a huge uptick in cryptomining malware against Linux servers. The usual attack vector is the following: A brute force attack...

Rootkits Malware Linux Security Linux Forensics
Read More
Hunting for Linux Intrusion Tactics is Better than Searching for Exploit Signatures

Hunting for Linux Intrusion Tactics is Better than Searching for Exploit Signatures

Sandfly Security - Agentless Linux EDR and Incident Response : 13 February 2019

In this video we'll tell you why hunting for tactics is better than focusing on zero day attacks and exploit signatures to find Linux hackers and...

Videos Rootkits Malware Linux Security Linux Forensics
Read More