https://sandflysecurity.com/blog/blog/sandfly-5-3-1-video-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-58-agentless-response-and-ssh-key-managementhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782695778-response-action-log.png1782695778-response-action-log1782695778-response-action-loghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management10-ssh-protected-key.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management10-ssh-protected-keyblog-imagessandfly-58-agentless-response-and-ssh-key-management10-ssh-protected-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782695488-process-memfd-response.png1782695488-process-memfd-response1782695488-process-memfd-responsehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782696568-ssh-key-delete-single-user.png1782696568-ssh-key-delete-single-user1782696568-ssh-key-delete-single-userhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management08-ssh-key-duplicate-full-listing.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management08-ssh-key-duplicate-full-listingblog-imagessandfly-58-agentless-response-and-ssh-key-management08-ssh-key-duplicate-full-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management02-response-action-log.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management02-response-action-logblog-imagessandfly-58-agentless-response-and-ssh-key-management02-response-action-loghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782696754-ssh-key-delete.png1782696754-ssh-key-delete1782696754-ssh-key-deletehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management05-ssh-key-delete-single-user.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management05-ssh-key-delete-single-userblog-imagessandfly-58-agentless-response-and-ssh-key-management05-ssh-key-delete-single-userhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782707609-ssh-duplicate-key-alert.png1782707609-ssh-duplicate-key-alert1782707609-ssh-duplicate-key-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management01-process-memfd-response.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management01-process-memfd-responseblog-imagessandfly-58-agentless-response-and-ssh-key-management01-process-memfd-responsehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782697313-ssh-key-duplicate.png1782697313-ssh-key-duplicate1782697313-ssh-key-duplicatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management03-process-memfd-download-full-details.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management03-process-memfd-download-full-detailsblog-imagessandfly-58-agentless-response-and-ssh-key-management03-process-memfd-download-full-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782695928-process-memfd-download-full-details.png1782695928-process-memfd-download-full-details1782695928-process-memfd-download-full-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management06-ssh-duplicate-key-alert.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management06-ssh-duplicate-key-alertblog-imagessandfly-58-agentless-response-and-ssh-key-management06-ssh-duplicate-key-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782697287-ssh-key-duplicate-full-listing.png1782697287-ssh-key-duplicate-full-listing1782697287-ssh-key-duplicate-full-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782698242-ssh-protected-key.png1782698242-ssh-protected-key1782698242-ssh-protected-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management07-ssh-key-duplicate.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management07-ssh-key-duplicateblog-imagessandfly-58-agentless-response-and-ssh-key-management07-ssh-key-duplicatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management11-user-responder-role.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management11-user-responder-roleblog-imagessandfly-58-agentless-response-and-ssh-key-management11-user-responder-rolehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782697439-ssh-key-de-duplicate.png1782697439-ssh-key-de-duplicate1782697439-ssh-key-de-duplicatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management04-ssh-key-delete.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management04-ssh-key-deleteblog-imagessandfly-58-agentless-response-and-ssh-key-management04-ssh-key-deletehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782703958-5-8-thumbnail-logo.png1782703958-5-8-thumbnail-logo1782703958-5-8-thumbnail-logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.8%20-%20Agentless%20Linux%20Response%20and%20SSH%20Key%20Management/blog-imagessandfly-58-agentless-response-and-ssh-key-management09-ssh-key-de-duplicate.pngblog-imagessandfly-58-agentless-response-and-ssh-key-management09-ssh-key-de-duplicateblog-imagessandfly-58-agentless-response-and-ssh-key-management09-ssh-key-de-duplicatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782696111-user-responder-role.png1782696111-user-responder-role1782696111-user-responder-rolehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752634887-llm-setup.png1752634887-llm-setup1752634887-llm-setuphttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning16-scheduler-trickle-scan.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning16-scheduler-trickle-scanblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning16-scheduler-trickle-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning13-llm-setup.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning13-llm-setupblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning13-llm-setuphttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning06-llm-result-investigation.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning06-llm-result-investigationblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning06-llm-result-investigationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752626638-llm-analyst-question-3.png1752626638-llm-analyst-question-31752626638-llm-analyst-question-3https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752637832-llm-host-analysis-overview.png1752637832-llm-host-analysis-overview1752637832-llm-host-analysis-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning08-llm-host-analysis-suggested-items-to-investigate.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning08-llm-host-analysis-suggested-items-to-investigateblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning08-llm-host-analysis-suggested-items-to-investigatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752631989-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors.png1752631989-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors1752631989-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752637913-llm-host-analysis-brief-and-overview.png1752637913-llm-host-analysis-brief-and-overview1752637913-llm-host-analysis-brief-and-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752626692-llm-analyst-answer-3.png1752626692-llm-analyst-answer-31752626692-llm-analyst-answer-3https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752632888-scheduler-trickle-scan.png1752632888-scheduler-trickle-scan1752632888-scheduler-trickle-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning14-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning14-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning14-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning15-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning15-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning15-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning10-llm-analyst-answer-2.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning10-llm-analyst-answer-2blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning10-llm-analyst-answer-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1.png1752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-11752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752624938-llm-result-investigation.png1752624938-llm-result-investigation1752624938-llm-result-investigationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752637687-llm-host-analysis-button.png1752637687-llm-host-analysis-button1752637687-llm-host-analysis-buttonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752637622-results-bpfdoor2.png1752637622-results-bpfdoor21752637622-results-bpfdoor2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752637974-llm-result-recommended-actions.png1752637974-llm-result-recommended-actions1752637974-llm-result-recommended-actionshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning03-llm-host-analysis-overview.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning03-llm-host-analysis-overviewblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning03-llm-host-analysis-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning07-llm-result-recommended-actions.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning07-llm-result-recommended-actionsblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning07-llm-result-recommended-actionshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752623713-sandfly-5-5-ai-destroying-linux-malware.jpg1752623713-sandfly-5-5-ai-destroying-linux-malware1752623713-sandfly-5-5-ai-destroying-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning01-results-bpfdoor2-1.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning01-results-bpfdoor2-1blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning01-results-bpfdoor2-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752625209-llm-host-analysis-suggested-items-to-investigate.png1752625209-llm-host-analysis-suggested-items-to-investigate1752625209-llm-host-analysis-suggested-items-to-investigatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning02-llm-host-analysis-button.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning02-llm-host-analysis-buttonblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning02-llm-host-analysis-buttonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759091899-nk-open-to-work-circle-transparent.png1759091899-nk-open-to-work-circle-transparent1759091899-nk-open-to-work-circle-transparenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning11-llm-analyst-question-3.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning11-llm-analyst-question-3blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning11-llm-analyst-question-3https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752626307-llm-analyst-answer-2.png1752626307-llm-analyst-answer-21752626307-llm-analyst-answer-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5%20AI-Powered%20Analysis%2c%20Advanced%20BPFDoor%20Detection%2c%20and%20Smarter%20Scanning/blog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning04-llm-host-analysis-brief-and-overview.pngblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning04-llm-host-analysis-brief-and-overviewblog-imagessandfly-5-5-ai-powered-analysis-advanced-bpfdoor-detection-and-smarter-scanning04-llm-host-analysis-brief-and-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752626288-llm-analyst-question-2.png1752626288-llm-analyst-question-21752626288-llm-analyst-question-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752624817-llm-host-details.png1752624817-llm-host-details1752624817-llm-host-details2026-09-28https://sandflysecurity.com/blog/sandfly-2-3-3-more-linux-sniffer-and-immutable-file-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.3%20%E2%80%93%20More%20Linux%20Sniffer%20and%20Immutable%20File%20Detection/blog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection02-custom-sandfly-search-for-immutable-ssh-authorizedkeys.pngblog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection02-custom-sandfly-search-for-immutable-ssh-authorizedkeysblog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection02-custom-sandfly-search-for-immutable-ssh-authorizedkeyshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881200-malicious-dsniff-sniffer-on-linux.png1635881200-malicious-dsniff-sniffer-on-linux1635881200-malicious-dsniff-sniffer-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881391-custom-sandfly-search-for-immutable-ssh-authorizedkeys.png1635881391-custom-sandfly-search-for-immutable-ssh-authorizedkeys1635881391-custom-sandfly-search-for-immutable-ssh-authorizedkeyshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.3%20%E2%80%93%20More%20Linux%20Sniffer%20and%20Immutable%20File%20Detection/blog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection01-malicious-dsniff-sniffer-on-linux.pngblog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection01-malicious-dsniff-sniffer-on-linuxblog-imagessandfly-2-3-3-more-linux-sniffer-and-immutable-file-detection01-malicious-dsniff-sniffer-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-1-3-updatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-2.png1712190688-thumbnail-generic-21712190688-thumbnail-generic-22026-09-28https://sandflysecurity.com/blog/sandfly-1-4-6-performance-and-syslog-updateshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216291-syslog-alerts.png1635216291-syslog-alerts1635216291-syslog-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnail2026-09-28https://sandflysecurity.com/blog/active-vs-dormant-attacks-on-linux-don-t-neglect-eitherhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1692319118-ssh-hunter-new-key.png1692319118-ssh-hunter-new-key1692319118-ssh-hunter-new-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Active%20vs%20Dormant%20Attacks%20on%20Linux%20dont%20negate%20either/blog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either04-ssh-hunter-new-key.pngblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either04-ssh-hunter-new-keyblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either04-ssh-hunter-new-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Active%20vs%20Dormant%20Attacks%20on%20Linux%20dont%20negate%20either/blog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either03-dormant-masquerading-file.pngblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either03-dormant-masquerading-fileblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either03-dormant-masquerading-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1692317615-dormant-masquerading-file.png1692317615-dormant-masquerading-file1692317615-dormant-masquerading-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Active%20vs%20Dormant%20Attacks%20on%20Linux%20dont%20negate%20either/blog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either01-process-netcat-masquerading.pngblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either01-process-netcat-masqueradingblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either01-process-netcat-masqueradinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1692320967-loitering-munition.jpg1692320967-loitering-munition1692320967-loitering-munitionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Active%20vs%20Dormant%20Attacks%20on%20Linux%20dont%20negate%20either/blog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either02-loitering-munition.jpgblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either02-loitering-munitionblog-imagesactive-vs-dormant-attacks-on-linux-don-t-neglect-either02-loitering-munitionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1692320967-loitering-munition-1.jpg1692320967-loitering-munition-11692320967-loitering-munition-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1692317319-process-netcat-masquerading.png1692317319-process-netcat-masquerading1692317319-process-netcat-masquerading2026-09-28https://sandflysecurity.com/blog/how-to-decloak-stealth-linux-cryptocurrency-mining-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware09-decloak-ld-so-preload-by-moving-it.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware09-decloak-ld-so-preload-by-moving-itblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware09-decloak-ld-so-preload-by-moving-ithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216358-investigating-etc-ld-so-preload-library-strings-content.png1635216358-investigating-etc-ld-so-preload-library-strings-content1635216358-investigating-etc-ld-so-preload-library-strings-contenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216350-investigating-etc-ld-so-preload-library-file-type.png1635216350-investigating-etc-ld-so-preload-library-file-type1635216350-investigating-etc-ld-so-preload-library-file-typehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware10-decloaked-ps-1.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware10-decloaked-ps-1blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware10-decloaked-ps-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216367-decloak-ld-so-preload-by-moving-it.png1635216367-decloak-ld-so-preload-by-moving-it1635216367-decloak-ld-so-preload-by-moving-ithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216395-decloaked-proc-dir-listing-standard-forensics.png1635216395-decloaked-proc-dir-listing-standard-forensics1635216395-decloaked-proc-dir-listing-standard-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755145719-north-korean-linux-malware.jpg1755145719-north-korean-linux-malware1755145719-north-korean-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware07-investigating-etc-ld-so-preload-library-file-type.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware07-investigating-etc-ld-so-preload-library-file-typeblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware07-investigating-etc-ld-so-preload-library-file-typehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216385-decloaked-proc-dir-listing.png1635216385-decloaked-proc-dir-listing1635216385-decloaked-proc-dir-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216325-ls-command-proc-cloaked-malware.png1635216325-ls-command-proc-cloaked-malware1635216325-ls-command-proc-cloaked-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216342-investigating-etc-ld-so-preload-library.png1635216342-investigating-etc-ld-so-preload-library1635216342-investigating-etc-ld-so-preload-libraryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216375-decloaked-ps-1.png1635216375-decloaked-ps-11635216375-decloaked-ps-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware03-cloaked-ps.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware03-cloaked-psblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware03-cloaked-pshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware12-decloaked-proc-dir-listing-standard-forensics.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware12-decloaked-proc-dir-listing-standard-forensicsblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware12-decloaked-proc-dir-listing-standard-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware01-cloaked-miner-linux-scaled.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware01-cloaked-miner-linux-scaledblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware01-cloaked-miner-linux-scaledhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware08-investigating-etc-ld-so-preload-library-strings-content.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware08-investigating-etc-ld-so-preload-library-strings-contentblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware08-investigating-etc-ld-so-preload-library-strings-contenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216315-cloaked-ps.png1635216315-cloaked-ps1635216315-cloaked-pshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware05-investigating-etc-ld-so-preload.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware05-investigating-etc-ld-so-preloadblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware05-investigating-etc-ld-so-preloadhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-process-high-entropy-annotated.png1635216307-process-high-entropy-annotated1635216307-process-high-entropy-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-cloaked-miner-linux-scaled.png1635216293-cloaked-miner-linux-scaled1635216293-cloaked-miner-linux-scaledhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware04-ls-command-proc-cloaked-malware.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware04-ls-command-proc-cloaked-malwareblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware04-ls-command-proc-cloaked-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware02-process-high-entropy-annotated.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware02-process-high-entropy-annotatedblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware02-process-high-entropy-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216335-investigating-etc-ld-so-preload.png1635216335-investigating-etc-ld-so-preload1635216335-investigating-etc-ld-so-preloadhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware11-decloaked-proc-dir-listing.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware11-decloaked-proc-dir-listingblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware11-decloaked-proc-dir-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Decloak%20Stealth%20Linux%20Cryptocurrency%20Mining%20Malware/blog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware06-investigating-etc-ld-so-preload-library.pngblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware06-investigating-etc-ld-so-preload-libraryblog-imageshow-to-decloak-stealth-linux-cryptocurrency-mining-malware06-investigating-etc-ld-so-preload-library2026-09-28https://sandflysecurity.com/why-sandfly/case-studies/fairphonehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/fairphone.jpgfairphonefairphone2026-09-18https://sandflysecurity.com/platform/drift-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/results.pngresultsresultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/platform/password-auditinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/secure-alertt.pngsecure-alerttsecure-alertthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/why-you-should-be-searching-for-linux-anti-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/partners/pedabhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-22https://sandflysecurity.com/blog/linux-stealth-rootkit-hunting-video-presentationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759985895-linux-stealth-rootkit-hunting-title-screen-1.png1759985895-linux-stealth-rootkit-hunting-title-screen-11759985895-linux-stealth-rootkit-hunting-title-screen-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/detecting-linux-stealth-rootkits-with-directory-link-errorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280622-reptile-ls-directory-stat-command.png1719280622-reptile-ls-directory-stat-command1719280622-reptile-ls-directory-stat-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors03-reptile-directory-hidden-dir-reptile_cmd-revealed.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors03-reptile-directory-hidden-dir-reptile_cmd-revealedblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors03-reptile-directory-hidden-dir-reptile_cmd-revealedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280569-reptile-ls-directory-count-command.png1719280569-reptile-ls-directory-count-command1719280569-reptile-ls-directory-count-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors07-picard-five-directories.jpgblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors07-picard-five-directoriesblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors07-picard-five-directorieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280785-sandfly-mismatch.png1719280785-sandfly-mismatch1719280785-sandfly-mismatchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors01-reptile-directory-hidden-dir-narrated.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors01-reptile-directory-hidden-dir-narratedblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors01-reptile-directory-hidden-dir-narratedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280666-reptile-ls-directory-ls-and-stat-command.png1719280666-reptile-ls-directory-ls-and-stat-command1719280666-reptile-ls-directory-ls-and-stat-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors02-reptile-directory-hidden-dir-before.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors02-reptile-directory-hidden-dir-beforeblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors02-reptile-directory-hidden-dir-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors05-reptile-ls-directory-stat-command.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors05-reptile-ls-directory-stat-commandblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors05-reptile-ls-directory-stat-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors09-sandfly-full-results.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors09-sandfly-full-resultsblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors09-sandfly-full-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280808-sandfly-full-results.png1719280808-sandfly-full-results1719280808-sandfly-full-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors06-reptile-ls-directory-ls-and-stat-command.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors06-reptile-ls-directory-ls-and-stat-commandblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors06-reptile-ls-directory-ls-and-stat-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280415-reptile-directory-hidden-dir-narrated.png1719280415-reptile-directory-hidden-dir-narrated1719280415-reptile-directory-hidden-dir-narratedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280501-reptile-directory-hidden-dir-reptile_cmd-revealed.png1719280501-reptile-directory-hidden-dir-reptile_cmd-revealed1719280501-reptile-directory-hidden-dir-reptile_cmd-revealedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors04-reptile-ls-directory-count-command.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors04-reptile-ls-directory-count-commandblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors04-reptile-ls-directory-count-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280730-picard-five-directories.jpg1719280730-picard-five-directories1719280730-picard-five-directorieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719280459-reptile-directory-hidden-dir-before.png1719280459-reptile-directory-hidden-dir-before1719280459-reptile-directory-hidden-dir-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Stealth%20Rootkits%20with%20Directory%20Link%20Errors/blog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors08-sandfly-mismatch.pngblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors08-sandfly-mismatchblog-imagesdetecting-linux-stealth-rootkits-with-directory-link-errors08-sandfly-mismatch2026-09-28https://sandflysecurity.com/blog/blog/unsecured-and-unencrypted-ssh-private-key-threats-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426426-thumbnail-duplicate-user-password-hash-attack-1.png1733426426-thumbnail-duplicate-user-password-hash-attack-11733426426-thumbnail-duplicate-user-password-hash-attack-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/detecting-and-investigating-openssl-backdoors-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216355-victim-proc-strings-environ.png1635216355-victim-proc-strings-environ1635216355-victim-proc-strings-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1719877061-openssl-process-backdoor-bindshell-reverse-openssl.png1719877061-openssl-process-backdoor-bindshell-reverse-openssl1719877061-openssl-process-backdoor-bindshell-reverse-opensslhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216386-victim-proc-fd-shell-listener.png1635216386-victim-proc-fd-shell-listener1635216386-victim-proc-fd-shell-listenerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216301-attacker-openssl-listener-shell.png1635216301-attacker-openssl-listener-shell1635216301-attacker-openssl-listener-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216326-victim-lsof-openssl-view.png1635216326-victim-lsof-openssl-view1635216326-victim-lsof-openssl-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-victim-openssl-reverse-bindshell-operating.png1635216311-victim-openssl-reverse-bindshell-operating1635216311-victim-openssl-reverse-bindshell-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216318-victim-ps-listing.png1635216318-victim-ps-listing1635216318-victim-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1719876958-openssl-process-backdoor-bindshell-reverse-generic.png1719876958-openssl-process-backdoor-bindshell-reverse-generic1719876958-openssl-process-backdoor-bindshell-reverse-generichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719876854-openssl-backdoor-results.png1719876854-openssl-backdoor-results1719876854-openssl-backdoor-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1719876854-openssl-backdoor-results.png1719876854-openssl-backdoor-results1719876854-openssl-backdoor-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216379-victim-cd-tmp-ls-listing.png1635216379-victim-cd-tmp-ls-listing1635216379-victim-cd-tmp-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216341-victim-proc-cd-and-ls-listing.png1635216341-victim-proc-cd-and-ls-listing1635216341-victim-proc-cd-and-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216311-victim-openssl-reverse-bindshell-operating.png1635216311-victim-openssl-reverse-bindshell-operating1635216311-victim-openssl-reverse-bindshell-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216379-victim-cd-tmp-ls-listing.png1635216379-victim-cd-tmp-ls-listing1635216379-victim-cd-tmp-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216355-victim-proc-strings-environ.png1635216355-victim-proc-strings-environ1635216355-victim-proc-strings-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719876903-openssl-file-suspicious-named-pipe.png1719876903-openssl-file-suspicious-named-pipe1719876903-openssl-file-suspicious-named-pipehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216333-victim-netstat-listing.png1635216333-victim-netstat-listing1635216333-victim-netstat-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216372-victim-proc-cd-fd-ls-listing.png1635216372-victim-proc-cd-fd-ls-listing1635216372-victim-proc-cd-fd-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719876958-openssl-process-backdoor-bindshell-reverse-generic.png1719876958-openssl-process-backdoor-bindshell-reverse-generic1719876958-openssl-process-backdoor-bindshell-reverse-generichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216364-victim-proc-maps-listing.png1635216364-victim-proc-maps-listing1635216364-victim-proc-maps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104493-bincrypter-man.jpg1743104493-bincrypter-man1743104493-bincrypter-manhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216341-victim-proc-cd-and-ls-listing.png1635216341-victim-proc-cd-and-ls-listing1635216341-victim-proc-cd-and-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216326-victim-lsof-openssl-view.png1635216326-victim-lsof-openssl-view1635216326-victim-lsof-openssl-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216333-victim-netstat-listing.png1635216333-victim-netstat-listing1635216333-victim-netstat-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1719876903-openssl-file-suspicious-named-pipe.png1719876903-openssl-file-suspicious-named-pipe1719876903-openssl-file-suspicious-named-pipehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719877001-openssl-process-running-openssl-client.png1719877001-openssl-process-running-openssl-client1719877001-openssl-process-running-openssl-clienthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-reverse-bindshell-diagram.jpg1635216293-reverse-bindshell-diagram1635216293-reverse-bindshell-diagramhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216348-victim-proc-strings-cmdline.png1635216348-victim-proc-strings-cmdline1635216348-victim-proc-strings-cmdlinehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216372-victim-proc-cd-fd-ls-listing.png1635216372-victim-proc-cd-fd-ls-listing1635216372-victim-proc-cd-fd-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216318-victim-ps-listing.png1635216318-victim-ps-listing1635216318-victim-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216386-victim-proc-fd-shell-listener.png1635216386-victim-proc-fd-shell-listener1635216386-victim-proc-fd-shell-listenerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported%20sitepage%20images/1635216364-victim-proc-maps-listing.png1635216364-victim-proc-maps-listing1635216364-victim-proc-maps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1719877061-openssl-process-backdoor-bindshell-reverse-openssl.png1719877061-openssl-process-backdoor-bindshell-reverse-openssl1719877061-openssl-process-backdoor-bindshell-reverse-opensslhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-attacker-openssl-listener-shell.png1635216301-attacker-openssl-listener-shell1635216301-attacker-openssl-listener-shell2026-09-28https://sandflysecurity.com/privacy-policyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/ssh-excessive-keys-risk-do-you-have-too-many-ssh-keyshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734035759-video-thumb-ssh-excessive-keys-risk.png1734035759-video-thumb-ssh-excessive-keys-risk1734035759-video-thumb-ssh-excessive-keys-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/how-to-detect-and-decloak-linux-stealth-rootkit-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668121383-sandfly-file-decloak-etc-modules.png1668121383-sandfly-file-decloak-etc-modules1668121383-sandfly-file-decloak-etc-moduleshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668126424-sandfly-detect-module-mismatch-cloaked-linux-rootkit.png1668126424-sandfly-detect-module-mismatch-cloaked-linux-rootkit1668126424-sandfly-detect-module-mismatch-cloaked-linux-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Detect%20and%20Decloak%20Linux%20Stealth%20Rootkit%20Data/blog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data05-sandfy-detect-raw-sandfly-size_mismatch-check-parameter.pngblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data05-sandfy-detect-raw-sandfly-size_mismatch-check-parameterblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data05-sandfy-detect-raw-sandfly-size_mismatch-check-parameterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668126619-sandfy-detect-raw-sandfly-size_mismatch-check-parameter.png1668126619-sandfy-detect-raw-sandfly-size_mismatch-check-parameter1668126619-sandfy-detect-raw-sandfly-size_mismatch-check-parameterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Detect%20and%20Decloak%20Linux%20Stealth%20Rootkit%20Data/blog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data01-vi-cloaked-data.pngblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data01-vi-cloaked-datablog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data01-vi-cloaked-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668127936-vi-cloaked-data.png1668127936-vi-cloaked-data1668127936-vi-cloaked-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668508075-decloak-with-ls-and-wc.png1668508075-decloak-with-ls-and-wc1668508075-decloak-with-ls-and-wchttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Detect%20and%20Decloak%20Linux%20Stealth%20Rootkit%20Data/blog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data03-sandfly-file-decloak-etc-modules.pngblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data03-sandfly-file-decloak-etc-modulesblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data03-sandfly-file-decloak-etc-moduleshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Detect%20and%20Decloak%20Linux%20Stealth%20Rootkit%20Data/blog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data04-sandfly-detect-module-mismatch-cloaked-linux-rootkit.pngblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data04-sandfly-detect-module-mismatch-cloaked-linux-rootkitblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data04-sandfly-detect-module-mismatch-cloaked-linux-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755145719-north-korean-linux-malware.jpg1755145719-north-korean-linux-malware1755145719-north-korean-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20How%20To%20Detect%20and%20Decloak%20Linux%20Stealth%20Rootkit%20Data/blog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data02-decloak-with-ls-and-wc.pngblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data02-decloak-with-ls-and-wcblog-imageshow-to-detect-and-decloak-linux-stealth-rootkit-data02-decloak-with-ls-and-wc2026-09-28https://sandflysecurity.com/blog/linux-duplicate-user-password-hash-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426426-thumbnail-duplicate-user-password-hash-attack-1.png1733426426-thumbnail-duplicate-user-password-hash-attack-11733426426-thumbnail-duplicate-user-password-hash-attack-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/resources/product-faqshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-17https://sandflysecurity.com/blog/sandflys-agentless-linux-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782964380-sandfly-ai-isolation-layer.png1782964380-sandfly-ai-isolation-layer1782964380-sandfly-ai-isolation-layerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783032833-ai-host-analysis-ebpf-rootkit.png1783032833-ai-host-analysis-ebpf-rootkit1783032833-ai-host-analysis-ebpf-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensics2026-09-28https://sandflysecurity.com/sample-test-pagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-14https://sandflysecurity.com/why-sandfly/compatibilityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/sandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection02-reptile-hidden-shell.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection02-reptile-hidden-shellblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection02-reptile-hidden-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection05-sandfly-file-permissions-risk-etc-dir.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection05-sandfly-file-permissions-risk-etc-dirblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection05-sandfly-file-permissions-risk-etc-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216299-reptile-hidden-shell.png1635216299-reptile-hidden-shell1635216299-reptile-hidden-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection08-ssh-enabled-tcp-forwarding-1.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection08-ssh-enabled-tcp-forwarding-1blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection08-ssh-enabled-tcp-forwarding-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection03-sctp-running-from-tmp.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection03-sctp-running-from-tmpblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection03-sctp-running-from-tmphttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216332-process-backdoor-bindshell-revserse-socat.png1635216332-process-backdoor-bindshell-revserse-socat1635216332-process-backdoor-bindshell-revserse-socathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection06-process-backdoor-bindshell-revserse-socat.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection06-process-backdoor-bindshell-revserse-socatblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection06-process-backdoor-bindshell-revserse-socathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection07-sandfly-user-history-data.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection07-sandfly-user-history-datablog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection07-sandfly-user-history-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216317-sandfly-user-history-malicious.png1635216317-sandfly-user-history-malicious1635216317-sandfly-user-history-malicioushttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection01-attack-history-alert.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection01-attack-history-alertblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection01-attack-history-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216310-sctp-running-from-tmp.png1635216310-sctp-running-from-tmp1635216310-sctp-running-from-tmphttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216340-sandfly-user-history-data.png1635216340-sandfly-user-history-data1635216340-sandfly-user-history-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216325-sandfly-file-permissions-risk-etc-dir.png1635216325-sandfly-file-permissions-risk-etc-dir1635216325-sandfly-file-permissions-risk-etc-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.7.0%20Mitre%20ATTCK%20Tags%20Enhanced%20Linux%20Stealth%20Rootkit%20DeCloaking%20and%20SCTP/blog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection04-sandfly-user-history-malicious.pngblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection04-sandfly-user-history-maliciousblog-imagessandfly-2-7-0-mitre-attck-tags-enhanced-linux-stealth-rootkit-de-cloaking-and-sctp-backdoor-detection04-sandfly-user-history-malicioushttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216347-ssh-enabled-tcp-forwarding-1.png1635216347-ssh-enabled-tcp-forwarding-11635216347-ssh-enabled-tcp-forwarding-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/linux-malware-investigation-myth-you-dont-need-a-debuggerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/sandfly-review-holistic-infosechttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/linux-malware-cryptominer-detection-and-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1672884665-google-cloud-security-report-targeted-software-1.png1672884665-google-cloud-security-report-targeted-software-11672884665-google-cloud-security-report-targeted-software-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216300-cryptominer-file-attributes.png1635216300-cryptominer-file-attributes1635216300-cryptominer-file-attributeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216313-cryptominer-process-attributes.png1635216313-cryptominer-process-attributes1635216313-cryptominer-process-attributeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-suspicious-cron-entry.png1635216293-suspicious-cron-entry1635216293-suspicious-cron-entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/blog/using-command-line-tools-to-find-process-masquerading-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-1-1-11-updateshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/sandfly-5-2-linux-stealth-rootkit-file-and-directory-de-cloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728249167-stealth-rootkit-kernel-hooking.png1728249167-stealth-rootkit-kernel-hooking1728249167-stealth-rootkit-kernel-hookinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745338340-sandfly_5-4-cisco-juniper.png1745338340-sandfly_5-4-cisco-juniper1745338340-sandfly_5-4-cisco-juniperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728253141-mounts-used-available-size.png1728253141-mounts-used-available-size1728253141-mounts-used-available-sizehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728252051-reptile-hidden-file.png1728252051-reptile-hidden-file1728252051-reptile-hidden-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking.png1728261226-thumbnail-root-kit-decloaking1728261226-thumbnail-root-kit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728276607-diamorphine-hidden-directory.png1728276607-diamorphine-hidden-directory1728276607-diamorphine-hidden-directoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-12026-09-28https://sandflysecurity.com/supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/sandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coveragehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759091899-nk-open-to-work-circle-transparent.png1759091899-nk-open-to-work-circle-transparent1759091899-nk-open-to-work-circle-transparenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1706830511-sandfly-hosts-distributions-report.png1706830511-sandfly-hosts-distributions-report1706830511-sandfly-hosts-distributions-reporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.0%20-%20Agentless%20Drift%20Detection%2c%20New%20UI%2c%20and%20Wider%20Linux%20Coverage/blog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage04-sandfly-hosts-distributions-report.pngblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage04-sandfly-hosts-distributions-reportblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage04-sandfly-hosts-distributions-reporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1707785897-drift-2.svg1707785897-drift-21707785897-drift-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784081543-5-8-update-thumbnail.png1784081543-5-8-update-thumbnail1784081543-5-8-update-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1707780810-drift.svg1707780810-drift1707780810-drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1708028560-possessed-photography-drmqiaubdws-unsplash-1.jpg1708028560-possessed-photography-drmqiaubdws-unsplash-11708028560-possessed-photography-drmqiaubdws-unsplash-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1707102313-drift-crontab.png1707102313-drift-crontab1707102313-drift-crontabhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1708028439-thomas-jensen-qtej-kmmq_q-unsplash.jpg1708028439-thomas-jensen-qtej-kmmq_q-unsplash1708028439-thomas-jensen-qtej-kmmq_q-unsplashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1707854048-result-profiles.png1707854048-result-profiles1707854048-result-profileshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.0%20-%20Agentless%20Drift%20Detection%2c%20New%20UI%2c%20and%20Wider%20Linux%20Coverage/blog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage06-result-profiles.pngblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage06-result-profilesblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage06-result-profileshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.0%20-%20Agentless%20Drift%20Detection%2c%20New%20UI%2c%20and%20Wider%20Linux%20Coverage/blog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage02-drift-crontab.pngblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage02-drift-crontabblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage02-drift-crontabhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.0%20-%20Agentless%20Drift%20Detection%2c%20New%20UI%2c%20and%20Wider%20Linux%20Coverage/blog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage03-thomas-jensen-qtej-kmmq_q-unsplash.jpgblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage03-thomas-jensen-qtej-kmmq_q-unsplashblog-imagessandfly-5-0-agentless-drift-detection-new-ui-and-wider-linux-coverage03-thomas-jensen-qtej-kmmq_q-unsplash2026-09-28https://sandflysecurity.com/blog/sandfly-featured-in-the-new-zealand-heraldhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-welcomes-symphony-cyber-as-a-partnerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1781475762-nato-locked-shields.png1781475762-nato-locked-shields1781475762-nato-locked-shieldshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1716848448-symphony-cyber-primary-1.png1716848448-symphony-cyber-primary-11716848448-symphony-cyber-primary-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1716848448-symphony-cyber-primary.png1716848448-symphony-cyber-primary1716848448-symphony-cyber-primary2026-09-28https://sandflysecurity.com/blog/linux-immutable-malware-process-binary-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736198702-video-thumb-linux-immutable-process-binary-attack.png1736198702-video-thumb-linux-immutable-process-binary-attack1736198702-video-thumb-linux-immutable-process-binary-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736976890-video-thumb-hidden-linux-binary-threats.png1736976890-video-thumb-hidden-linux-binary-threats1736976890-video-thumb-hidden-linux-binary-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734638383-video-thumb-linux-process-running-from-ram-disk-attack.png1734638383-video-thumb-linux-process-running-from-ram-disk-attack1734638383-video-thumb-linux-process-running-from-ram-disk-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/why-sandfly/case-studies/automotive-manufacturer-achieves-complete-linux-security-visibilityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/Manufacturer%20Achieves.jpegManufacturer AchievesManufacturer Achieveshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/using-linux-utmpdump-for-forensics-and-detecting-log-file-tamperinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216335-wtmp-dump-after-nulls.png1635216335-wtmp-dump-after-nulls1635216335-wtmp-dump-after-nullshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216323-wtmp-dump-after.png1635216323-wtmp-dump-after1635216323-wtmp-dump-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering06-wtmp-grep.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering06-wtmp-grepblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering06-wtmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering02-w-after.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering02-w-afterblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering02-w-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216370-btmp-after.png1635216370-btmp-after1635216370-btmp-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering09-btmp-after.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering09-btmp-afterblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering09-btmp-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering05-wtmp-dump-after-nulls.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering05-wtmp-dump-after-nullsblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering05-wtmp-dump-after-nullshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216387-wtmp-lastlog-missing.png1635216387-wtmp-lastlog-missing1635216387-wtmp-lastlog-missinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216380-wtmp-tamper.png1635216380-wtmp-tamper1635216380-wtmp-tamperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216347-wtmp-grep.png1635216347-wtmp-grep1635216347-wtmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering04-wtmp-dump-after.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering04-wtmp-dump-afterblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering04-wtmp-dump-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering01-w-before.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering01-w-beforeblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering01-w-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering03-wtmp-dump-before.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering03-wtmp-dump-beforeblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering03-wtmp-dump-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering07-utmp-grep.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering07-utmp-grepblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering07-utmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216355-utmp-grep.png1635216355-utmp-grep1635216355-utmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering08-btmp-grep.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering08-btmp-grepblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering08-btmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216300-w-after.png1635216300-w-after1635216300-w-afterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering11-wtmp-lastlog-missing.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering11-wtmp-lastlog-missingblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering11-wtmp-lastlog-missinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216362-btmp-grep.png1635216362-btmp-grep1635216362-btmp-grephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-w-before.png1635216293-w-before1635216293-w-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-wtmp-dump-before.png1635216311-wtmp-dump-before1635216311-wtmp-dump-beforehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20utmpdump%20for%20Forensics%20and%20Detecting%20Log%20File%20Tampering/blog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering10-wtmp-tamper.pngblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering10-wtmp-tamperblog-imagesusing-linux-utmpdump-for-forensics-and-detecting-log-file-tampering10-wtmp-tamper2026-09-28https://sandflysecurity.com/blog/sandfly-2-9-0-protect-five-linux-hosts-free-instantlyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more01-html-listener.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more01-html-listenerblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more01-html-listenerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216336-python-backdoor-apache.png1635216336-python-backdoor-apache1635216336-python-backdoor-apachehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more02-shell-www-username.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more02-shell-www-usernameblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more02-shell-www-usernamehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216344-tmp-system-binary-link.png1635216344-tmp-system-binary-link1635216344-tmp-system-binary-linkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216328-init-script-persistence.png1635216328-init-script-persistence1635216328-init-script-persistencehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216352-binary-process-creation-time-identical.png1635216352-binary-process-creation-time-identical1635216352-binary-process-creation-time-identicalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-html-listener.png1635216293-html-listener1635216293-html-listenerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more08-binary-process-creation-time-identical.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more08-binary-process-creation-time-identicalblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more08-binary-process-creation-time-identicalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-shell-www-username.png1635216301-shell-www-username1635216301-shell-www-usernamehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more06-python-backdoor-apache.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more06-python-backdoor-apacheblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more06-python-backdoor-apachehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more05-init-script-persistence.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more05-init-script-persistenceblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more05-init-script-persistencehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216320-antiforensics-system-wide.png1635216320-antiforensics-system-wide1635216320-antiforensics-system-widehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more07-tmp-system-binary-link.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more07-tmp-system-binary-linkblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more07-tmp-system-binary-linkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216312-kernel-thread-masquerade-1.png1635216312-kernel-thread-masquerade-11635216312-kernel-thread-masquerade-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more04-antiforensics-system-wide.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more04-antiforensics-system-wideblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more04-antiforensics-system-widehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.2%20%E2%80%93%20Enhanced%20Web%20Shell%20Detection%2c%20Anti-Forensics%20and%20More/blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more03-kernel-thread-masquerade-1.pngblog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more03-kernel-thread-masquerade-1blog-imagessandfly-2-2-enhanced-web-shell-detection-anti-forensics-and-more03-kernel-thread-masquerade-12026-09-28https://sandflysecurity.com/blog/detecting-packet-sniffing-malware-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Packet%20Sniffing%20Malware%20on%20Linux/blog-imagesdetecting-packet-sniffing-malware-on-linux01-proc-net-packet-raw.pngblog-imagesdetecting-packet-sniffing-malware-on-linux01-proc-net-packet-rawblog-imagesdetecting-packet-sniffing-malware-on-linux01-proc-net-packet-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750102852-list-packet-sniffers-output-annotated.png1750102852-list-packet-sniffers-output-annotated1750102852-list-packet-sniffers-output-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750102886-lsof-sniffer-annotated.png1750102886-lsof-sniffer-annotated1750102886-lsof-sniffer-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750103401-tron-lightcycle-race-over-packets.jpg1750103401-tron-lightcycle-race-over-packets1750103401-tron-lightcycle-race-over-packetshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750102704-proc-net-packet-raw.png1750102704-proc-net-packet-raw1750102704-proc-net-packet-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Packet%20Sniffing%20Malware%20on%20Linux/blog-imagesdetecting-packet-sniffing-malware-on-linux02-proc-net-packet-annotated.pngblog-imagesdetecting-packet-sniffing-malware-on-linux02-proc-net-packet-annotatedblog-imagesdetecting-packet-sniffing-malware-on-linux02-proc-net-packet-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750102772-proc-net-packet-annotated.png1750102772-proc-net-packet-annotated1750102772-proc-net-packet-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Packet%20Sniffing%20Malware%20on%20Linux/blog-imagesdetecting-packet-sniffing-malware-on-linux04-lsof-sniffer-annotated.pngblog-imagesdetecting-packet-sniffing-malware-on-linux04-lsof-sniffer-annotatedblog-imagesdetecting-packet-sniffing-malware-on-linux04-lsof-sniffer-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Packet%20Sniffing%20Malware%20on%20Linux/blog-imagesdetecting-packet-sniffing-malware-on-linux03-list-packet-sniffers-output-annotated.pngblog-imagesdetecting-packet-sniffing-malware-on-linux03-list-packet-sniffers-output-annotatedblog-imagesdetecting-packet-sniffing-malware-on-linux03-list-packet-sniffers-output-annotated2026-09-28https://sandflysecurity.com/blog/destination-linux-cybersecurity-interview-with-craig-rowlandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Destination-linux%20cybersecurity%20interview/Screenshot%202026-09-24%20at%2011.23.13%20AM.pngScreenshot 2026-09-24 at 11.23.13 AMScreenshot 2026-09-24 at 11.23.13 AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/partnershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1765314781-solution-brief-download-thumbnail.png1765314781-solution-brief-download-thumbnail1765314781-solution-brief-download-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1769712670-operation-and-tutorials-playlist.png1769712670-operation-and-tutorials-playlist1769712670-operation-and-tutorials-playlisthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1769713710-scanning-hosts-with-sandfly.png1769713710-scanning-hosts-with-sandfly1769713710-scanning-hosts-with-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-18https://sandflysecurity.com/blog/blog/compromised-linux-cheat-sheethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplicationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681862763-policy-user-password-auditor-custom.png1681862763-policy-user-password-auditor-custom1681862763-policy-user-password-auditor-customhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication07-sandfly-alert-details.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication07-sandfly-alert-detailsblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication07-sandfly-alert-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681862797-policy-user-password-auditor-custom-raw.png1681862797-policy-user-password-auditor-custom-raw1681862797-policy-user-password-auditor-custom-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681877536-sandfly-alert-details.png1681877536-sandfly-alert-details1681877536-sandfly-alert-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication06-policy-user-password-auditor-max_random_users.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication06-policy-user-password-auditor-max_random_usersblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication06-policy-user-password-auditor-max_random_usershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681937946-password-auditing-speed.png1681937946-password-auditing-speed1681937946-password-auditing-speedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-1.png1658984030-thumbnail-generic-11658984030-thumbnail-generic-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681876603-policy-user-password-auditor-top-100.png1681876603-policy-user-password-auditor-top-1001681876603-policy-user-password-auditor-top-100https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication03-policy-user-password-auditor-custom.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication03-policy-user-password-auditor-customblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication03-policy-user-password-auditor-customhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication02-policy-user-password-auditor-top-100.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication02-policy-user-password-auditor-top-100blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication02-policy-user-password-auditor-top-100https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681865512-policy-user-password-auditor-max_random_users.png1681865512-policy-user-password-auditor-max_random_users1681865512-policy-user-password-auditor-max_random_usershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication01-user-password-auditor-password-is-username.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication01-user-password-auditor-password-is-usernameblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication01-user-password-auditor-password-is-usernamehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1681861782-user-password-auditor-password-is-username.png1681861782-user-password-auditor-password-is-username1681861782-user-password-auditor-password-is-usernamehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication04-policy-user-password-auditor-custom-raw.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication04-policy-user-password-auditor-custom-rawblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication04-policy-user-password-auditor-custom-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.4.0%20-%20Agentless%20Linux%20Password%20Auditing%20and%20Data%20De-Duplication/blog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication05-password-auditing-speed.pngblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication05-password-auditing-speedblog-imagessandfly-4-4-0-agentless-linux-password-auditing-and-data-de-duplication05-password-auditing-speed2026-09-28https://sandflysecurity.com/blog/sandfly-2-8-0-agentless-active-attack-response-for-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux01-sandfly-response-options.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux01-sandfly-response-optionsblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux01-sandfly-response-optionshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216371-sandfly-user-history-immutable.png1635216371-sandfly-user-history-immutable1635216371-sandfly-user-history-immutablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216349-sandfly-host-page-1.png1635216349-sandfly-host-page-11635216349-sandfly-host-page-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-sandfly-response-options.png1635216293-sandfly-response-options1635216293-sandfly-response-optionshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216334-sandfly-policy-file-permissions-risk-etc-shadow.png1635216334-sandfly-policy-file-permissions-risk-etc-shadow1635216334-sandfly-policy-file-permissions-risk-etc-shadowhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux07-sandfly-policy-file-ssh-enabled-tcp-forwarding.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux07-sandfly-policy-file-ssh-enabled-tcp-forwardingblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux07-sandfly-policy-file-ssh-enabled-tcp-forwardinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux03-sandfly-custom-suspend.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux03-sandfly-custom-suspendblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux03-sandfly-custom-suspendhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux10-sandfly-ip-range-list.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux10-sandfly-ip-range-listblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux10-sandfly-ip-range-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216312-sandfly-custom-suspend.png1635216312-sandfly-custom-suspend1635216312-sandfly-custom-suspendhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216319-process-suspend-explanation.png1635216319-process-suspend-explanation1635216319-process-suspend-explanationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216342-sandfly-policy-file-ssh-enabled-tcp-forwarding.png1635216342-sandfly-policy-file-ssh-enabled-tcp-forwarding1635216342-sandfly-policy-file-ssh-enabled-tcp-forwardinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux09-sandfly-enhanced-host-information.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux09-sandfly-enhanced-host-informationblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux09-sandfly-enhanced-host-informationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216357-sandfly-enhanced-host-information.png1635216357-sandfly-enhanced-host-information1635216357-sandfly-enhanced-host-informationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux04-process-suspend-explanation.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux04-process-suspend-explanationblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux04-process-suspend-explanationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux02-sandfly-process-response.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux02-sandfly-process-responseblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux02-sandfly-process-responsehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux05-sandfly-policy-scans.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux05-sandfly-policy-scansblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux05-sandfly-policy-scanshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-sandfly-process-response.png1635216301-sandfly-process-response1635216301-sandfly-process-responsehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux11-sandfly-user-history-immutable.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux11-sandfly-user-history-immutableblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux11-sandfly-user-history-immutablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux08-sandfly-host-page-1.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux08-sandfly-host-page-1blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux08-sandfly-host-page-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216365-sandfly-ip-range-list.png1635216365-sandfly-ip-range-list1635216365-sandfly-ip-range-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216326-sandfly-policy-scans.png1635216326-sandfly-policy-scans1635216326-sandfly-policy-scanshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.8.0%20%E2%80%93%20Agentless%20Active%20Attack%20Response%20for%20Linux/blog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux06-sandfly-policy-file-permissions-risk-etc-shadow.pngblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux06-sandfly-policy-file-permissions-risk-etc-shadowblog-imagessandfly-2-8-0-agentless-active-attack-response-for-linux06-sandfly-policy-file-permissions-risk-etc-shadow2026-09-28https://sandflysecurity.com/why-sandfly/safetyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/basic-linux-malware-process-forensics-for-incident-respondershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782248168-scales-rootkit-thumbnail.png1782248168-scales-rootkit-thumbnail1782248168-scales-rootkit-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216341-tmp-environ-e1569879232953.png1635216341-tmp-environ-e15698792329531635216341-tmp-environ-e1569879232953https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216306-tmp-proc-listing-e1569879021288.png1635216306-tmp-proc-listing-e15698790212881635216306-tmp-proc-listing-e1569879021288https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216351-tmp-fd-open-e1569879336874.png1635216351-tmp-fd-open-e15698793368741635216351-tmp-fd-open-e1569879336874https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216359-tmp-maps-open-e1569879379129.png1635216359-tmp-maps-open-e15698793791291635216359-tmp-maps-open-e1569879379129https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216393-sandfly-deleted-tcp-port.png1635216393-sandfly-deleted-tcp-port1635216393-sandfly-deleted-tcp-porthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216386-sandfly-linux-malware-alerts.png1635216386-sandfly-linux-malware-alerts1635216386-sandfly-linux-malware-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216316-tmp-recover-binary-e1569879111162.png1635216316-tmp-recover-binary-e15698791111621635216316-tmp-recover-binary-e1569879111162https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216377-tmp-status-e1569879456982.png1635216377-tmp-status-e15698794569821635216377-tmp-status-e1569879456982https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-tmp-netstat-listing-e1569878955899.png1635216293-tmp-netstat-listing-e15698789558991635216293-tmp-netstat-listing-e1569878955899https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216368-tmp-stack-e1569879418643.png1635216368-tmp-stack-e15698794186431635216368-tmp-stack-e1569879418643https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216325-tmp-get-hashes-e1569879154574.png1635216325-tmp-get-hashes-e15698791545741635216325-tmp-get-hashes-e1569879154574https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216332-tmp-cmdline-e1569879191117.png1635216332-tmp-cmdline-e15698791911171635216332-tmp-cmdline-e15698791911172026-09-28https://sandflysecurity.com/blog/agentless-edr-and-linux-threats-sandfly-on-the-google-cloud-security-podcasthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755557779-cloud-security-podcast_high_res-original.png1755557779-cloud-security-podcast_high_res-original1755557779-cloud-security-podcast_high_res-originalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-5-0-6-maintenance-releasehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-2-0-released-write-your-own-sandflieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216313-dashboard-green-clock.png1635216313-dashboard-green-clock1635216313-dashboard-green-clockhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.0%20Released%20%E2%80%93%20Write%20Your%20Own%20Sandflies/blog-imagessandfly-2-0-released-write-your-own-sandflies04-sandfly-custom-process-hash.pngblog-imagessandfly-2-0-released-write-your-own-sandflies04-sandfly-custom-process-hashblog-imagessandfly-2-0-released-write-your-own-sandflies04-sandfly-custom-process-hashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-alarm-file-attributes-1.png1635216293-alarm-file-attributes-11635216293-alarm-file-attributes-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.0%20Released%20%E2%80%93%20Write%20Your%20Own%20Sandflies/blog-imagessandfly-2-0-released-write-your-own-sandflies03-dashboard-green-clock.pngblog-imagessandfly-2-0-released-write-your-own-sandflies03-dashboard-green-clockblog-imagessandfly-2-0-released-write-your-own-sandflies03-dashboard-green-clockhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.0%20Released%20%E2%80%93%20Write%20Your%20Own%20Sandflies/blog-imagessandfly-2-0-released-write-your-own-sandflies01-alarm-file-attributes-1.pngblog-imagessandfly-2-0-released-write-your-own-sandflies01-alarm-file-attributes-1blog-imagessandfly-2-0-released-write-your-own-sandflies01-alarm-file-attributes-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-alarm-malicious-cron.png1635216301-alarm-malicious-cron1635216301-alarm-malicious-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216320-sandfly-custom-process-hash.png1635216320-sandfly-custom-process-hash1635216320-sandfly-custom-process-hashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.0%20Released%20%E2%80%93%20Write%20Your%20Own%20Sandflies/blog-imagessandfly-2-0-released-write-your-own-sandflies02-alarm-malicious-cron.pngblog-imagessandfly-2-0-released-write-your-own-sandflies02-alarm-malicious-cronblog-imagessandfly-2-0-released-write-your-own-sandflies02-alarm-malicious-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/detecting-evasive-linux-backdoors-presentationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1698161932-first-cold-incident-response-presentation-1.jpg1698161932-first-cold-incident-response-presentation-11698161932-first-cold-incident-response-presentation-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/christchurch-hacker-con-linux-digital-forensics-videohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/hello-world-sandfly-1-1-is-now-availablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/sandfly-3-0-beta-live-nowhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881637-results-alerts-detail-sniffer-malicious-light-mode.png1635881637-results-alerts-detail-sniffer-malicious-light-mode1635881637-results-alerts-detail-sniffer-malicious-light-modehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881828-hunter-ssh-keys-alerts.png1635881828-hunter-ssh-keys-alerts1635881828-hunter-ssh-keys-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881693-dashboard-few-alerts.png1635881693-dashboard-few-alerts1635881693-dashboard-few-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635881571-jump-host-add.png1635881571-jump-host-add1635881571-jump-host-addhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/vodafone-selects-sandfly-security-for-the-xonehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1711252956-sandfly-gulatech-sorenson.png1711252956-sandfly-gulatech-sorenson1711252956-sandfly-gulatech-sorensonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1747098840-sysk-sandfly-696x464.webp1747098840-sysk-sandfly-696x4641747098840-sysk-sandfly-696x464https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-3-0-production-release-and-licensing-changeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensics2026-09-28https://sandflysecurity.com/blog/bpfdoor-detection-analysis-and-hunting-tactics-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186242-bpfdoorv2-host-ai-analysis.png1771186242-bpfdoorv2-host-ai-analysis1771186242-bpfdoorv2-host-ai-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185292-bpfdoorv1-process-environ-history-anti-forensics-raw-environ.png1771185292-bpfdoorv1-process-environ-history-anti-forensics-raw-environ1771185292-bpfdoorv1-process-environ-history-anti-forensics-raw-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182853-bpfdoorv1-deleted-binary.png1771182853-bpfdoorv1-deleted-binary1771182853-bpfdoorv1-deleted-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux10-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux10-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorsblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux10-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux17-bpfdoorv1-process-backdoor-bindshell-generic-4-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux17-bpfdoorv1-process-backdoor-bindshell-generic-4-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux17-bpfdoorv1-process-backdoor-bindshell-generic-4-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux22-bpfdoorv1-process-network-port-established-from-dev-dir-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux22-bpfdoorv1-process-network-port-established-from-dev-dir-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux22-bpfdoorv1-process-network-port-established-from-dev-dir-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux18-bpfdoorv1-bindshell-process-listing-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux18-bpfdoorv1-bindshell-process-listing-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux18-bpfdoorv1-bindshell-process-listing-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux19-bpfdoorv1-process-bindshell-sniffer-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux19-bpfdoorv1-process-bindshell-sniffer-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux19-bpfdoorv1-process-bindshell-sniffer-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux02-bpfdoorv1-alerts.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux02-bpfdoorv1-alertsblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux02-bpfdoorv1-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182781-bpfdoorv1-dev-shm-path.png1771182781-bpfdoorv1-dev-shm-path1771182781-bpfdoorv1-dev-shm-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184467-bpfdoorv2-process-running-sniffer_cmdline_overwrite.png1771184467-bpfdoorv2-process-running-sniffer_cmdline_overwrite1771184467-bpfdoorv2-process-running-sniffer_cmdline_overwritehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux05-bpfdoorv1-deleted-binary.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux05-bpfdoorv1-deleted-binaryblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux05-bpfdoorv1-deleted-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux11-bpfdoorv1-process-running-sniffer-operating-deleted-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux11-bpfdoorv1-process-running-sniffer-operating-deleted-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux11-bpfdoorv1-process-running-sniffer-operating-deleted-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185522-bpfdoorv1-process-network-port-established-from-dev-dir.png1771185522-bpfdoorv1-process-network-port-established-from-dev-dir1771185522-bpfdoorv1-process-network-port-established-from-dev-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185678-bpfdoorv1-process-running-sniffer-operating-ipv4-traffic.png1771185678-bpfdoorv1-process-running-sniffer-operating-ipv4-traffic1771185678-bpfdoorv1-process-running-sniffer-operating-ipv4-traffichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771183255-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic.png1771183255-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic1771183255-bpfdoorv2-process-running-sniffer_operating_ipv4_traffichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771183199-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors.png1771183199-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors1771183199-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184562-bpfdoorv1-backdoor-active-alerts.png1771184562-bpfdoorv1-backdoor-active-alerts1771184562-bpfdoorv1-backdoor-active-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux01-firewall-redirect-diagram.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux01-firewall-redirect-diagramblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux01-firewall-redirect-diagramhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186076-template-hash-match.png1771186076-template-hash-match1771186076-template-hash-matchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182927-bpfdoorv1-process-running-sniffer-environ-empty.png1771182927-bpfdoorv1-process-running-sniffer-environ-empty1771182927-bpfdoorv1-process-running-sniffer-environ-emptyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux14-bpfdoorv2-ps-listing-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux14-bpfdoorv2-ps-listing-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux14-bpfdoorv2-ps-listing-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184276-bpfdoorv2-process-stack-packet-sniffer.png1771184276-bpfdoorv2-process-stack-packet-sniffer1771184276-bpfdoorv2-process-stack-packet-snifferhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux29-process-match-hash-sha1-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux29-process-match-hash-sha1-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux29-process-match-hash-sha1-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652238177-firewall-redirect-diagram-1.png1652238177-firewall-redirect-diagram-11652238177-firewall-redirect-diagram-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux15-bpfdoorv2-process-running-sniffer_cmdline_overwrite-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux15-bpfdoorv2-process-running-sniffer_cmdline_overwrite-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux15-bpfdoorv2-process-running-sniffer_cmdline_overwrite-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184423-bpfdoorv2-ps-listing.png1771184423-bpfdoorv2-ps-listing1771184423-bpfdoorv2-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182666-bpfdoorv1-alerts.png1771182666-bpfdoorv1-alerts1771182666-bpfdoorv1-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux09-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux09-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorsblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux09-bpfdoorv1-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux26-bpfdoorv2-recon_process_list_sniffer_operating-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux26-bpfdoorv2-recon_process_list_sniffer_operating-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux26-bpfdoorv2-recon_process_list_sniffer_operating-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184747-bpfdoorv1-process-bindshell-sniffer.png1771184747-bpfdoorv1-process-bindshell-sniffer1771184747-bpfdoorv1-process-bindshell-snifferhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux27-bpfdoorv2-process-running-threat-feed-match-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux27-bpfdoorv2-process-running-threat-feed-match-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux27-bpfdoorv2-process-running-threat-feed-match-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux03-bpfdoorv2-alerts.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux03-bpfdoorv2-alertsblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux03-bpfdoorv2-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux25-bpfdoorv2-recon_process_list_all_drift-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux25-bpfdoorv2-recon_process_list_all_drift-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux25-bpfdoorv2-recon_process_list_all_drift-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186681-bpfdoor-detection-and-hunting-tactics.png1771186681-bpfdoor-detection-and-hunting-tactics1771186681-bpfdoor-detection-and-hunting-tacticshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux06-bpfdoorv1-process-running-sniffer-environ-empty.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux06-bpfdoorv1-process-running-sniffer-environ-emptyblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux06-bpfdoorv1-process-running-sniffer-environ-emptyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux13-bpfdoorv2-process-stack-packet-sniffer-raw-stack-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux13-bpfdoorv2-process-stack-packet-sniffer-raw-stack-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux13-bpfdoorv2-process-stack-packet-sniffer-raw-stack-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184331-bpfdoorv2-process-stack-packet-sniffer-raw-stack.png1771184331-bpfdoorv2-process-stack-packet-sniffer-raw-stack1771184331-bpfdoorv2-process-stack-packet-sniffer-raw-stackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux21-bpfdoorv1-process-environ-history-anti-forensics-raw-environ-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux21-bpfdoorv1-process-environ-history-anti-forensics-raw-environ-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux21-bpfdoorv1-process-environ-history-anti-forensics-raw-environ-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182982-bpfdoorv2-process-running-sniffer-environ-corrupt.png1771182982-bpfdoorv2-process-running-sniffer-environ-corrupt1771182982-bpfdoorv2-process-running-sniffer-environ-corrupthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186125-process-match-hash-sha1.png1771186125-process-match-hash-sha11771186125-process-match-hash-sha1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184686-bpfdoorv1-bindshell-process-listing.png1771184686-bpfdoorv1-bindshell-process-listing1771184686-bpfdoorv1-bindshell-process-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186001-bpfdoorv2-process-running-threat-feed-match.png1771186001-bpfdoorv2-process-running-threat-feed-match1771186001-bpfdoorv2-process-running-threat-feed-matchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185258-bpfdoorv1-process-environ-history-anti-forensics.png1771185258-bpfdoorv1-process-environ-history-anti-forensics1771185258-bpfdoorv1-process-environ-history-anti-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184213-bpfdoorv1-process-running-sniffer-operating-deleted.png1771184213-bpfdoorv1-process-running-sniffer-operating-deleted1771184213-bpfdoorv1-process-running-sniffer-operating-deletedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185765-bpfdoorv2-recon_process_list_all_drift.png1771185765-bpfdoorv2-recon_process_list_all_drift1771185765-bpfdoorv2-recon_process_list_all_drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185813-bpfdoorv2-recon_process_list_sniffer_operating.png1771185813-bpfdoorv2-recon_process_list_sniffer_operating1771185813-bpfdoorv2-recon_process_list_sniffer_operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux24-bpfdoorv1-process-running-sniffer-operating-ipv4-traffic-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux24-bpfdoorv1-process-running-sniffer-operating-ipv4-traffic-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux24-bpfdoorv1-process-running-sniffer-operating-ipv4-traffic-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771185562-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connections.png1771185562-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connections1771185562-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connectionshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1.png1752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-11752631992-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic-raw-file-descriptors-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux16-bpfdoorv1-backdoor-active-alerts-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux16-bpfdoorv1-backdoor-active-alerts-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux16-bpfdoorv1-backdoor-active-alerts-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1752623713-sandfly-5-5-ai-destroying-linux-malware.jpg1752623713-sandfly-5-5-ai-destroying-linux-malware1752623713-sandfly-5-5-ai-destroying-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771184649-bpfdoorv1-process-backdoor-bindshell-generic-4.png1771184649-bpfdoorv1-process-backdoor-bindshell-generic-41771184649-bpfdoorv1-process-backdoor-bindshell-generic-4https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux08-bpfdoorv2-process-running-sniffer_operating_ipv4_traffic.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux08-bpfdoorv2-process-running-sniffer_operating_ipv4_trafficblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux08-bpfdoorv2-process-running-sniffer_operating_ipv4_traffichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux23-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connections-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux23-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connections-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux23-bpfdoorv1-process-network-port-established-from-dev-dir-raw-connections-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771182702-bpfdoorv2-alerts.png1771182702-bpfdoorv2-alerts1771182702-bpfdoorv2-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux07-bpfdoorv2-process-running-sniffer-environ-corrupt.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux07-bpfdoorv2-process-running-sniffer-environ-corruptblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux07-bpfdoorv2-process-running-sniffer-environ-corrupthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux04-bpfdoorv1-dev-shm-path.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux04-bpfdoorv1-dev-shm-pathblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux04-bpfdoorv1-dev-shm-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux12-bpfdoorv2-process-stack-packet-sniffer-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux12-bpfdoorv2-process-stack-packet-sniffer-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux12-bpfdoorv2-process-stack-packet-sniffer-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux28-template-hash-match-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux28-template-hash-match-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux28-template-hash-match-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20Detection%2c%20Analysis%20and%20Hunting%20Tactics/blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux20-bpfdoorv1-process-environ-history-anti-forensics-1.pngblog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux20-bpfdoorv1-process-environ-history-anti-forensics-1blog-imagesbpfdoor-detection-analysis-and-hunting-tactics-on-linux20-bpfdoorv1-process-environ-history-anti-forensics-12026-09-28https://sandflysecurity.com/blog/linux-malware-persistence-with-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132576-cronrate-illegal-day-result.png1638132576-cronrate-illegal-day-result1638132576-cronrate-illegal-day-resulthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639426387-kinsing-malicious-process-sandfly-hunter.png1639426387-kinsing-malicious-process-sandfly-hunter1639426387-kinsing-malicious-process-sandfly-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/detecting-and-de-cloaking-hiddenwasp-linux-stealth-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216373-hidden-wasp-stealth-rootkit-detection-4.png1635216373-hidden-wasp-stealth-rootkit-detection-41635216373-hidden-wasp-stealth-rootkit-detection-4https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993564-process-decloak-backdoor-found.png1668993564-process-decloak-backdoor-found1668993564-process-decloak-backdoor-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216317-hidden-wasp-ldpreload-set.png1635216317-hidden-wasp-ldpreload-set1635216317-hidden-wasp-ldpreload-sethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216380-hidden-wasp-stealth-rootkit-detection-5.png1635216380-hidden-wasp-stealth-rootkit-detection-51635216380-hidden-wasp-stealth-rootkit-detection-5https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216355-hidden-wasp-stealth-rootkit-detection-2.png1635216355-hidden-wasp-stealth-rootkit-detection-21635216355-hidden-wasp-stealth-rootkit-detection-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216397-hidden-wasp-stealth-rootkit-detection-7.png1635216397-hidden-wasp-stealth-rootkit-detection-71635216397-hidden-wasp-stealth-rootkit-detection-7https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216364-hidden-wasp-stealth-rootkit-detection-3.png1635216364-hidden-wasp-stealth-rootkit-detection-31635216364-hidden-wasp-stealth-rootkit-detection-3https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216406-hidden-wasp-stealth-rootkit-detection-8.png1635216406-hidden-wasp-stealth-rootkit-detection-81635216406-hidden-wasp-stealth-rootkit-detection-8https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216338-hidden-wasp-decloaked-ports.png1635216338-hidden-wasp-decloaked-ports1635216338-hidden-wasp-decloaked-portshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750103401-tron-lightcycle-race-over-packets.jpg1750103401-tron-lightcycle-race-over-packets1750103401-tron-lightcycle-race-over-packetshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216347-hidden-wasp-stealth-rootkit-detection.png1635216347-hidden-wasp-stealth-rootkit-detection1635216347-hidden-wasp-stealth-rootkit-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216388-hidden-wasp-stealth-rootkit-detection-6.png1635216388-hidden-wasp-stealth-rootkit-detection-61635216388-hidden-wasp-stealth-rootkit-detection-6https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-hidden-wasp-no-suspicious-ports.png1635216307-hidden-wasp-no-suspicious-ports1635216307-hidden-wasp-no-suspicious-portshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/obsolete-linux-password-hash-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426305-thumbnail-reverse-shell-forensics.png1733426305-thumbnail-reverse-shell-forensics1733426305-thumbnail-reverse-shell-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734035759-video-thumb-ssh-excessive-keys-risk.png1734035759-video-thumb-ssh-excessive-keys-risk1734035759-video-thumb-ssh-excessive-keys-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1739473747-thumbnail-obsolete-linux-password-hash-threats.png1739473747-thumbnail-obsolete-linux-password-hash-threats1739473747-thumbnail-obsolete-linux-password-hash-threats2026-09-28https://sandflysecurity.com/blog/sandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%201.1.14%20%20Linux%20File%20Masquerading%2c%20Encrypted%20Malware%20Detection%2c%20and%20More/blog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more01-sandfly-file-masquerade.pngblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more01-sandfly-file-masqueradeblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more01-sandfly-file-masqueradehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-file-entropy-checks.png1635216301-file-entropy-checks1635216301-file-entropy-checkshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%201.1.14%20%20Linux%20File%20Masquerading%2c%20Encrypted%20Malware%20Detection%2c%20and%20More/blog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more04-hidden-executable-binary-checks.pngblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more04-hidden-executable-binary-checksblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more04-hidden-executable-binary-checkshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216319-hidden-executable-binary-checks.png1635216319-hidden-executable-binary-checks1635216319-hidden-executable-binary-checkshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216312-executable-binary-in-suspicious-areas-checks.png1635216312-executable-binary-in-suspicious-areas-checks1635216312-executable-binary-in-suspicious-areas-checkshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%201.1.14%20%20Linux%20File%20Masquerading%2c%20Encrypted%20Malware%20Detection%2c%20and%20More/blog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more03-executable-binary-in-suspicious-areas-checks.pngblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more03-executable-binary-in-suspicious-areas-checksblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more03-executable-binary-in-suspicious-areas-checkshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%201.1.14%20%20Linux%20File%20Masquerading%2c%20Encrypted%20Malware%20Detection%2c%20and%20More/blog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more02-file-entropy-checks.pngblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more02-file-entropy-checksblog-imagessandfly-1-1-14-linux-file-masquerading-encrypted-malware-detection-and-more02-file-entropy-checks2026-09-28https://sandflysecurity.com/blog/rob-joyce-interview-linux-critical-infrastructure-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728971541-thumbnail-rob-joyce-interview.png1728971541-thumbnail-rob-joyce-interview1728971541-thumbnail-rob-joyce-interviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking-1.png1728261226-thumbnail-root-kit-decloaking-11728261226-thumbnail-root-kit-decloaking-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/how-to-recover-a-deleted-binary-from-active-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782248168-scales-rootkit-thumbnail.png1782248168-scales-rootkit-thumbnail1782248168-scales-rootkit-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/linux-stealth-rootkit-hunting-presentationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759985895-linux-stealth-rootkit-hunting-title-screen-1.png1759985895-linux-stealth-rootkit-hunting-title-screen-11759985895-linux-stealth-rootkit-hunting-title-screen-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/linux-edr-detecting-processes-running-from-temporary-directory-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426426-thumbnail-duplicate-user-password-hash-attack-1.png1733426426-thumbnail-duplicate-user-password-hash-attack-11733426426-thumbnail-duplicate-user-password-hash-attack-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1735506237-linux-process-running-with-hidden-binary-name-attack.png1735506237-linux-process-running-with-hidden-binary-name-attack1735506237-linux-process-running-with-hidden-binary-name-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1735780360-video-thumb-linux-process-in-temp-directory-attack.png1735780360-video-thumb-linux-process-in-temp-directory-attack1735780360-video-thumb-linux-process-in-temp-directory-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/the-advantages-of-agentless-edr-for-linux-white-paperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1767737702-advantages-of-agentless-linux-edr-graphic-1.png1767737702-advantages-of-agentless-linux-edr-graphic-11767737702-advantages-of-agentless-linux-edr-graphic-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/detecting-bincrypter-linux-malware-obfuscationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation07-bincryptor-stack-network-accept.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation07-bincryptor-stack-network-acceptblog-imagesdetecting-bincrypter-linux-malware-obfuscation07-bincryptor-stack-network-accepthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation04-bincrypter-proc-listing.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation04-bincrypter-proc-listingblog-imagesdetecting-bincrypter-linux-malware-obfuscation04-bincrypter-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104988-bincrypter-lots-of-alerts.png1743104988-bincrypter-lots-of-alerts1743104988-bincrypter-lots-of-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation05-bincryptor-fd-file-elf-type.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation05-bincryptor-fd-file-elf-typeblog-imagesdetecting-bincrypter-linux-malware-obfuscation05-bincryptor-fd-file-elf-typehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104944-bincrypter-lsof.png1743104944-bincrypter-lsof1743104944-bincrypter-lsofhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation06-bincrypter-process-elf-file-descriptor.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation06-bincrypter-process-elf-file-descriptorblog-imagesdetecting-bincrypter-linux-malware-obfuscation06-bincrypter-process-elf-file-descriptorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104561-bincrypter-readme.png1743104561-bincrypter-readme1743104561-bincrypter-readmehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation10-bincrypter-lots-of-alerts.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation10-bincrypter-lots-of-alertsblog-imagesdetecting-bincrypter-linux-malware-obfuscation10-bincrypter-lots-of-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104910-bincryptor-stack-network-accept.png1743104910-bincryptor-stack-network-accept1743104910-bincryptor-stack-network-accepthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104802-bincryptor-fd-file-elf-type.png1743104802-bincryptor-fd-file-elf-type1743104802-bincryptor-fd-file-elf-typehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104842-bincrypter-process-elf-file-descriptor.png1743104842-bincrypter-process-elf-file-descriptor1743104842-bincrypter-process-elf-file-descriptorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104493-bincrypter-man.jpg1743104493-bincrypter-man1743104493-bincrypter-manhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743105145-bincrypter-process-injector-detection.png1743105145-bincrypter-process-injector-detection1743105145-bincrypter-process-injector-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104631-bincrypter-binaries-compressed-or-not.png1743104631-bincrypter-binaries-compressed-or-not1743104631-bincrypter-binaries-compressed-or-nothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104738-bincrypter-proc-listing.png1743104738-bincrypter-proc-listing1743104738-bincrypter-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743105057-bincrypter-sandfly-entropyscan-results.png1743105057-bincrypter-sandfly-entropyscan-results1743105057-bincrypter-sandfly-entropyscan-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation01-bincrypter-readme.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation01-bincrypter-readmeblog-imagesdetecting-bincrypter-linux-malware-obfuscation01-bincrypter-readmehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation02-bincrypter-binaries-compressed-or-not.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation02-bincrypter-binaries-compressed-or-notblog-imagesdetecting-bincrypter-linux-malware-obfuscation02-bincrypter-binaries-compressed-or-nothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation03-bincrypter-ps-listing.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation03-bincrypter-ps-listingblog-imagesdetecting-bincrypter-linux-malware-obfuscation03-bincrypter-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation09-bincrypter-sandfly-entropyscan-results.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation09-bincrypter-sandfly-entropyscan-resultsblog-imagesdetecting-bincrypter-linux-malware-obfuscation09-bincrypter-sandfly-entropyscan-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Bincrypter%20Linux%20Malware%20Obfuscation/blog-imagesdetecting-bincrypter-linux-malware-obfuscation08-bincrypter-lsof.pngblog-imagesdetecting-bincrypter-linux-malware-obfuscation08-bincrypter-lsofblog-imagesdetecting-bincrypter-linux-malware-obfuscation08-bincrypter-lsofhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104676-bincrypter-ps-listing.png1743104676-bincrypter-ps-listing1743104676-bincrypter-ps-listing2026-09-28https://sandflysecurity.com/blog/how-agentless-linux-edr-detects-rootkits-over-sshhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking.png1728261226-thumbnail-root-kit-decloaking1728261226-thumbnail-root-kit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993564-process-decloak-backdoor-found.png1668993564-process-decloak-backdoor-found1668993564-process-decloak-backdoor-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784253540-rootkit-tank.png1784253540-rootkit-tank1784253540-rootkit-tankhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750103401-tron-lightcycle-race-over-packets.jpg1750103401-tron-lightcycle-race-over-packets1750103401-tron-lightcycle-race-over-packets2026-09-28https://sandflysecurity.com/blog/sandfly-4-2-3-openssl-cve-2022-3602-and-cve-2022-3786-updatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784081543-5-8-update-thumbnail.png1784081543-5-8-update-thumbnail1784081543-5-8-update-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/partners/sorasechttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1771943522-sorasec_logotype_white_orange.png1771943522-sorasec_logotype_white_orange1771943522-sorasec_logotype_white_orangehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/detect-linux-loadable-kernel-module-stealth-rootkits-agentlessly-with-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-1-6-0-200-sandflieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216347-sandfly-process-running-from-hidden-run-dir.png1635216347-sandfly-process-running-from-hidden-run-dir1635216347-sandfly-process-running-from-hidden-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216386-sandfly-file-binary-masquerade-type-mismatch-in-run-dir.png1635216386-sandfly-file-binary-masquerade-type-mismatch-in-run-dir1635216386-sandfly-file-binary-masquerade-type-mismatch-in-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216318-sandfly-process-strace-ssh-keylogger-process-info.png1635216318-sandfly-process-strace-ssh-keylogger-process-info1635216318-sandfly-process-strace-ssh-keylogger-process-infohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216379-sandfly-file-binary-hidden-in-run-dir.png1635216379-sandfly-file-binary-hidden-in-run-dir1635216379-sandfly-file-binary-hidden-in-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216325-sandfly-process-masquerade-mixed-case.png1635216325-sandfly-process-masquerade-mixed-case1635216325-sandfly-process-masquerade-mixed-casehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-sandfly-process-masquerade-any.png1635216293-sandfly-process-masquerade-any1635216293-sandfly-process-masquerade-anyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216364-sandfly-file-process-suspicious-named-pipe-in-run-dir.png1635216364-sandfly-file-process-suspicious-named-pipe-in-run-dir1635216364-sandfly-file-process-suspicious-named-pipe-in-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216332-sandfly-file-binary-system-link-in-tmp-dir.png1635216332-sandfly-file-binary-system-link-in-tmp-dir1635216332-sandfly-file-binary-system-link-in-tmp-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216340-sandfly-file-binary-system-link-in-dev-dir.png1635216340-sandfly-file-binary-system-link-in-dev-dir1635216340-sandfly-file-binary-system-link-in-dev-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216356-sandfly-process-running-from-hidden-run-dir.png1635216356-sandfly-process-running-from-hidden-run-dir1635216356-sandfly-process-running-from-hidden-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216304-sandfly-process-strace-running.png1635216304-sandfly-process-strace-running1635216304-sandfly-process-strace-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-sandfly-process-strace-ssh-keylogger-explanation.png1635216311-sandfly-process-strace-ssh-keylogger-explanation1635216311-sandfly-process-strace-ssh-keylogger-explanationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216372-sandfly-file-binary-encrypted-in-run-dir.png1635216372-sandfly-file-binary-encrypted-in-run-dir1635216372-sandfly-file-binary-encrypted-in-run-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/why-sandfly/tactics-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-22https://sandflysecurity.com/blog/risky-business-news-podcast-why-linux-is-the-dark-matter-of-the-internethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb.png1733861103-risky-business-snake-oilers-sandfly-security-thumb1733861103-risky-business-snake-oilers-sandfly-security-thumb2026-09-28https://sandflysecurity.com/blog/agentless-incident-response-sandflies-and-more-stealth-rootkit-de-cloaking-sandfly-1-4-2-releasedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-stealth-rootkit-decloaking.png1635216307-stealth-rootkit-decloaking1635216307-stealth-rootkit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/sandfly-4-0-new-ssh-credential-and-key-auditinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658968851-sandfly-ebpf-rootkit.png1658968851-sandfly-ebpf-rootkit1658968851-sandfly-ebpf-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658965927-sandfly-result-view.png1658965927-sandfly-result-view1658965927-sandfly-result-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658966188-sandfly-restricted-schedule.png1658966188-sandfly-restricted-schedule1658966188-sandfly-restricted-schedulehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658882058-ssh-hunter-full-view.png1658882058-ssh-hunter-full-view1658882058-ssh-hunter-full-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693270806-password-auditor-1.png1693270806-password-auditor-11693270806-password-auditor-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658199331-dominique-knobben-fdfrayr_4is-unsplash.jpg1658199331-dominique-knobben-fdfrayr_4is-unsplash1658199331-dominique-knobben-fdfrayr_4is-unsplashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658966866-sandfly-binary-name.png1658966866-sandfly-binary-name1658966866-sandfly-binary-namehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/getting-in-the-fighthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216320-process-high-entropy.png1635216320-process-high-entropy1635216320-process-high-entropyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216314-script-3-craigrowland.png1635216314-script-3-craigrowland1635216314-script-3-craigrowlandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216328-binary-high-entropy.png1635216328-binary-high-entropy1635216328-binary-high-entropyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-script-badpackets.png1635216307-script-badpackets1635216307-script-badpacketshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216296-script-star-trek.png1635216296-script-star-trek1635216296-script-star-trek2026-09-28https://sandflysecurity.com/about-us/our-companyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1721600045-ron-head-closeup.png1721600045-ron-head-closeup1721600045-ron-head-closeuphttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1721600538-bx3i3039edit-edited.png1721600538-bx3i3039edit-edited1721600538-bx3i3039edit-editedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1721600795-chris-jagger.jpeg1721600795-chris-jagger1721600795-chris-jaggerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1747699470-craig-rowland-headshot.jpg1747699470-craig-rowland-headshot1747699470-craig-rowland-headshothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1721601168-robjoyce_1658_2.jpg1721601168-robjoyce_1658_21721601168-robjoyce_1658_22026-09-18https://sandflysecurity.com/blog/linux-scales-ebpf-rootkit-detection-and-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis19-sudo-credential-stealer-shell-script.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis19-sudo-credential-stealer-shell-scriptblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis19-sudo-credential-stealer-shell-scripthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782248168-scales-rootkit-thumbnail.png1782248168-scales-rootkit-thumbnail1782248168-scales-rootkit-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis21-recon-systemd-service-drift-forensic-details.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis21-recon-systemd-service-drift-forensic-detailsblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis21-recon-systemd-service-drift-forensic-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis02-process-hidden-stealth-list.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis02-process-hidden-stealth-listblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis02-process-hidden-stealth-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261087-hidden-bin-sudo-under-root.png1782261087-hidden-bin-sudo-under-root1782261087-hidden-bin-sudo-under-roothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis14-bpftool-map-show.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis14-bpftool-map-showblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis14-bpftool-map-showhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis08-cd-proc-764-ls-listing.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis08-cd-proc-764-ls-listingblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis08-cd-proc-764-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782263374-ss-tupna-listing-no-process-owns-network-port-edited.png1782263374-ss-tupna-listing-no-process-owns-network-port-edited1782263374-ss-tupna-listing-no-process-owns-network-port-editedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782255706-cd-proc-764-ls-listing.png1782255706-cd-proc-764-ls-listing1782255706-cd-proc-764-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261234-sudo-credential-stealer-shell-script.png1782261234-sudo-credential-stealer-shell-script1782261234-sudo-credential-stealer-shell-scripthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782258295-cd-fd-ls-listing-lots-of-bpf.png1782258295-cd-fd-ls-listing-lots-of-bpf1782258295-cd-fd-ls-listing-lots-of-bpfhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782259105-bpftool-map-show.png1782259105-bpftool-map-show1782259105-bpftool-map-showhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782254898-ps-no-pid-764.png1782254898-ps-no-pid-7641782254898-ps-no-pid-764https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis06-proc-listing-no-pid-764.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis06-proc-listing-no-pid-764blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis06-proc-listing-no-pid-764https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782254571-rootkit-process-hidden-stealth.png1782254571-rootkit-process-hidden-stealth1782254571-rootkit-process-hidden-stealthhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261774-rootkit-systemd-service-file.png1782261774-rootkit-systemd-service-file1782261774-rootkit-systemd-service-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782258928-bpftool-link-show.png1782258928-bpftool-link-show1782258928-bpftool-link-showhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis20-recon-systemd-service-drift-listing.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis20-recon-systemd-service-drift-listingblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis20-recon-systemd-service-drift-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782266380-rootkit-process-forensic-data.png1782266380-rootkit-process-forensic-data1782266380-rootkit-process-forensic-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261712-rootkit-persistence-systemd.png1782261712-rootkit-persistence-systemd1782261712-rootkit-persistence-systemdhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis09-sandfly-respond-grab-process-binary.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis09-sandfly-respond-grab-process-binaryblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis09-sandfly-respond-grab-process-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis18-hidden-bin-sudo-under-root.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis18-hidden-bin-sudo-under-rootblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis18-hidden-bin-sudo-under-roothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis05-ps-no-pid-764.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis05-ps-no-pid-764blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis05-ps-no-pid-764https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782259516-bpftool-prog-show-2.png1782259516-bpftool-prog-show-21782259516-bpftool-prog-show-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782255266-stat-proc-764-shows-dir-present-though.png1782255266-stat-proc-764-shows-dir-present-though1782255266-stat-proc-764-shows-dir-present-thoughhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782256667-sandfly-respond-grab-process-binary.png1782256667-sandfly-respond-grab-process-binary1782256667-sandfly-respond-grab-process-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis01-scales-rootkit-all-alerts.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis01-scales-rootkit-all-alertsblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis01-scales-rootkit-all-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis22-rootkit-persistence-systemd.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis22-rootkit-persistence-systemdblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis22-rootkit-persistence-systemdhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782255895-recover-bin-sha256sum.png1782255895-recover-bin-sha256sum1782255895-recover-bin-sha256sumhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782254426-process-hidden-stealth-list.png1782254426-process-hidden-stealth-list1782254426-process-hidden-stealth-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis13-bpftool-link-show.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis13-bpftool-link-showblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis13-bpftool-link-showhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis23-rootkit-systemd-service-file.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis23-rootkit-systemd-service-fileblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis23-rootkit-systemd-service-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis07-stat-proc-764-shows-dir-present-though.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis07-stat-proc-764-shows-dir-present-thoughblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis07-stat-proc-764-shows-dir-present-thoughhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261497-recon-systemd-service-drift-listing.png1782261497-recon-systemd-service-drift-listing1782261497-recon-systemd-service-drift-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis12-cd-fd-ls-listing-lots-of-bpf.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis12-cd-fd-ls-listing-lots-of-bpfblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis12-cd-fd-ls-listing-lots-of-bpfhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782253959-scales-rootkit-all-alerts.png1782253959-scales-rootkit-all-alerts1782253959-scales-rootkit-all-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis04-rootkit-process-forensic-data.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis04-rootkit-process-forensic-datablog-imageslinux-scales-ebpf-rootkit-detection-and-analysis04-rootkit-process-forensic-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis10-recover-bin-sha256sum.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis10-recover-bin-sha256sumblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis10-recover-bin-sha256sumhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis11-ss-tupna-listing-no-process-owns-network-port-edited.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis11-ss-tupna-listing-no-process-owns-network-port-editedblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis11-ss-tupna-listing-no-process-owns-network-port-editedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis03-rootkit-process-hidden-stealth.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis03-rootkit-process-hidden-stealthblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis03-rootkit-process-hidden-stealthhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261054-usr-bin-local-hidden-details.png1782261054-usr-bin-local-hidden-details1782261054-usr-bin-local-hidden-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis16-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodes.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis16-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodesblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis16-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis17-usr-bin-local-hidden-details.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis17-usr-bin-local-hidden-detailsblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis17-usr-bin-local-hidden-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782255454-proc-listing-no-pid-764.png1782255454-proc-listing-no-pid-7641782255454-proc-listing-no-pid-764https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782260030-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodes.png1782260030-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodes1782260030-cd-sys-fs-bpf-cat-hidden_pids-hidden_names-hidden_inodeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782261579-recon-systemd-service-drift-forensic-details.png1782261579-recon-systemd-service-drift-forensic-details1782261579-recon-systemd-service-drift-forensic-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Scales%20eBPF%20Rootkit%20Detection%20and%20Analysis%20Atomic%20Arch/blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis15-bpftool-prog-show-2.pngblog-imageslinux-scales-ebpf-rootkit-detection-and-analysis15-bpftool-prog-show-2blog-imageslinux-scales-ebpf-rootkit-detection-and-analysis15-bpftool-prog-show-22026-09-28https://sandflysecurity.com/blog/sandfly-2-3-performance-updates-elasticsearch-7-support-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635878907-sandfly-detection-mass-scanning-example.png1635878907-sandfly-detection-mass-scanning-example1635878907-sandfly-detection-mass-scanning-examplehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216294-sandfly-new-json-format.png1635216294-sandfly-new-json-format1635216294-sandfly-new-json-formathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/sandfly-5-5-4-north-korean-rootkit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759091899-nk-open-to-work-circle-transparent.png1759091899-nk-open-to-work-circle-transparent1759091899-nk-open-to-work-circle-transparenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759092195-rootkit-kernel-module-vmalloc-artifact.png1759092195-rootkit-kernel-module-vmalloc-artifact1759092195-rootkit-kernel-module-vmalloc-artifacthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759092377-rootkit-alerts.png1759092377-rootkit-alerts1759092377-rootkit-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1707780810-drift.svg1707780810-drift1707780810-drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5.4%20-%20Chinese-North%20Korean%20Rootkit%20Decloaking/blog-imagessandfly-5-5-4-north-korean-rootkit-decloaking02-rootkit-alerts.pngblog-imagessandfly-5-5-4-north-korean-rootkit-decloaking02-rootkit-alertsblog-imagessandfly-5-5-4-north-korean-rootkit-decloaking02-rootkit-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.5.4%20-%20Chinese-North%20Korean%20Rootkit%20Decloaking/blog-imagessandfly-5-5-4-north-korean-rootkit-decloaking01-rootkit-kernel-module-vmalloc-artifact.pngblog-imagessandfly-5-5-4-north-korean-rootkit-decloaking01-rootkit-kernel-module-vmalloc-artifactblog-imagessandfly-5-5-4-north-korean-rootkit-decloaking01-rootkit-kernel-module-vmalloc-artifact2026-09-28https://sandflysecurity.com/blog/blog/ssh-authorized-keys2-backdoor-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733937033-video-thumb-ssh-authorized-keys2-backdoor-attack.png1733937033-video-thumb-ssh-authorized-keys2-backdoor-attack1733937033-video-thumb-ssh-authorized-keys2-backdoor-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/why-sandfly/case-studies/the-university-of-massachusetts-lowellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/agentless-intrusion-detection.jpgagentless-intrusion-detectionagentless-intrusion-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/umass-lowell.jpgumass-lowellumass-lowellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/visible-across-all-linux.jpgvisible-across-all-linuxvisible-across-all-linux2026-09-18https://sandflysecurity.com/blog/ninjas-on-rooftops-a-better-approach-to-linux-threathuntinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759985895-linux-stealth-rootkit-hunting-title-screen-1.png1759985895-linux-stealth-rootkit-hunting-title-screen-11759985895-linux-stealth-rootkit-hunting-title-screen-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/investigating-linux-process-file-descriptors-for-incident-response-and-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216300-suspicious-fd-proc-listing.png1635216300-suspicious-fd-proc-listing1635216300-suspicious-fd-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOGInvestigating%20Linux%20Process%20File%20Descriptors%20for%20Incident%20Response%20and%20Forensics/blog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics01-suspicious-fd-ps-listing.pngblog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics01-suspicious-fd-ps-listingblog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics01-suspicious-fd-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOGInvestigating%20Linux%20Process%20File%20Descriptors%20for%20Incident%20Response%20and%20Forensics/blog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics02-suspicious-fd-proc-listing.pngblog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics02-suspicious-fd-proc-listingblog-imagesinvestigating-linux-process-file-descriptors-for-incident-response-and-forensics02-suspicious-fd-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-suspicious-fd-ps-listing.png1635216293-suspicious-fd-ps-listing1635216293-suspicious-fd-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-suspicious-fd-proc-cat-file.png1635216311-suspicious-fd-proc-cat-file1635216311-suspicious-fd-proc-cat-filehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-secures-vay-s-remotely-driven-vehicle-fleethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1747918816-11_teledrive_station_1.jpg1747918816-11_teledrive_station_11747918816-11_teledrive_station_1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-3-3-reporting-sso-veracode-certified-suspicious-ip-detection-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031359-veracode_verified.png1651031359-veracode_verified1651031359-veracode_verifiedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651097279-unconventional-ip-cron.png1651097279-unconventional-ip-cron1651097279-unconventional-ip-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651097808-ssh-private-key-in-home-dir.png1651097808-ssh-private-key-in-home-dir1651097808-ssh-private-key-in-home-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031574-report-host-view-1.png1651031574-report-host-view-11651031574-report-host-view-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031574-report-host-view.png1651031574-report-host-view1651031574-report-host-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031636-reports-scans-hourly-performance.png1651031636-reports-scans-hourly-performance1651031636-reports-scans-hourly-performancehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031709-data-retention-days.png1651031709-data-retention-days1651031709-data-retention-dayshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031183-sso-configuration.png1651031183-sso-configuration1651031183-sso-configurationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031732-postgres-replication.png1651031732-postgres-replication1651031732-postgres-replicationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651031220-sso-new-user.png1651031220-sso-new-user1651031220-sso-new-userhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651095871-multi-architecture.png1651095871-multi-architecture1651095871-multi-architecturehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651097294-unconventional-ip-cron-json.png1651097294-unconventional-ip-cron-json1651097294-unconventional-ip-cron-jsonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/the-advantages-of-agentless-security-and-intrusion-detection-for-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/linux-stealth-rootkit-malware-with-edr-evasion-analyzedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272731-incident-etc-ld-so-preload-non-empty-data.png1637272731-incident-etc-ld-so-preload-non-empty-data1637272731-incident-etc-ld-so-preload-non-empty-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272296-incident-process-bioset-open-suspicious-file-descriptors-raw-data.png1637272296-incident-process-bioset-open-suspicious-file-descriptors-raw-data1637272296-incident-process-bioset-open-suspicious-file-descriptors-raw-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637275670-incident-immutable-file-lib-dir.png1637275670-incident-immutable-file-lib-dir1637275670-incident-immutable-file-lib-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637275799-incident-immutable-file-lib-dir-details.png1637275799-incident-immutable-file-lib-dir-details1637275799-incident-immutable-file-lib-dir-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637280137-incident-usr-bin-bioset-copy-failed-sfirt-bioset-copy-success-redacted.png1637280137-incident-usr-bin-bioset-copy-failed-sfirt-bioset-copy-success-redacted1637280137-incident-usr-bin-bioset-copy-failed-sfirt-bioset-copy-success-redactedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272614-inciden-etc-ld-so-preload-immutable.png1637272614-inciden-etc-ld-so-preload-immutable1637272614-inciden-etc-ld-so-preload-immutablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637270231-incident-virustotal-unknown-malware.png1637270231-incident-virustotal-unknown-malware1637270231-incident-virustotal-unknown-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637270429-incident-host-results.png1637270429-incident-host-results1637270429-incident-host-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637270429-incident-host-results-1.png1637270429-incident-host-results-11637270429-incident-host-results-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637273028-incident-process-bioset-immutable.png1637273028-incident-process-bioset-immutable1637273028-incident-process-bioset-immutablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272906-incident-high-entropy-process-kthreadd.png1637272906-incident-high-entropy-process-kthreadd1637272906-incident-high-entropy-process-kthreaddhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639426387-kinsing-malicious-process-sandfly-hunter.png1639426387-kinsing-malicious-process-sandfly-hunter1639426387-kinsing-malicious-process-sandfly-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637280263-incident-file-ldsopreload-copy-and-read-redacted.png1637280263-incident-file-ldsopreload-copy-and-read-redacted1637280263-incident-file-ldsopreload-copy-and-read-redactedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272667-incident-etc-ld-so-preload-non-empty.png1637272667-incident-etc-ld-so-preload-non-empty1637272667-incident-etc-ld-so-preload-non-emptyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637272034-incident-process-bioset-open-suspicious-file-descriptors.png1637272034-incident-process-bioset-open-suspicious-file-descriptors1637272034-incident-process-bioset-open-suspicious-file-descriptors2026-09-28https://sandflysecurity.com/blog/free-sandfly-linux-incident-response-licensehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750103401-tron-lightcycle-race-over-packets.jpg1750103401-tron-lightcycle-race-over-packets1750103401-tron-lightcycle-race-over-packetshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-2.png1712190688-thumbnail-generic-21712190688-thumbnail-generic-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/leveling-up-your-linux-securityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host.png1643243329-results-by-host1643243329-results-by-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1775695829-5-linux-security-blind-spots-webinar_fb-li.jpg1775695829-5-linux-security-blind-spots-webinar_fb-li1775695829-5-linux-security-blind-spots-webinar_fb-lihttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706773-packet-breaking-through-wall.jpg1750706773-packet-breaking-through-wall1750706773-packet-breaking-through-wall2026-09-28https://sandflysecurity.com/blog/why-you-must-monitor-linux-for-signs-of-intrudershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-3-1-releasedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784081543-5-8-update-thumbnail.png1784081543-5-8-update-thumbnail1784081543-5-8-update-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1657853403-screen-shot-2022-07-15-at-2-46-12-pm.png1657853403-screen-shot-2022-07-15-at-2-46-12-pm1657853403-screen-shot-2022-07-15-at-2-46-12-pmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1640032351-sandfly-3-1-host-detail-view.png1640032351-sandfly-3-1-host-detail-view1640032351-sandfly-3-1-host-detail-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639686058-elasticsearch-replication-url.png1639686058-elasticsearch-replication-url1639686058-elasticsearch-replication-urlhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1640103473-sandfly-3-1-ssh-key-hunter.png1640103473-sandfly-3-1-ssh-key-hunter1640103473-sandfly-3-1-ssh-key-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1640035275-sandfly-3-1-graylog-result-list.png1640035275-sandfly-3-1-graylog-result-list1640035275-sandfly-3-1-graylog-result-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1640032339-sandfly-3-1-host-view.png1640032339-sandfly-3-1-host-view1640032339-sandfly-3-1-host-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/sandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20v/BLOG%20Sandfly%204.3.2%20-%20Linux%20Loadable%20Kernel%20Module%20Rootkit%20Taint%20Detection/blog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection02-kernel-taint-inconsistency.pngblog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection02-kernel-taint-inconsistencyblog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection02-kernel-taint-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693270806-password-auditor-1.png1693270806-password-auditor-11693270806-password-auditor-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679361873-kernel_module_tainted_not_in_kernel.png1679361873-kernel_module_tainted_not_in_kernel1679361873-kernel_module_tainted_not_in_kernelhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20v/BLOG%20Sandfly%204.3.2%20-%20Linux%20Loadable%20Kernel%20Module%20Rootkit%20Taint%20Detection/blog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection01-kernel_module_tainted_unsigned.pngblog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection01-kernel_module_tainted_unsignedblog-imagessandfly-4-3-2-linux-loadable-kernel-module-rootkit-taint-detection01-kernel_module_tainted_unsignedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679361993-kernel_module_unexpected.png1679361993-kernel_module_unexpected1679361993-kernel_module_unexpectedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679431079-memfd_create-elf-hidden.png1679431079-memfd_create-elf-hidden1679431079-memfd_create-elf-hiddenhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679362954-host-key-verification-individual.png1679362954-host-key-verification-individual1679362954-host-key-verification-individualhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679361529-kernel_module_tainted_unsigned.png1679361529-kernel_module_tainted_unsigned1679361529-kernel_module_tainted_unsignedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679361728-kernel-taint-inconsistency.png1679361728-kernel-taint-inconsistency1679361728-kernel-taint-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679430629-process_kernel_rootkit_lkm_vmallocinfo.png1679430629-process_kernel_rootkit_lkm_vmallocinfo1679430629-process_kernel_rootkit_lkm_vmallocinfohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1679362382-host-load.png1679362382-host-load1679362382-host-load2026-09-28https://sandflysecurity.com/blog/sandfly-security-is-not-vulnerable-to-log4j-exploithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733425718-thumbnail-obsolete-password-hashes.png1733425718-thumbnail-obsolete-password-hashes1733425718-thumbnail-obsolete-password-hasheshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1778042103-copy-fail-image.png1778042103-copy-fail-image1778042103-copy-fail-image2026-09-28https://sandflysecurity.com/blog/ericsson-partners-with-sandfly-to-strengthen-telecom-securityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1772142934-sandfly-ericsson-1200-x-675-social.png1772142934-sandfly-ericsson-1200-x-675-social1772142934-sandfly-ericsson-1200-x-675-socialhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784863456-typhoon-image-cropped.png1784863456-typhoon-image-cropped1784863456-typhoon-image-croppedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/linux-nologin-shell-rename-backdoor-attack-detection-and-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733425718-thumbnail-obsolete-password-hashes.png1733425718-thumbnail-obsolete-password-hashes1733425718-thumbnail-obsolete-password-hasheshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426336-thumbnail-no-login-shell-rename-attacks.png1733426336-thumbnail-no-login-shell-rename-attacks1733426336-thumbnail-no-login-shell-rename-attackshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426382-thumbnail-default-user-password-attack.png1733426382-thumbnail-default-user-password-attack1733426382-thumbnail-default-user-password-attack2026-09-28https://sandflysecurity.com/blog/ssh-key-compromise-risks-and-countermeasureshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/bloghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736465756-video-thumb-immutable-file-attack-persistence-on-linux.png1736465756-video-thumb-immutable-file-attack-persistence-on-linux1736465756-video-thumb-immutable-file-attack-persistence-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1781288662-linux-malware-simple-to-sophisticated.png1781288662-linux-malware-simple-to-sophisticated1781288662-linux-malware-simple-to-sophisticatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Destination-linux%20cybersecurity%20interview/Screenshot%202026-09-24%20at%2011.23.13%20AM.pngScreenshot 2026-09-24 at 11.23.13 AMScreenshot 2026-09-24 at 11.23.13 AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Destination-linux%20cybersecurity%20interview/Screenshot%202026-09-24%20at%2011.33.02%20AM.pngScreenshot 2026-09-24 at 11.33.02 AMScreenshot 2026-09-24 at 11.33.02 AM2026-09-28https://sandflysecurity.com/blog/sandfly-2-5-2-scheduling-priority-detecting-command-line-web-servers-port-scanners-and-kernel-thread-masqueradinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216296-scheduler-add.png1635216296-scheduler-add1635216296-scheduler-addhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216355-ad-hoc-rest-api.png1635216355-ad-hoc-rest-api1635216355-ad-hoc-rest-apihttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216338-linux-kernel-thread-masqureade-attack.png1635216338-linux-kernel-thread-masqureade-attack1635216338-linux-kernel-thread-masqureade-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216347-malicious-network-sniffer.png1635216347-malicious-network-sniffer1635216347-malicious-network-snifferhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216321-command-line-python-webserver-intrusion-detection.png1635216321-command-line-python-webserver-intrusion-detection1635216321-command-line-python-webserver-intrusion-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216330-masscan-running.png1635216330-masscan-running1635216330-masscan-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-python-command-line-web-server.png1635216307-python-command-line-web-server1635216307-python-command-line-web-serverhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216314-command-line-web-server-listing.png1635216314-command-line-web-server-listing1635216314-command-line-web-server-listing2026-09-28https://sandflysecurity.com/blog/linux-stealth-rootkit-process-decloaking-tool-updatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1782248168-scales-rootkit-thumbnail.png1782248168-scales-rootkit-thumbnail1782248168-scales-rootkit-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993564-process-decloak-backdoor-found-1.png1668993564-process-decloak-backdoor-found-11668993564-process-decloak-backdoor-found-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Stealth%20Rootkit%20Process%20Decloaking%20Tool%20Updated/blog-imageslinux-stealth-rootkit-process-decloaking-tool-updated02-process-decloak-backdoor-found.pngblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated02-process-decloak-backdoor-foundblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated02-process-decloak-backdoor-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668994524-sandfly-decloaked-linux-rootkit.png1668994524-sandfly-decloaked-linux-rootkit1668994524-sandfly-decloaked-linux-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993564-process-decloak-backdoor-found.png1668993564-process-decloak-backdoor-found1668993564-process-decloak-backdoor-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Stealth%20Rootkit%20Process%20Decloaking%20Tool%20Updated/blog-imageslinux-stealth-rootkit-process-decloaking-tool-updated03-sandfly-decloaked-linux-rootkit.pngblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated03-sandfly-decloaked-linux-rootkitblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated03-sandfly-decloaked-linux-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993842-process-decloak-ps-listing-no-pid.png1668993842-process-decloak-ps-listing-no-pid1668993842-process-decloak-ps-listing-no-pidhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Stealth%20Rootkit%20Process%20Decloaking%20Tool%20Updated/blog-imageslinux-stealth-rootkit-process-decloaking-tool-updated01-process-decloak-ps-listing-no-pid.pngblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated01-process-decloak-ps-listing-no-pidblog-imageslinux-stealth-rootkit-process-decloaking-tool-updated01-process-decloak-ps-listing-no-pid2026-09-28https://sandflysecurity.com/resources/white-papershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1722202725-sandfly-safety-and-performance.webp1722202725-sandfly-safety-and-performance1722202725-sandfly-safety-and-performancehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1747386667-how-to-make-a-strong-password.webp1747386667-how-to-make-a-strong-password1747386667-how-to-make-a-strong-passwordhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1752633767-bpfdoor-detection-analysis-sandfly-security.webp1752633767-bpfdoor-detection-analysis-sandfly-security1752633767-bpfdoor-detection-analysis-sandfly-securityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1740965547-linux-password-hash-risks.webp1740965547-linux-password-hash-risks1740965547-linux-password-hash-riskshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1731874060-sandfly-data-privacy-whitepaper.webp1731874060-sandfly-data-privacy-whitepaper1731874060-sandfly-data-privacy-whitepaperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1724629312-sandfly-agentless-linux-password-auditing.webp1724629312-sandfly-agentless-linux-password-auditing1724629312-sandfly-agentless-linux-password-auditinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1739491176-sandfly-ssh-key-security-whitepaper.webp1739491176-sandfly-ssh-key-security-whitepaper1739491176-sandfly-ssh-key-security-whitepaperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1767735316-sandfly-advantages-of-agentless-linux-edr.webp1767735316-sandfly-advantages-of-agentless-linux-edr1767735316-sandfly-advantages-of-agentless-linux-edr2026-09-18https://sandflysecurity.com/blog/agentless-password-auditing-for-linux-white-paperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426305-thumbnail-reverse-shell-forensics.png1733426305-thumbnail-reverse-shell-forensics1733426305-thumbnail-reverse-shell-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734035759-video-thumb-ssh-excessive-keys-risk.png1734035759-video-thumb-ssh-excessive-keys-risk1734035759-video-thumb-ssh-excessive-keys-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1724628338-thumbnail-password-auditing.png1724628338-thumbnail-password-auditing1724628338-thumbnail-password-auditing2026-09-28https://sandflysecurity.com/blog/sandfly-now-available-on-microsoft-azure-marketplacehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759198700-azure-twitter-post-2x-1.png1759198700-azure-twitter-post-2x-11759198700-azure-twitter-post-2x-12026-09-28https://sandflysecurity.com/blog/sandfly-2-8-2-over-1000-linux-compromise-detection-modules-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-sandfly-md5-obsolete-password-hash.png1635216307-sandfly-md5-obsolete-password-hash1635216307-sandfly-md5-obsolete-password-hashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216390-sandfly-file-archive-date-created-less-than-1-hour.png1635216390-sandfly-file-archive-date-created-less-than-1-hour1635216390-sandfly-file-archive-date-created-less-than-1-hourhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216398-sandfly-file-binary-date-created-less-than-4-hours.png1635216398-sandfly-file-binary-date-created-less-than-4-hours1635216398-sandfly-file-binary-date-created-less-than-4-hourshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216352-ssh-banned-key-search.png1635216352-ssh-banned-key-search1635216352-ssh-banned-key-searchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216296-sandfly-user-password-days-since-last-changed-less-than-7-days.png1635216296-sandfly-user-password-days-since-last-changed-less-than-7-days1635216296-sandfly-user-password-days-since-last-changed-less-than-7-dayshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216359-sandfly-process-running-hacking-tool-recon.png1635216359-sandfly-process-running-hacking-tool-recon1635216359-sandfly-process-running-hacking-tool-reconhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216375-sandfly-process-backdoor-bindshell-reverse-openssl-1.png1635216375-sandfly-process-backdoor-bindshell-reverse-openssl-11635216375-sandfly-process-backdoor-bindshell-reverse-openssl-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216382-sandfl-user-history-anti-forensics.png1635216382-sandfl-user-history-anti-forensics1635216382-sandfl-user-history-anti-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216337-sandfly-policy-user-ssh-authorized-keys-duplicates-found.png1635216337-sandfly-policy-user-ssh-authorized-keys-duplicates-found1635216337-sandfly-policy-user-ssh-authorized-keys-duplicates-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216366-sandfly-file-artifact-password-file-in-tmp-dir-shadow.png1635216366-sandfly-file-artifact-password-file-in-tmp-dir-shadow1635216366-sandfly-file-artifact-password-file-in-tmp-dir-shadowhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216330-user-password-present.png1635216330-user-password-present1635216330-user-password-presenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216344-sandfly-policy-user-ssh-authorized-keys-type-ecdsa-sha2-nistp256.png1635216344-sandfly-policy-user-ssh-authorized-keys-type-ecdsa-sha2-nistp2561635216344-sandfly-policy-user-ssh-authorized-keys-type-ecdsa-sha2-nistp256https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216315-sandfly-user-password-hash-type-unknown-1.png1635216315-sandfly-user-password-hash-type-unknown-11635216315-sandfly-user-password-hash-type-unknown-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216322-sandfly-policy-user-password-days-since-expired-greater-than-30-days.png1635216322-sandfly-policy-user-password-days-since-expired-greater-than-30-days1635216322-sandfly-policy-user-password-days-since-expired-greater-than-30-days2026-09-28https://sandflysecurity.com/blog/sandfly-5-3-detailed-host-forensics-and-microsoft-sentinel-integrationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936674-host-details-processes.png1737936674-host-details-processes1737936674-host-details-processeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737937021-host-details-services.png1737937021-host-details-services1737937021-host-details-serviceshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936896-host-details-hardware.png1737936896-host-details-hardware1737936896-host-details-hardwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936688-host-details-listeners.png1737936688-host-details-listeners1737936688-host-details-listenershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936822-host-details-users.png1737936822-host-details-users1737936822-host-details-usershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936853-host-details-kernel-modules.png1737936853-host-details-kernel-modules1737936853-host-details-kernel-moduleshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936577-host-details.png1737936577-host-details1737936577-host-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936783-results-details.png1737936783-results-details1737936783-results-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737936870-host-details-ssh.png1737936870-host-details-ssh1737936870-host-details-sshhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737937068-integration-ms-sentinel.png1737937068-integration-ms-sentinel1737937068-integration-ms-sentinelhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/partners/ericssonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1772137554-eri_horizontal_rgb.png1772137554-eri_horizontal_rgb1772137554-eri_horizontal_rgbhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/blog/linux-process-running-with-hidden-binary-name-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1735506237-linux-process-running-with-hidden-binary-name-attack.png1735506237-linux-process-running-with-hidden-binary-name-attack1735506237-linux-process-running-with-hidden-binary-name-attack2026-09-28https://sandflysecurity.com/blog/sandfly-linux-file-entropy-scanner-updatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637270429-incident-host-results-1.png1637270429-incident-host-results-11637270429-incident-host-results-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-security-receives-seed-fundinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host.png1643243329-results-by-host1643243329-results-by-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1711252956-sandfly-gulatech-sorenson.png1711252956-sandfly-gulatech-sorenson1711252956-sandfly-gulatech-sorensonhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1772142934-sandfly-ericsson-1200-x-675-social.png1772142934-sandfly-ericsson-1200-x-675-social1772142934-sandfly-ericsson-1200-x-675-social2026-09-28https://sandflysecurity.com/blog/christchurch-hackercon-2018-presentation-insiders-history-of-intrusion-detection-technologyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/ssh-major-compromise-vector-for-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host.png1643243329-results-by-host1643243329-results-by-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658977462-screen-shot-2022-07-28-at-10-26-01-am-1.png1658977462-screen-shot-2022-07-28-at-10-26-01-am-11658977462-screen-shot-2022-07-28-at-10-26-01-am-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1672884665-google-cloud-security-report-targeted-software.png1672884665-google-cloud-security-report-targeted-software1672884665-google-cloud-security-report-targeted-softwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1672884665-google-cloud-security-report-targeted-software-1.png1672884665-google-cloud-security-report-targeted-software-11672884665-google-cloud-security-report-targeted-software-12026-09-28https://sandflysecurity.com/blog/hunting-for-linux-intrusion-tactics-is-better-than-searching-for-exploit-signatureshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/deploy-and-configure-sandfly-agentless-security-on-digitaloceanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1763412180-do-sandfly-deploy.png1763412180-do-sandfly-deploy1763412180-do-sandfly-deployhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/sample-landing-pagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-18https://sandflysecurity.com/blog/linux-process-running-from-dev-shm-ram-disk-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734638383-video-thumb-linux-process-running-from-ram-disk-attack.png1734638383-video-thumb-linux-process-running-from-ram-disk-attack1734638383-video-thumb-linux-process-running-from-ram-disk-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1735780360-video-thumb-linux-process-in-temp-directory-attack.png1735780360-video-thumb-linux-process-in-temp-directory-attack1735780360-video-thumb-linux-process-in-temp-directory-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-documentation-now-onlinehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-now-available-for-free-at-digital-oceanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/why-agentless-security-is-needed-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-12026-09-28https://sandflysecurity.com/why-sandfly/case-studieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/sandfly-performance-white-paperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-2.png1712190688-thumbnail-generic-21712190688-thumbnail-generic-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728971541-thumbnail-rob-joyce-interview.png1728971541-thumbnail-rob-joyce-interview1728971541-thumbnail-rob-joyce-interviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/resources/requirements-installationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-18https://sandflysecurity.com/blog/deprecation-of-linux-kernels-prior-to-32-in-sandfly-58https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1657853403-screen-shot-2022-07-15-at-2-46-12-pm.png1657853403-screen-shot-2022-07-15-at-2-46-12-pm1657853403-screen-shot-2022-07-15-at-2-46-12-pmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784081543-5-8-update-thumbnail.png1784081543-5-8-update-thumbnail1784081543-5-8-update-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/how-linux-malware-works-from-simple-to-sophisticatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/blog/ssh-key-compromise-risks-and-countermeasureshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687818898-ssh-find-authorized_keys2-annotated.png1687818898-ssh-find-authorized_keys2-annotated1687818898-ssh-find-authorized_keys2-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687755728-ssh-find-dupes-annotated.png1687755728-ssh-find-dupes-annotated1687755728-ssh-find-dupes-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures03-ssh-duplicate-key-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures03-ssh-duplicate-key-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures03-ssh-duplicate-key-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658977462-screen-shot-2022-07-28-at-10-26-01-am.png1658977462-screen-shot-2022-07-28-at-10-26-01-am1658977462-screen-shot-2022-07-28-at-10-26-01-amhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures06-ssh-find-options-set-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures06-ssh-find-options-set-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures06-ssh-find-options-set-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures05-ssh-excessive-keys-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures05-ssh-excessive-keys-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures05-ssh-excessive-keys-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures07-ssh-find-authorized_keys2-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures07-ssh-find-authorized_keys2-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures07-ssh-find-authorized_keys2-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687819319-ssh-modified-authorized_keys-annotated.png1687819319-ssh-modified-authorized_keys-annotated1687819319-ssh-modified-authorized_keys-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures04-ssh-find-dupes-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures04-ssh-find-dupes-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures04-ssh-find-dupes-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures01-ssh-find-private-keys-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures01-ssh-find-private-keys-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures01-ssh-find-private-keys-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687755878-ssh-duplicate-key-annotated.png1687755878-ssh-duplicate-key-annotated1687755878-ssh-duplicate-key-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SSH%20Key%20Compromise%20Risks%20and%20Countermeasures/blog-imagesssh-key-compromise-risks-and-countermeasures02-ssh-modified-authorized_keys-annotated.pngblog-imagesssh-key-compromise-risks-and-countermeasures02-ssh-modified-authorized_keys-annotatedblog-imagesssh-key-compromise-risks-and-countermeasures02-ssh-modified-authorized_keys-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687819717-ssh-find-private-keys-annotated.png1687819717-ssh-find-private-keys-annotated1687819717-ssh-find-private-keys-annotatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1687855406-ssh-find-options-set-annotated.png1687855406-ssh-find-options-set-annotated1687855406-ssh-find-options-set-annotated2026-09-28https://sandflysecurity.com/blog/sandfly-5-5-ai-linux-forensics-analysis-demohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753070999-sandfly-5-5-ai-linux-security-analysis.png1753070999-sandfly-5-5-ai-linux-security-analysis1753070999-sandfly-5-5-ai-linux-security-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-wins-gold-in-the-cybersecurity-excellence-awards-for-edrhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1742520993-gold-award-social.png1742520993-gold-award-social1742520993-gold-award-socialhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1742511034-gold-award-post.png1742511034-gold-award-post1742511034-gold-award-post2026-09-28https://sandflysecurity.com/blog/sandfly-2-1-releasedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216324-suspicious-process-maps.png1635216324-suspicious-process-maps1635216324-suspicious-process-mapshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216316-suspicious-sudoer-2.png1635216316-suspicious-sudoer-21635216316-suspicious-sudoer-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216332-process-forensics.png1635216332-process-forensics1635216332-process-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216340-process-forensics-binary.png1635216340-process-forensics-binary1635216340-process-forensics-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-bindshell-alert.png1635216293-bindshell-alert1635216293-bindshell-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759091899-nk-open-to-work-circle-transparent.png1759091899-nk-open-to-work-circle-transparent1759091899-nk-open-to-work-circle-transparenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216304-pcap-alert.png1635216304-pcap-alert1635216304-pcap-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/partners/amivizhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1772202481-amiviz-logo-reversed-2-color.png1772202481-amiviz-logo-reversed-2-color1772202481-amiviz-logo-reversed-2-colorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-22https://sandflysecurity.com/blog/using-elasticsearch-and-kibana-to-investigate-suspicious-linux-activity-with-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1781288662-linux-malware-simple-to-sophisticated.png1781288662-linux-malware-simple-to-sophisticated1781288662-linux-malware-simple-to-sophisticated2026-09-28https://sandflysecurity.com/blog/sandfly-5.1-introducing-ssh-security-zoneshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/xz-ssh-backdoor-detection-strategieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712189341-xz-results.png1712189341-xz-results1712189341-xz-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20XZ%20SSH%20Backdoor%20Detection%20Strategies/blog-imagesxz-ssh-backdoor-detection-strategies02-xz-results-raw.pngblog-imagesxz-ssh-backdoor-detection-strategies02-xz-results-rawblog-imagesxz-ssh-backdoor-detection-strategies02-xz-results-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20XZ%20SSH%20Backdoor%20Detection%20Strategies/blog-imagesxz-ssh-backdoor-detection-strategies03-xz-results-raw-top-level.pngblog-imagesxz-ssh-backdoor-detection-strategies03-xz-results-raw-top-levelblog-imagesxz-ssh-backdoor-detection-strategies03-xz-results-raw-top-levelhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712188755-xz-sleep-process-environ.png1712188755-xz-sleep-process-environ1712188755-xz-sleep-process-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712189404-xz-results-raw.png1712189404-xz-results-raw1712189404-xz-results-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20XZ%20SSH%20Backdoor%20Detection%20Strategies/blog-imagesxz-ssh-backdoor-detection-strategies04-xz-results.pngblog-imagesxz-ssh-backdoor-detection-strategies04-xz-resultsblog-imagesxz-ssh-backdoor-detection-strategies04-xz-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20XZ%20SSH%20Backdoor%20Detection%20Strategies/blog-imagesxz-ssh-backdoor-detection-strategies01-xz-sleep-process-environ.pngblog-imagesxz-ssh-backdoor-detection-strategies01-xz-sleep-process-environblog-imagesxz-ssh-backdoor-detection-strategies01-xz-sleep-process-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-2.png1712190688-thumbnail-generic-21712190688-thumbnail-generic-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712189150-xz-results-raw-top-level.png1712189150-xz-results-raw-top-level1712189150-xz-results-raw-top-level2026-09-28https://sandflysecurity.com/partners/cyberteam360https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1771939095-cyberteam360-logo-white.png1771939095-cyberteam360-logo-white1771939095-cyberteam360-logo-white2026-09-18https://sandflysecurity.com/blog/sandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-viewshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views04-host-view-offline.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views04-host-view-offlineblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views04-host-view-offlinehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views02-host-view-details.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views02-host-view-detailsblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views02-host-view-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243523-cron-base64.png1643243523-cron-base641643243523-cron-base64https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host-1.png1643243329-results-by-host-11643243329-results-by-host-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643238708-host-view-details.png1643238708-host-view-details1643238708-host-view-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643238756-hostview-full.png1643238756-hostview-full1643238756-hostview-fullhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643238772-host-view-offline.png1643238772-host-view-offline1643238772-host-view-offlinehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643242607-key-forensic-arrow.png1643242607-key-forensic-arrow1643242607-key-forensic-arrowhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views03-hostview-full.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views03-hostview-fullblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views03-hostview-fullhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views05-results-by-host.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views05-results-by-hostblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views05-results-by-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views01-cron-base64.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views01-cron-base64blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views01-cron-base64https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%203.2%20Base64%20Linux%20Malware%20Payload%20Detection%20and%20New%20UI%20Views/blog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views06-key-forensic-arrow.pngblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views06-key-forensic-arrowblog-imagessandfly-3-2-base64-linux-malware-payload-detection-and-new-ui-views06-key-forensic-arrow2026-09-28https://sandflysecurity.com/blog/linux-obsolete-password-hash-riskshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734035759-video-thumb-ssh-excessive-keys-risk.png1734035759-video-thumb-ssh-excessive-keys-risk1734035759-video-thumb-ssh-excessive-keys-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426305-thumbnail-reverse-shell-forensics.png1733426305-thumbnail-reverse-shell-forensics1733426305-thumbnail-reverse-shell-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426336-thumbnail-no-login-shell-rename-attacks.png1733426336-thumbnail-no-login-shell-rename-attacks1733426336-thumbnail-no-login-shell-rename-attackshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733425718-thumbnail-obsolete-password-hashes.png1733425718-thumbnail-obsolete-password-hashes1733425718-thumbnail-obsolete-password-hasheshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/getting-an-attacker-ip-address-from-a-malicious-linux-at-jobhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-use-cat-to-list-all-jobs.png1635216293-use-cat-to-list-all-jobs1635216293-use-cat-to-list-all-jobshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216307-sandfly-detecting-malicious-at-job-linux-persistence.png1635216307-sandfly-detecting-malicious-at-job-linux-persistence1635216307-sandfly-detecting-malicious-at-job-linux-persistencehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706773-packet-breaking-through-wall.jpg1750706773-packet-breaking-through-wall1750706773-packet-breaking-through-wallhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216319-sandfly-detecting-malicious-at-job-linux-persistence-2.png1635216319-sandfly-detecting-malicious-at-job-linux-persistence-21635216319-sandfly-detecting-malicious-at-job-linux-persistence-22026-09-28https://sandflysecurity.com/blog/sandfly-4-5-0-powerful-new-expression-syntaxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1686520520-the_summit_supercomputer.jpg1686520520-the_summit_supercomputer1686520520-the_summit_supercomputerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1686527854-user-read-api-role.png1686527854-user-read-api-role1686527854-user-read-api-rolehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1759091899-nk-open-to-work-circle-transparent.png1759091899-nk-open-to-work-circle-transparent1759091899-nk-open-to-work-circle-transparenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1686518885-customer-sandfly-expr-syntax.png1686518885-customer-sandfly-expr-syntax1686518885-customer-sandfly-expr-syntax2026-09-28https://sandflysecurity.com/blog/ssh-key-credential-tracking-with-sandfly-splunk-app-updatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1667956989-splunk-ssh-key-last-seen-report.png1667956989-splunk-ssh-key-last-seen-report1667956989-splunk-ssh-key-last-seen-reporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1667956803-splunk-ssh-key-forensic-data.png1667956803-splunk-ssh-key-forensic-data1667956803-splunk-ssh-key-forensic-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1667956927-splunk-ssh-authorized_keys-created-past-7-days-detail-listing.png1667956927-splunk-ssh-authorized_keys-created-past-7-days-detail-listing1667956927-splunk-ssh-authorized_keys-created-past-7-days-detail-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1667956487-splunk-ssh-key-summary.png1667956487-splunk-ssh-key-summary1667956487-splunk-ssh-key-summaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1667956697-splunk-ssh-key-details.png1667956697-splunk-ssh-key-details1667956697-splunk-ssh-key-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-security-code-audit-and-continuous-monitoringhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1662549597-cure53-logo.png1662549597-cure53-logo1662549597-cure53-logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1662520600-verified.png1662520600-verified1662520600-verifiedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/destination-linux-podcast-tor-vpns-and-anonymity-riskshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Destination-linux%20cybersecurity%20interview/Screenshot%202026-09-24%20at%2011.33.02%20AM.pngScreenshot 2026-09-24 at 11.33.02 AMScreenshot 2026-09-24 at 11.33.02 AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/linux-medusa-rootkit-detection-and-de-cloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking04-medusa-suspicious-file-details.pngblog-imageslinux-medusa-rootkit-detection-and-de-cloaking04-medusa-suspicious-file-detailsblog-imageslinux-medusa-rootkit-detection-and-de-cloaking04-medusa-suspicious-file-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753656619-medusa-host-analysis-follow-up-question-highlighted.png1753656619-medusa-host-analysis-follow-up-question-highlighted1753656619-medusa-host-analysis-follow-up-question-highlightedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking03-medusa-busybox-static-commands-highlighted.pngblog-imageslinux-medusa-rootkit-detection-and-de-cloaking03-medusa-busybox-static-commands-highlightedblog-imageslinux-medusa-rootkit-detection-and-de-cloaking03-medusa-busybox-static-commands-highlightedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking02-medusa-rootkit-busybox-static.pngblog-imageslinux-medusa-rootkit-detection-and-de-cloaking02-medusa-rootkit-busybox-staticblog-imageslinux-medusa-rootkit-detection-and-de-cloaking02-medusa-rootkit-busybox-statichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking01-medusa-jedi-mind-trick.jpegblog-imageslinux-medusa-rootkit-detection-and-de-cloaking01-medusa-jedi-mind-trickblog-imageslinux-medusa-rootkit-detection-and-de-cloaking01-medusa-jedi-mind-trickhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1771186681-bpfdoor-detection-and-hunting-tactics.png1771186681-bpfdoor-detection-and-hunting-tactics1771186681-bpfdoor-detection-and-hunting-tacticshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753654332-medusa-jedi-mind-trick.jpg1753654332-medusa-jedi-mind-trick1753654332-medusa-jedi-mind-trickhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104493-bincrypter-man.jpg1743104493-bincrypter-man1743104493-bincrypter-manhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753654209-medusa-tron-image.jpg1753654209-medusa-tron-image1753654209-medusa-tron-imagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753656543-medusa-host-analysis.png1753656543-medusa-host-analysis1753656543-medusa-host-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking05-medusa-host-analysis.pngblog-imageslinux-medusa-rootkit-detection-and-de-cloaking05-medusa-host-analysisblog-imageslinux-medusa-rootkit-detection-and-de-cloaking05-medusa-host-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20Medusa%20Rootkit%20Detection%20and%20De-Cloaking/blog-imageslinux-medusa-rootkit-detection-and-de-cloaking06-medusa-host-analysis-follow-up-question-highlighted.pngblog-imageslinux-medusa-rootkit-detection-and-de-cloaking06-medusa-host-analysis-follow-up-question-highlightedblog-imageslinux-medusa-rootkit-detection-and-de-cloaking06-medusa-host-analysis-follow-up-question-highlightedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753654431-medusa-rootkit-busybox-static.png1753654431-medusa-rootkit-busybox-static1753654431-medusa-rootkit-busybox-statichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753656408-medusa-busybox-static-commands-highlighted.png1753656408-medusa-busybox-static-commands-highlighted1753656408-medusa-busybox-static-commands-highlightedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1753656488-medusa-suspicious-file-details.png1753656488-medusa-suspicious-file-details1753656488-medusa-suspicious-file-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/evasive-linux-malware-detection-video-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426336-thumbnail-no-login-shell-rename-attacks.png1733426336-thumbnail-no-login-shell-rename-attacks1733426336-thumbnail-no-login-shell-rename-attackshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/sandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-morehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216384-sandfly-user-home-dir-dev-shm.png1635216384-sandfly-user-home-dir-dev-shm1635216384-sandfly-user-home-dir-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more09-sandfly-process-running-default-command-excessive-time.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more09-sandfly-process-running-default-command-excessive-timeblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more09-sandfly-process-running-default-command-excessive-timehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216367-sandfly-file-permissions-risk-etc-sudoers.png1635216367-sandfly-file-permissions-risk-etc-sudoers1635216367-sandfly-file-permissions-risk-etc-sudoershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more03-operating-system-1.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more03-operating-system-1blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more03-operating-system-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-sandfly-external-elasticsearch-database.png1635216293-sandfly-external-elasticsearch-database1635216293-sandfly-external-elasticsearch-databasehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216343-sandfly-process-suspicious-name-docker-container.png1635216343-sandfly-process-suspicious-name-docker-container1635216343-sandfly-process-suspicious-name-docker-containerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more10-sandfly-file-permissions-risk-etc-sudoers.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more10-sandfly-file-permissions-risk-etc-sudoersblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more10-sandfly-file-permissions-risk-etc-sudoershttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more11-packet-process-packet-sniffer-malicious-operating.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more11-packet-process-packet-sniffer-malicious-operatingblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more11-packet-process-packet-sniffer-malicious-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more14-ssh-key-logger-artifact.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more14-ssh-key-logger-artifactblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more14-ssh-key-logger-artifacthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216374-packet-process-packet-sniffer-malicious-operating.png1635216374-packet-process-packet-sniffer-malicious-operating1635216374-packet-process-packet-sniffer-malicious-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216400-ssh-key-logger-artifact.png1635216400-ssh-key-logger-artifact1635216400-ssh-key-logger-artifacthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216351-sandfly-process-hiding-linux-stealth-rootkit.png1635216351-sandfly-process-hiding-linux-stealth-rootkit1635216351-sandfly-process-hiding-linux-stealth-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216328-user-failed-logins.png1635216328-user-failed-logins1635216328-user-failed-loginshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more05-user-failed-logins.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more05-user-failed-loginsblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more05-user-failed-loginshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-operating-system-1.png1635216311-operating-system-11635216311-operating-system-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more12-sandfly-user-home-dir-dev-shm.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more12-sandfly-user-home-dir-dev-shmblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more12-sandfly-user-home-dir-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more07-sandfly-process-suspicious-name-docker-container.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more07-sandfly-process-suspicious-name-docker-containerblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more07-sandfly-process-suspicious-name-docker-containerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216304-sandfly-results-elasticsearch-database.png1635216304-sandfly-results-elasticsearch-database1635216304-sandfly-results-elasticsearch-databasehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more06-sandfly-kibana-suspcious-processes-1.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more06-sandfly-kibana-suspcious-processes-1blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more06-sandfly-kibana-suspcious-processes-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more08-sandfly-process-hiding-linux-stealth-rootkit.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more08-sandfly-process-hiding-linux-stealth-rootkitblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more08-sandfly-process-hiding-linux-stealth-rootkithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more04-process-heat-maps-2.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more04-process-heat-maps-2blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more04-process-heat-maps-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more02-sandfly-results-elasticsearch-database.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more02-sandfly-results-elasticsearch-databaseblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more02-sandfly-results-elasticsearch-databasehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216359-sandfly-process-running-default-command-excessive-time.png1635216359-sandfly-process-running-default-command-excessive-time1635216359-sandfly-process-running-default-command-excessive-timehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216391-strace-log-artifact-dev-shm.png1635216391-strace-log-artifact-dev-shm1635216391-strace-log-artifact-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216335-sandfly-kibana-suspcious-processes-1.png1635216335-sandfly-kibana-suspcious-processes-11635216335-sandfly-kibana-suspcious-processes-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216319-process-heat-maps-2.png1635216319-process-heat-maps-21635216319-process-heat-maps-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more01-sandfly-external-elasticsearch-database.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more01-sandfly-external-elasticsearch-databaseblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more01-sandfly-external-elasticsearch-databasehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.6.0%20%E2%80%93%20Elasticsearch%20Replication%2c%20Linux%20Docker%20Container%20Security%20Scanning%2c%20Hidden/blog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more13-strace-log-artifact-dev-shm.pngblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more13-strace-log-artifact-dev-shmblog-imagessandfly-2-6-0-elasticsearch-replication-linux-container-security-scanning-hidden-process-de-cloaking-and-more13-strace-log-artifact-dev-shm2026-09-28https://sandflysecurity.com/why-sandfly/fast-deploymenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-22https://sandflysecurity.com/blog/blog/automotive-manufacturing-chooses-agentless-linux-edr-after-agent-based-failureshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774298962-adobestock_1827842521.jpg1774298962-adobestock_18278425211774298962-adobestock_18278425212026-09-28https://sandflysecurity.com/blog/lunk-app-for-sandfly-agentless-intrusion-detection-for-linux-now-availablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/why-sandfly/data-privacyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/jason-dent.pngjason-dentjason-dent2026-09-22https://sandflysecurity.com/blog/detecting-copy-fail-linux-vulnerability-agentlessly-with-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking.png1728261226-thumbnail-root-kit-decloaking1728261226-thumbnail-root-kit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1778042103-copy-fail-image.png1778042103-copy-fail-image1778042103-copy-fail-imagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-version-5-0-is-now-availablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-2.png1712190688-thumbnail-generic-21712190688-thumbnail-generic-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/linux-password-hash-risks-and-security-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1741036373-linux-password-hash-security-overview.png1741036373-linux-password-hash-security-overview1741036373-linux-password-hash-security-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1739473747-thumbnail-obsolete-linux-password-hash-threats.png1739473747-thumbnail-obsolete-linux-password-hash-threats1739473747-thumbnail-obsolete-linux-password-hash-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/leaked-north-korean-linux-stealth-rootkit-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755161231-korea-dirs-cloaked-entry-etc-init-d-tracker-fs.png1755161231-korea-dirs-cloaked-entry-etc-init-d-tracker-fs1755161231-korea-dirs-cloaked-entry-etc-init-d-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755160948-korea-systemd-service.png1755160948-korea-systemd-service1755160948-korea-systemd-servicehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755148332-korea-bindshell-active-port-22-help-command.png1755148332-korea-bindshell-active-port-22-help-command1755148332-korea-bindshell-active-port-22-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis05-korea-var-log-kern-log-vmwfxs-module-signature-taint.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis05-korea-var-log-kern-log-vmwfxs-module-signature-taintblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis05-korea-var-log-kern-log-vmwfxs-module-signature-tainthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis07-korea-kernel-recon-kernel-tainted.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis07-korea-kernel-recon-kernel-taintedblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis07-korea-kernel-recon-kernel-taintedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis03-korea-file-usr-include-tracker-fs.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis03-korea-file-usr-include-tracker-fsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis03-korea-file-usr-include-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755162277-korea-bindshell-active-port-22-socks5-help-command.png1755162277-korea-bindshell-active-port-22-socks5-help-command1755162277-korea-bindshell-active-port-22-socks5-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755162683-korea-process-running-hidden-stealth-dash-shell.png1755162683-korea-process-running-hidden-stealth-dash-shell1755162683-korea-process-running-hidden-stealth-dash-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis27-korea-ai-host-analysis-flash-pro.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis27-korea-ai-host-analysis-flash-problog-imagesleaked-north-korean-linux-stealth-rootkit-analysis27-korea-ai-host-analysis-flash-prohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755147534-korea-var-log-kern-log-vmwfxs-module-signature-taint.png1755147534-korea-var-log-kern-log-vmwfxs-module-signature-taint1755147534-korea-var-log-kern-log-vmwfxs-module-signature-tainthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755147389-korea-dmesg-vmwfxs-module-signature-taint.png1755147389-korea-dmesg-vmwfxs-module-signature-taint1755147389-korea-dmesg-vmwfxs-module-signature-tainthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755159506-tracker-fs-hidden-dir-binary.png1755159506-tracker-fs-hidden-dir-binary1755159506-tracker-fs-hidden-dir-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis04-korea-dmesg-vmwfxs-module-signature-taint.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis04-korea-dmesg-vmwfxs-module-signature-taintblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis04-korea-dmesg-vmwfxs-module-signature-tainthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis01-korea-rootkit-initial-alerts.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis01-korea-rootkit-initial-alertsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis01-korea-rootkit-initial-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755165902-korea-host-services-listing.png1755165902-korea-host-services-listing1755165902-korea-host-services-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755162247-korea-bindshell-active-port-22-trans-help-command.png1755162247-korea-bindshell-active-port-22-trans-help-command1755162247-korea-bindshell-active-port-22-trans-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755162591-korea-bindshell-active-port-22-shell-help-command.png1755162591-korea-bindshell-active-port-22-shell-help-command1755162591-korea-bindshell-active-port-22-shell-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755149700-korea-stat-usr-include-tracker-fs.png1755149700-korea-stat-usr-include-tracker-fs1755149700-korea-stat-usr-include-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis06-korea-kernel-tainted-inconsistency.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis06-korea-kernel-tainted-inconsistencyblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis06-korea-kernel-tainted-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755167408-korea-sandfly-processdecloak-pid-environ.png1755167408-korea-sandfly-processdecloak-pid-environ1755167408-korea-sandfly-processdecloak-pid-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis25-korea-bindshell-active-port-22-shell-help-command.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis25-korea-bindshell-active-port-22-shell-help-commandblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis25-korea-bindshell-active-port-22-shell-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis26-korea-process-running-hidden-stealth-dash-shell.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis26-korea-process-running-hidden-stealth-dash-shellblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis26-korea-process-running-hidden-stealth-dash-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755159171-korea-ls-file-stat-usr-include-tracker-fs.png1755159171-korea-ls-file-stat-usr-include-tracker-fs1755159171-korea-ls-file-stat-usr-include-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755147873-korea-kernel-tainted-inconsistency.png1755147873-korea-kernel-tainted-inconsistency1755147873-korea-kernel-tainted-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis13-korea-dirs-cloaked-entry-etc-files.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis13-korea-dirs-cloaked-entry-etc-filesblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis13-korea-dirs-cloaked-entry-etc-fileshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis20-korea-sandfly-processdecloak.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis20-korea-sandfly-processdecloakblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis20-korea-sandfly-processdecloakhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis23-korea-bindshell-active-port-22-trans-help-command.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis23-korea-bindshell-active-port-22-trans-help-commandblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis23-korea-bindshell-active-port-22-trans-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis11-korea-host-services-listing.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis11-korea-host-services-listingblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis11-korea-host-services-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis18-korea-bindshell-active-port-22-ss-listening-port-command-output-no-process.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis18-korea-bindshell-active-port-22-ss-listening-port-command-output-no-processblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis18-korea-bindshell-active-port-22-ss-listening-port-command-output-no-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis14-korea-dirs-cloaked-entry-etc-init-d-tracker-fs.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis14-korea-dirs-cloaked-entry-etc-init-d-tracker-fsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis14-korea-dirs-cloaked-entry-etc-init-d-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755161798-korea-process-running-hidden-stealth-tracker-efs.png1755161798-korea-process-running-hidden-stealth-tracker-efs1755161798-korea-process-running-hidden-stealth-tracker-efshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755145719-north-korean-linux-malware.jpg1755145719-north-korean-linux-malware1755145719-north-korean-linux-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755161164-korea-dirs-cloaked-entry-etc-files.png1755161164-korea-dirs-cloaked-entry-etc-files1755161164-korea-dirs-cloaked-entry-etc-fileshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755167229-korea-sandfly-processdecloak.png1755167229-korea-sandfly-processdecloak1755167229-korea-sandfly-processdecloakhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755149706-korea-file-usr-include-tracker-fs.png1755149706-korea-file-usr-include-tracker-fs1755149706-korea-file-usr-include-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis09-tracker-fs-hidden-dir-binary.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis09-tracker-fs-hidden-dir-binaryblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis09-tracker-fs-hidden-dir-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755172808-korea-rootkit-initial-alerts.png1755172808-korea-rootkit-initial-alerts1755172808-korea-rootkit-initial-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis02-korea-stat-usr-include-tracker-fs.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis02-korea-stat-usr-include-tracker-fsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis02-korea-stat-usr-include-tracker-fshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755159844-korea-proc-acpi-pcicard-socket.png1755159844-korea-proc-acpi-pcicard-socket1755159844-korea-proc-acpi-pcicard-sockethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis19-korea-process-running-hidden-stealth-tracker-efs.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis19-korea-process-running-hidden-stealth-tracker-efsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis19-korea-process-running-hidden-stealth-tracker-efshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755149077-korea-process-environ-history-anti-forensics.png1755149077-korea-process-environ-history-anti-forensics1755149077-korea-process-environ-history-anti-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis21-korea-sandfly-processdecloak-pid-environ.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis21-korea-sandfly-processdecloak-pid-environblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis21-korea-sandfly-processdecloak-pid-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755163774-korea-ai-host-analysis-flash-pro.png1755163774-korea-ai-host-analysis-flash-pro1755163774-korea-ai-host-analysis-flash-prohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755166003-korea-host-services-listing-drift.png1755166003-korea-host-services-listing-drift1755166003-korea-host-services-listing-drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis15-tracker-efs-strings-2-environ-shell-proc-pcicard-passwords.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis15-tracker-efs-strings-2-environ-shell-proc-pcicard-passwordsblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis15-tracker-efs-strings-2-environ-shell-proc-pcicard-passwordshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755160057-tracker-efs-strings-2-environ-shell-proc-pcicard-passwords.png1755160057-tracker-efs-strings-2-environ-shell-proc-pcicard-passwords1755160057-tracker-efs-strings-2-environ-shell-proc-pcicard-passwordshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis12-korea-host-services-listing-drift.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis12-korea-host-services-listing-driftblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis12-korea-host-services-listing-drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755147958-korea-kernel-recon-kernel-tainted.png1755147958-korea-kernel-recon-kernel-tainted1755147958-korea-kernel-recon-kernel-taintedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis17-korea-bindshell-active-port-22-help-command.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis17-korea-bindshell-active-port-22-help-commandblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis17-korea-bindshell-active-port-22-help-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis16-korea-proc-acpi-pcicard-socket.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis16-korea-proc-acpi-pcicard-socketblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis16-korea-proc-acpi-pcicard-sockethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1755161706-korea-bindshell-active-port-22-ss-listening-port-command-output-no-process.png1755161706-korea-bindshell-active-port-22-ss-listening-port-command-output-no-process1755161706-korea-bindshell-active-port-22-ss-listening-port-command-output-no-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Leaked%20North%20Korean%20Linux%20Stealth%20Rootkit%20Analysis/blog-imagesleaked-north-korean-linux-stealth-rootkit-analysis24-korea-bindshell-active-port-22-socks5-help-command.pngblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis24-korea-bindshell-active-port-22-socks5-help-commandblog-imagesleaked-north-korean-linux-stealth-rootkit-analysis24-korea-bindshell-active-port-22-socks5-help-command2026-09-28https://sandflysecurity.com/blog/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysishttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652239393-bpfdoor-ps-listing-shell-running.png1652239393-bpfdoor-ps-listing-shell-running1652239393-bpfdoor-ps-listing-shell-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis02-bpfdoor-process-deleted-command-line.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis02-bpfdoor-process-deleted-command-lineblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis02-bpfdoor-process-deleted-command-linehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis15-bpfdoor-ps-listing-shell-running.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis15-bpfdoor-ps-listing-shell-runningblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis15-bpfdoor-ps-listing-shell-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652241169-bpfdoor-alerts.png1652241169-bpfdoor-alerts1652241169-bpfdoor-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis08-bpfdoor-real-dbus-process-environment.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis08-bpfdoor-real-dbus-process-environmentblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis08-bpfdoor-real-dbus-process-environmenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis03-bpfdoor-deleted-binary.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis03-bpfdoor-deleted-binaryblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis03-bpfdoor-deleted-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis07-bpfdoor-fake-dbus-process-environment.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis07-bpfdoor-fake-dbus-process-environmentblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis07-bpfdoor-fake-dbus-process-environmenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis14-bpf-ssh-shell-activation-edited.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis14-bpf-ssh-shell-activation-editedblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis14-bpf-ssh-shell-activation-editedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652259309-bpfdoor-packet-socket.png1652259309-bpfdoor-packet-socket1652259309-bpfdoor-packet-sockethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652240076-bpfdoor-anti-forensics-shell.png1652240076-bpfdoor-anti-forensics-shell1652240076-bpfdoor-anti-forensics-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis05-bpfdoor-sandfly-hunter-real.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis05-bpfdoor-sandfly-hunter-realblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis05-bpfdoor-sandfly-hunter-realhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652260269-bpfdoor-stack-packet.png1652260269-bpfdoor-stack-packet1652260269-bpfdoor-stack-packethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652238590-bpf-ssh-shell-activation-edited.png1652238590-bpf-ssh-shell-activation-edited1652238590-bpf-ssh-shell-activation-editedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652259284-bpfdoor-sniffer-tuned-detection.png1652259284-bpfdoor-sniffer-tuned-detection1652259284-bpfdoor-sniffer-tuned-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis16-bpfdoor-dash-shell-hunter-points.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis16-bpfdoor-dash-shell-hunter-pointsblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis16-bpfdoor-dash-shell-hunter-pointshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis18-bpfdoor-alerts.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis18-bpfdoor-alertsblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis18-bpfdoor-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652242695-bpfdoor-deleted-binary.png1652242695-bpfdoor-deleted-binary1652242695-bpfdoor-deleted-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis10-bpfdoor-stack-trace.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis10-bpfdoor-stack-traceblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis10-bpfdoor-stack-tracehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652229749-bpfdoor-process-deleted-command-line.png1652229749-bpfdoor-process-deleted-command-line1652229749-bpfdoor-process-deleted-command-linehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652242695-bpfdoor-deleted-binary-1.png1652242695-bpfdoor-deleted-binary-11652242695-bpfdoor-deleted-binary-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652231905-bpfdoor-fake-dbus-process-environment.png1652231905-bpfdoor-fake-dbus-process-environment1652231905-bpfdoor-fake-dbus-process-environmenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652231140-bpfdoor-proc-listing.png1652231140-bpfdoor-proc-listing1652231140-bpfdoor-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652229062-bpfdoor-timestomp-binary-before-deletion.png1652229062-bpfdoor-timestomp-binary-before-deletion1652229062-bpfdoor-timestomp-binary-before-deletionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis12-bpfdoor-packet-socket.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis12-bpfdoor-packet-socketblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis12-bpfdoor-packet-sockethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis13-firewall-redirect-diagram.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis13-firewall-redirect-diagramblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis13-firewall-redirect-diagramhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis17-bpfdoor-anti-forensics-shell.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis17-bpfdoor-anti-forensics-shellblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis17-bpfdoor-anti-forensics-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652239621-bpfdoor-dash-shell-hunter-points.png1652239621-bpfdoor-dash-shell-hunter-points1652239621-bpfdoor-dash-shell-hunter-pointshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis06-bpfdoor-proc-listing.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis06-bpfdoor-proc-listingblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis06-bpfdoor-proc-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652238177-firewall-redirect-diagram.png1652238177-firewall-redirect-diagram1652238177-firewall-redirect-diagramhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652230838-bpfdoor-sandfly-hunter-real.png1652230838-bpfdoor-sandfly-hunter-real1652230838-bpfdoor-sandfly-hunter-realhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652231917-bpfdoor-real-dbus-process-environment.png1652231917-bpfdoor-real-dbus-process-environment1652231917-bpfdoor-real-dbus-process-environmenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652261182-bpfdoor-stack-trace.png1652261182-bpfdoor-stack-trace1652261182-bpfdoor-stack-tracehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis11-bpfdoor-sniffer-tuned-detection.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis11-bpfdoor-sniffer-tuned-detectionblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis11-bpfdoor-sniffer-tuned-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis09-bpfdoor-stack-packet.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis09-bpfdoor-stack-packetblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis09-bpfdoor-stack-packethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1652230613-bpfdoor-ps-listing.png1652230613-bpfdoor-ps-listing1652230613-bpfdoor-ps-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis01-bpfdoor-timestomp-binary-before-deletion.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis01-bpfdoor-timestomp-binary-before-deletionblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis01-bpfdoor-timestomp-binary-before-deletionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20BPFDoor%20-%20An%20Evasive%20Linux%20Backdoor%20Technical%20Analysis/blog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis04-bpfdoor-ps-listing.pngblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis04-bpfdoor-ps-listingblog-imagesbpfdoor-an-evasive-linux-backdoor-technical-analysis04-bpfdoor-ps-listing2026-09-28https://sandflysecurity.com/blog/the-pyramid-of-pain-and-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLoG%20The%20Pyramid%20of%20Pain%20and%20Sandfly/blog-imagesthe-pyramid-of-pain-and-sandfly01-pyramid-of-pain.jpgblog-imagesthe-pyramid-of-pain-and-sandfly01-pyramid-of-painblog-imagesthe-pyramid-of-pain-and-sandfly01-pyramid-of-painhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-2-5-0-higher-performance-ssh-key-certificates-and-more-linux-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216323-process-remote-ip-address-active.png1635216323-process-remote-ip-address-active1635216323-process-remote-ip-address-activehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216306-process-local-tcp-port-operating.png1635216306-process-local-tcp-port-operating1635216306-process-local-tcp-port-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216294-ssh-host-credentials-1.png1635216294-ssh-host-credentials-11635216294-ssh-host-credentials-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216315-process-remote-tcp-ip-address.png1635216315-process-remote-tcp-ip-address1635216315-process-remote-tcp-ip-addresshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216332-nmap-process-masquerading.png1635216332-nmap-process-masquerading1635216332-nmap-process-masqueradinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/insights-from-the-ciso-series-podcasthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1747098840-sysk-sandfly-696x464.webp1747098840-sysk-sandfly-696x4641747098840-sysk-sandfly-696x464https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host.png1643243329-results-by-host1643243329-results-by-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1772142934-sandfly-ericsson-1200-x-675-social.png1772142934-sandfly-ericsson-1200-x-675-social1772142934-sandfly-ericsson-1200-x-675-socialhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/hidden-linux-binary-threats-for-intruders-and-malwarehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736976890-video-thumb-hidden-linux-binary-threats.png1736976890-video-thumb-hidden-linux-binary-threats1736976890-video-thumb-hidden-linux-binary-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734035759-video-thumb-ssh-excessive-keys-risk.png1734035759-video-thumb-ssh-excessive-keys-risk1734035759-video-thumb-ssh-excessive-keys-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736465756-video-thumb-immutable-file-attack-persistence-on-linux.png1736465756-video-thumb-immutable-file-attack-persistence-on-linux1736465756-video-thumb-immutable-file-attack-persistence-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1735506237-linux-process-running-with-hidden-binary-name-attack.png1735506237-linux-process-running-with-hidden-binary-name-attack1735506237-linux-process-running-with-hidden-binary-name-attack2026-09-28https://sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantlyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132154-cronrat-results-list.png1638132154-cronrat-results-list1638132154-cronrat-results-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly12-cronrat-result-excessive-length-raw.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly12-cronrat-result-excessive-length-rawblog-imagesdetecting-cronrat-malware-on-linux-instantly12-cronrat-result-excessive-length-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly07-cronrat-dashboard-results.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly07-cronrat-dashboard-resultsblog-imagesdetecting-cronrat-malware-on-linux-instantly07-cronrat-dashboard-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly02-cronrat-custom-sandfly-edit.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly02-cronrat-custom-sandfly-editblog-imagesdetecting-cronrat-malware-on-linux-instantly02-cronrat-custom-sandfly-edithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638130111-cronrat-cron-template.png1638130111-cronrat-cron-template1638130111-cronrat-cron-templatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132576-cronrate-illegal-day-result.png1638132576-cronrate-illegal-day-result1638132576-cronrate-illegal-day-resulthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638131565-cronrate-custom-sandfly-active-check.png1638131565-cronrate-custom-sandfly-active-check1638131565-cronrate-custom-sandfly-active-checkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly08-cronrat-results-list.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly08-cronrat-results-listblog-imagesdetecting-cronrat-malware-on-linux-instantly08-cronrat-results-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638131852-cronrate-custom-sandflies-select.png1638131852-cronrate-custom-sandflies-select1638131852-cronrate-custom-sandflies-selecthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly06-cronrate-passed-check.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly06-cronrate-passed-checkblog-imagesdetecting-cronrat-malware-on-linux-instantly06-cronrate-passed-checkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132597-cronrate-illegal-date-raw.png1638132597-cronrate-illegal-date-raw1638132597-cronrate-illegal-date-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly01-cronrat-cron-template.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly01-cronrat-cron-templateblog-imagesdetecting-cronrat-malware-on-linux-instantly01-cronrat-cron-templatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly09-cronrate-illegal-day-result.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly09-cronrate-illegal-day-resultblog-imagesdetecting-cronrat-malware-on-linux-instantly09-cronrate-illegal-day-resulthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132576-cronrate-illegal-day-result-1.png1638132576-cronrate-illegal-day-result-11638132576-cronrate-illegal-day-result-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly10-cronrate-illegal-date-raw.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly10-cronrate-illegal-date-rawblog-imagesdetecting-cronrat-malware-on-linux-instantly10-cronrate-illegal-date-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639426387-kinsing-malicious-process-sandfly-hunter.png1639426387-kinsing-malicious-process-sandfly-hunter1639426387-kinsing-malicious-process-sandfly-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly05-cronrate-custom-sandflies-select.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly05-cronrate-custom-sandflies-selectblog-imagesdetecting-cronrat-malware-on-linux-instantly05-cronrate-custom-sandflies-selecthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132109-cronrat-dashboard-results.png1638132109-cronrat-dashboard-results1638132109-cronrat-dashboard-resultshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly04-cronrate-custom-sandfly-active-check.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly04-cronrate-custom-sandfly-active-checkblog-imagesdetecting-cronrat-malware-on-linux-instantly04-cronrate-custom-sandfly-active-checkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638131873-cronrat-command-match-template.png1638131873-cronrat-command-match-template1638131873-cronrat-command-match-templatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly03-cronrat-command-match-template.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly03-cronrat-command-match-templateblog-imagesdetecting-cronrat-malware-on-linux-instantly03-cronrat-command-match-templatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132631-cronrat-result-really-long-command.png1638132631-cronrat-result-really-long-command1638132631-cronrat-result-really-long-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20CronRAT%20Crontab%20Malware%20on%20Linux/blog-imagesdetecting-cronrat-malware-on-linux-instantly11-cronrat-result-really-long-command.pngblog-imagesdetecting-cronrat-malware-on-linux-instantly11-cronrat-result-really-long-commandblog-imagesdetecting-cronrat-malware-on-linux-instantly11-cronrat-result-really-long-commandhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638130220-cronrat-custom-sandfly-edit.png1638130220-cronrat-custom-sandfly-edit1638130220-cronrat-custom-sandfly-edithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1638132051-cronrate-passed-check.png1638132051-cronrate-passed-check1638132051-cronrate-passed-check2026-09-28https://sandflysecurity.comhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1772156895-mp-ericsson-hq-signage-14-original.jpg1772156895-mp-ericsson-hq-signage-14-original1772156895-mp-ericsson-hq-signage-14-originalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/fgfgfggfgfgfgf.svgfgfgfggfgfgfgffgfgfggfgfgfgfhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/image.webpimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1637897245-umass-logo.jpg1637897245-umass-logo1637897245-umass-logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/image%20(2).webpimage (2)image (2)https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1772145063-installing-ericssons-5g-radios-at-telstras-innovation-centre-on-the-gold-coast-australia.jpg1772145063-installing-ericssons-5g-radios-at-telstras-innovation-centre-on-the-gold-coast-australia1772145063-installing-ericssons-5g-radios-at-telstras-innovation-centre-on-the-gold-coast-australiahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1757537158-netfilter-logo3%20(1).png1757537158-netfilter-logo3 (1)1757537158-netfilter-logo3 (1)https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1753953754-ai.png1753953754-ai1753953754-aihttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1753953754-ssh.png1753953754-ssh1753953754-sshhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1772145318-eri_vertical_rgb.png1772145318-eri_vertical_rgb1772145318-eri_vertical_rgbhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/image%20(3).webpimage (3)image (3)https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1754005984-drift.png1754005984-drift1754005984-drifthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1754005964-threats.png1754005964-threats1754005964-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1753228832-digitalocean-official-1.svg1753228832-digitalocean-official-11753228832-digitalocean-official-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/image%20(1).webpimage (1)image (1)https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1753953754-password.png1753953754-password1753953754-passwordhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/fgg.pngfggfgghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/image%20(4).webpimage (4)image (4)2026-09-28https://sandflysecurity.com/blog/detecting-linux-kernel-process-masquerading-with-command-line-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216350-sha1-sum-masquerading-process.png1635216350-sha1-sum-masquerading-process1635216350-sha1-sum-masquerading-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216295-kernel-threads-vs-normal.png1635216295-kernel-threads-vs-normal1635216295-kernel-threads-vs-normalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216340-grep-find-imposter-maps.png1635216340-grep-find-imposter-maps1635216340-grep-find-imposter-mapshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216319-ps-real-imposter.png1635216319-ps-real-imposter1635216319-ps-real-imposterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216309-1-ps-tree-view-kernel-thread-where-is-it.png1635216309-1-ps-tree-view-kernel-thread-where-is-it1635216309-1-ps-tree-view-kernel-thread-where-is-ithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216357-recovering-suspicious-binary.png1635216357-recovering-suspicious-binary1635216357-recovering-suspicious-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216329-cat-proc-maps.png1635216329-cat-proc-maps1635216329-cat-proc-maps2026-09-28https://sandflysecurity.com/blog/sandfly-4-6-1-microsoft-active-directory-support-and-default-linux-password-audithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693270806-password-auditor-1.png1693270806-password-auditor-11693270806-password-auditor-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693270806-password-auditor.png1693270806-password-auditor1693270806-password-auditorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/sandfly-4-2-automatic-host-discovery-and-faster-than-everhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever04-policy_user_ssh_known_hosts_unmasked.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever04-policy_user_ssh_known_hosts_unmaskedblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever04-policy_user_ssh_known_hosts_unmaskedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever07-generate-ssh-key.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever07-generate-ssh-keyblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever07-generate-ssh-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665624325-generate-ssh-key.png1665624325-generate-ssh-key1665624325-generate-ssh-keyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever01-discover-scan.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever01-discover-scanblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever01-discover-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665618251-discover-scan.png1665618251-discover-scan1665618251-discover-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever03-ssh-dead-key-full-view.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever03-ssh-dead-key-full-viewblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever03-ssh-dead-key-full-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665623866-ssh-dead-key-full-view.png1665623866-ssh-dead-key-full-view1665623866-ssh-dead-key-full-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665623498-users_sudoers_readme_entry.png1665623498-users_sudoers_readme_entry1665623498-users_sudoers_readme_entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever08-scheduler-tags-include-exclude.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever08-scheduler-tags-include-excludeblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever08-scheduler-tags-include-excludehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665623377-policy_user_ssh_known_hosts_filename_present.png1665623377-policy_user_ssh_known_hosts_filename_present1665623377-policy_user_ssh_known_hosts_filename_presenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665623170-policy_user_ssh_known_hosts_unmasked.png1665623170-policy_user_ssh_known_hosts_unmasked1665623170-policy_user_ssh_known_hosts_unmaskedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever06-users_sudoers_readme_entry.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever06-users_sudoers_readme_entryblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever06-users_sudoers_readme_entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665624809-scheduler-tags-include-exclude.png1665624809-scheduler-tags-include-exclude1665624809-scheduler-tags-include-excludehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever05-policy_user_ssh_known_hosts_filename_present.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever05-policy_user_ssh_known_hosts_filename_presentblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever05-policy_user_ssh_known_hosts_filename_presenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665618735-automatic-host-maintenance-removal.png1665618735-automatic-host-maintenance-removal1665618735-automatic-host-maintenance-removalhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1665623866-ssh-dead-key-full-view-1.png1665623866-ssh-dead-key-full-view-11665623866-ssh-dead-key-full-view-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.2%20-%20Automatic%20Host%20Discovery%20and%20Faster%20Than%20Ever/blog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever02-automatic-host-maintenance-removal.pngblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever02-automatic-host-maintenance-removalblog-imagessandfly-4-2-automatic-host-discovery-and-faster-than-ever02-automatic-host-maintenance-removal2026-09-28https://sandflysecurity.com/request-a-meetinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1783380032-twitter-post-black-hat-2026-no-logo.png1783380032-twitter-post-black-hat-2026-no-logo1783380032-twitter-post-black-hat-2026-no-logo2026-09-18https://sandflysecurity.com/blog/compromised-linux-cheat-sheethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/end-user-license-agreementhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-17https://sandflysecurity.com/partners/cetinhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1771938756-cetin-rgb-negativ.png1771938756-cetin-rgb-negativ1771938756-cetin-rgb-negativhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/sctp-protocol-attack-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706947-sctp-enabled-lsmod.png1750706947-sctp-enabled-lsmod1750706947-sctp-enabled-lsmodhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706980-sctp-proc-net-protocols.png1750706980-sctp-proc-net-protocols1750706980-sctp-proc-net-protocolshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706773-packet-breaking-through-wall.jpg1750706773-packet-breaking-through-wall1750706773-packet-breaking-through-wallhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706913-sctp-ss-ltun-no-sctp-port-shown-listening-raw.png1750706913-sctp-ss-ltun-no-sctp-port-shown-listening-raw1750706913-sctp-ss-ltun-no-sctp-port-shown-listening-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux08-socat-alert.pngblog-imagessctp-protocol-attack-risks-on-linux08-socat-alertblog-imagessctp-protocol-attack-risks-on-linux08-socat-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux02-socat-sctp-bin-id-output-raw.pngblog-imagessctp-protocol-attack-risks-on-linux02-socat-sctp-bin-id-output-rawblog-imagessctp-protocol-attack-risks-on-linux02-socat-sctp-bin-id-output-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706892-socat-sctp-bin-id-output-raw.png1750706892-socat-sctp-bin-id-output-raw1750706892-socat-sctp-bin-id-output-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706929-sctp-ss-lstu.png1750706929-sctp-ss-lstu1750706929-sctp-ss-lstuhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux05-sctp-enabled-lsmod.pngblog-imagessctp-protocol-attack-risks-on-linux05-sctp-enabled-lsmodblog-imagessctp-protocol-attack-risks-on-linux05-sctp-enabled-lsmodhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux03-sctp-ss-ltun-no-sctp-port-shown-listening-raw.pngblog-imagessctp-protocol-attack-risks-on-linux03-sctp-ss-ltun-no-sctp-port-shown-listening-rawblog-imagessctp-protocol-attack-risks-on-linux03-sctp-ss-ltun-no-sctp-port-shown-listening-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux01-socat-exec-usr-bin-id-raw.pngblog-imagessctp-protocol-attack-risks-on-linux01-socat-exec-usr-bin-id-rawblog-imagessctp-protocol-attack-risks-on-linux01-socat-exec-usr-bin-id-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706993-sctp-proc-net-sctp-eps-raw.png1750706993-sctp-proc-net-sctp-eps-raw1750706993-sctp-proc-net-sctp-eps-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux04-sctp-ss-lstu.pngblog-imagessctp-protocol-attack-risks-on-linux04-sctp-ss-lstublog-imagessctp-protocol-attack-risks-on-linux04-sctp-ss-lstuhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750706871-socat-exec-usr-bin-id-raw.png1750706871-socat-exec-usr-bin-id-raw1750706871-socat-exec-usr-bin-id-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux07-sctp-proc-net-sctp-eps-raw.pngblog-imagessctp-protocol-attack-risks-on-linux07-sctp-proc-net-sctp-eps-rawblog-imagessctp-protocol-attack-risks-on-linux07-sctp-proc-net-sctp-eps-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750707009-socat-alert.png1750707009-socat-alert1750707009-socat-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20SCTP%20Protocol%20Attack%20Risks%20on%20Linux/blog-imagessctp-protocol-attack-risks-on-linux06-sctp-proc-net-protocols.pngblog-imagessctp-protocol-attack-risks-on-linux06-sctp-proc-net-protocolsblog-imagessctp-protocol-attack-risks-on-linux06-sctp-proc-net-protocols2026-09-28https://sandflysecurity.com/partners/carahsofthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1771363141-carahsoft-white-logo-sandfly-security-partner.png1771363141-carahsoft-white-logo-sandfly-security-partner1771363141-carahsoft-white-logo-sandfly-security-partnerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-18https://sandflysecurity.com/blog/sandfly-filescan-open-source-file-entropy-scanner-for-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-sandfly-filescan-malware-scan.png1635216293-sandfly-filescan-malware-scan1635216293-sandfly-filescan-malware-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%20Filescan%20Open%20Source%20File%20Entropy%20Scanner%20for%20Linux/blog-imagessandfly-filescan-open-source-file-entropy-scanner-for-linux01-sandfly-filescan-malware-scan.pngblog-imagessandfly-filescan-open-source-file-entropy-scanner-for-linux01-sandfly-filescan-malware-scanblog-imagessandfly-filescan-open-source-file-entropy-scanner-for-linux01-sandfly-filescan-malware-scanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-1-5-0-releasedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216338-sandfly-process-pcap-file-open.png1635216338-sandfly-process-pcap-file-open1635216338-sandfly-process-pcap-file-openhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216384-process-running-from-suspicious-dir.png1635216384-process-running-from-suspicious-dir1635216384-process-running-from-suspicious-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216345-sandfly-process-listening-netowork-port-running-from-proc-dir.png1635216345-sandfly-process-listening-netowork-port-running-from-proc-dir1635216345-sandfly-process-listening-netowork-port-running-from-proc-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216361-netcat-masquerading-process.png1635216361-netcat-masquerading-process1635216361-netcat-masquerading-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216368-socat-masquerding-process.png1635216368-socat-masquerding-process1635216368-socat-masquerding-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216305-network-process-example-hashes.png1635216305-network-process-example-hashes1635216305-network-process-example-hasheshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216291-network-process-example-ports-open.png1635216291-network-process-example-ports-open1635216291-network-process-example-ports-openhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216391-sandfly-file-pcap-hidden-anywhere.png1635216391-sandfly-file-pcap-hidden-anywhere1635216391-sandfly-file-pcap-hidden-anywherehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216323-sandfly-file-binary-masquerade-typ-mismatch-anywhere.png1635216323-sandfly-file-binary-masquerade-typ-mismatch-anywhere1635216323-sandfly-file-binary-masquerade-typ-mismatch-anywherehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216330-sandfly-file-pcap-in-tmp-dir.png1635216330-sandfly-file-pcap-in-tmp-dir1635216330-sandfly-file-pcap-in-tmp-dirhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216314-network-process-fds-open.png1635216314-network-process-fds-open1635216314-network-process-fds-openhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216377-sandfly-process-masquerade-shell.png1635216377-sandfly-process-masquerade-shell1635216377-sandfly-process-masquerade-shellhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216354-sandfly-process-masquerade-tcpdump-1.png1635216354-sandfly-process-masquerade-tcpdump-11635216354-sandfly-process-masquerade-tcpdump-12026-09-28https://sandflysecurity.com/blog/sandfly-rest-api-publishedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-4-3-0-key-vault-integration-process-ssh-and-persistence-attack-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693270806-password-auditor-1.png1693270806-password-auditor-11693270806-password-auditor-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674601029-unauthorized_user_present.png1674601029-unauthorized_user_present1674601029-unauthorized_user_presenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674533510-host-graph-view.png1674533510-host-graph-view1674533510-host-graph-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674604013-docker-container-attack.png1674604013-docker-container-attack1674604013-docker-container-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674528841-process_cron_placeholder_entry.png1674528841-process_cron_placeholder_entry1674528841-process_cron_placeholder_entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674530816-user_ssh_known_hosts_default_user.png1674530816-user_ssh_known_hosts_default_user1674530816-user_ssh_known_hosts_default_userhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM.png1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AM1658984030-thumbnail-generic-Sep-14-2026-02-00-10-6004-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674532156-credential-provider.png1674532156-credential-provider1674532156-credential-providerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674527776-process_shell_running_detached_ssh.png1674527776-process_shell_running_detached_ssh1674527776-process_shell_running_detached_sshhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674527596-sandfly_process_running_hidden_proc_dir_spoofing.png1674527596-sandfly_process_running_hidden_proc_dir_spoofing1674527596-sandfly_process_running_hidden_proc_dir_spoofinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674527607-process_running_hidden_mount_over.png1674527607-process_running_hidden_mount_over1674527607-process_running_hidden_mount_overhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1674602915-ssh-alert-custom.png1674602915-ssh-alert-custom1674602915-ssh-alert-custom2026-09-28https://sandflysecurity.com/blog/linux-command-line-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/linux-cryptomining-malware-podcast-interviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-security-named-finalist-in-cybershark-pitch-competitionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%20Security%20Named%20Finalist%20in%20CyberShark%20Pitch%20Competition/blog-imagessandfly-security-named-finalist-in-cybershark-pitch-competition01-sandfly.pngblog-imagessandfly-security-named-finalist-in-cybershark-pitch-competition01-sandflyblog-imagessandfly-security-named-finalist-in-cybershark-pitch-competition01-sandflyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1756319960-sandfly-1.png1756319960-sandfly-11756319960-sandfly-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1756319960-sandfly.png1756319960-sandfly1756319960-sandfly2026-09-28https://sandflysecurity.com/blog/sandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter03-rapid-whitelist-sandfly-hunter-process-path.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter03-rapid-whitelist-sandfly-hunter-process-pathblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter03-rapid-whitelist-sandfly-hunter-process-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter18-ssh-hunter-host-view.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter18-ssh-hunter-host-viewblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter18-ssh-hunter-host-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter12-advanced-match-whitelist-attribute-selection-2.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter12-advanced-match-whitelist-attribute-selection-2blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter12-advanced-match-whitelist-attribute-selection-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346864-loose-match-whitelist-selection.png1690346864-loose-match-whitelist-selection1690346864-loose-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346833-strict-match-whitelist-selection.png1690346833-strict-match-whitelist-selection1690346833-strict-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346247-whitelist-modes.png1690346247-whitelist-modes1690346247-whitelist-modeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690347081-advanced-match-whitelist-selection.png1690347081-advanced-match-whitelist-selection1690347081-advanced-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter15-tag-bulk-hosts-select.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter15-tag-bulk-hosts-selectblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter15-tag-bulk-hosts-selecthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690345555-rapid-whitelist-sandfly-hunter-process-path-detail.png1690345555-rapid-whitelist-sandfly-hunter-process-path-detail1690345555-rapid-whitelist-sandfly-hunter-process-path-detailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690345755-rapid-whitelist-sandfly-hunter-process-path-whitelist-summary.png1690345755-rapid-whitelist-sandfly-hunter-process-path-whitelist-summary1690345755-rapid-whitelist-sandfly-hunter-process-path-whitelist-summaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter02-whitelist-example-alert.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter02-whitelist-example-alertblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter02-whitelist-example-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter01-whitelist-modes.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter01-whitelist-modesblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter01-whitelist-modeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690345508-rapid-whitelist-sandfly-hunter-process-path.png1690345508-rapid-whitelist-sandfly-hunter-process-path1690345508-rapid-whitelist-sandfly-hunter-process-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690347707-advanced-match-whitelist-attribute-selection-2.png1690347707-advanced-match-whitelist-attribute-selection-21690347707-advanced-match-whitelist-attribute-selection-2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter06-loose-match-whitelist-selection.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter06-loose-match-whitelist-selectionblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter06-loose-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter17-rapid-whitelist-sandfly-hunter-process-path-whitelist-summary.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter17-rapid-whitelist-sandfly-hunter-process-path-whitelist-summaryblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter17-rapid-whitelist-sandfly-hunter-process-path-whitelist-summaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690347642-advanced-match-whitelist-attribute-selection.png1690347642-advanced-match-whitelist-attribute-selection1690347642-advanced-match-whitelist-attribute-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter11-advanced-match-whitelist-attribute-selection.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter11-advanced-match-whitelist-attribute-selectionblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter11-advanced-match-whitelist-attribute-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346349-whitelist-example-alert.png1690346349-whitelist-example-alert1690346349-whitelist-example-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690411966-whitelist-host-scope.png1690411966-whitelist-host-scope1690411966-whitelist-host-scopehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690347835-advanced-match-whitelist-attribute-selection-finalize.png1690347835-advanced-match-whitelist-attribute-selection-finalize1690347835-advanced-match-whitelist-attribute-selection-finalizehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter04-rapid-whitelist-sandfly-hunter-process-path-detail.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter04-rapid-whitelist-sandfly-hunter-process-path-detailblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter04-rapid-whitelist-sandfly-hunter-process-path-detailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346589-loose-match-whitelist-details.png1690346589-loose-match-whitelist-details1690346589-loose-match-whitelist-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter05-rapid-whitelist-sandfly-hunter-process-notes.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter05-rapid-whitelist-sandfly-hunter-process-notesblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter05-rapid-whitelist-sandfly-hunter-process-noteshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter13-advanced-match-whitelist-attribute-selection-finalize.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter13-advanced-match-whitelist-attribute-selection-finalizeblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter13-advanced-match-whitelist-attribute-selection-finalizehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690346949-strict-match-whitelist-details.png1690346949-strict-match-whitelist-details1690346949-strict-match-whitelist-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter07-loose-match-whitelist-details.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter07-loose-match-whitelist-detailsblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter07-loose-match-whitelist-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter08-strict-match-whitelist-selection.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter08-strict-match-whitelist-selectionblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter08-strict-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690345566-rapid-whitelist-sandfly-hunter-process-notes.png1690345566-rapid-whitelist-sandfly-hunter-process-notes1690345566-rapid-whitelist-sandfly-hunter-process-noteshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter14-whitelist-host-scope.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter14-whitelist-host-scopeblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter14-whitelist-host-scopehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690407661-ssh-hunter-host-view.png1690407661-ssh-hunter-host-view1690407661-ssh-hunter-host-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690408239-credential-leak.png1690408239-credential-leak1690408239-credential-leakhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690348314-tag-bulk-hosts-entry.png1690348314-tag-bulk-hosts-entry1690348314-tag-bulk-hosts-entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1690348292-tag-bulk-hosts-select.png1690348292-tag-bulk-hosts-select1690348292-tag-bulk-hosts-selecthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter16-tag-bulk-hosts-entry.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter16-tag-bulk-hosts-entryblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter16-tag-bulk-hosts-entryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter09-strict-match-whitelist-details.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter09-strict-match-whitelist-detailsblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter09-strict-match-whitelist-detailshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter10-advanced-match-whitelist-selection.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter10-advanced-match-whitelist-selectionblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter10-advanced-match-whitelist-selectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1658984030-thumbnail-generic-1.png1658984030-thumbnail-generic-11658984030-thumbnail-generic-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%204.6.0%20-%20Advanced%20Whitelisting%20and%20Free%20SSH%20Hunter/blog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter19-credential-leak.pngblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter19-credential-leakblog-imagessandfly-4-6-0-advanced-whitelisting-and-free-ssh-hunter19-credential-leak2026-09-28https://sandflysecurity.com/blog/sandfly-1-4-4-mind-your-pidnesshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-hidden-subdir-process.png1635216293-hidden-subdir-process1635216293-hidden-subdir-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/platform/device-and-appliance-securityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-22https://sandflysecurity.com/why-sandfly/case-studies/ecogyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/energy.pngenergyenergyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/sandfly-5-6-automatic-drift-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/de-cloaking-linux-stealth-malware-and-rootkits-sedexp-diamorphine-and-reptilehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-4.png1712190688-thumbnail-generic-41712190688-thumbnail-generic-4https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking-1.png1728261226-thumbnail-root-kit-decloaking-11728261226-thumbnail-root-kit-decloaking-12026-09-28https://sandflysecurity.com/platform/incident-responsehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-18https://sandflysecurity.com/blog/de-cloaking-linux-stealth-rootkits-whitelisting-and-ui-updates-sandfly-1-4-releasedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216300-forensic-view-linux-stealth-rootkit-cloaked-data.png1635216300-forensic-view-linux-stealth-rootkit-cloaked-data1635216300-forensic-view-linux-stealth-rootkit-cloaked-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-reptile-rootkit-decloaked.png1635216293-reptile-rootkit-decloaked1635216293-reptile-rootkit-decloakedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216313-sandfly-listening-network-port-tmp.png1635216313-sandfly-listening-network-port-tmp1635216313-sandfly-listening-network-port-tmp2026-09-28https://sandflysecurity.com/blog/log4j-kinsing-linux-malware-in-the-wildhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639423732-kinsing-hidden-dir-dev-shm.png1639423732-kinsing-hidden-dir-dev-shm1639423732-kinsing-hidden-dir-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639422397-kinsing-suspicious-library.png1639422397-kinsing-suspicious-library1639422397-kinsing-suspicious-libraryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild04-kinsing-malicious-systemd.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild04-kinsing-malicious-systemdblog-imageslog4j-kinsing-linux-malware-in-the-wild04-kinsing-malicious-systemdhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild11-kinsing-hidden-dir-dev-shm.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild11-kinsing-hidden-dir-dev-shmblog-imageslog4j-kinsing-linux-malware-in-the-wild11-kinsing-hidden-dir-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639426387-kinsing-malicious-process-sandfly-hunter.png1639426387-kinsing-malicious-process-sandfly-hunter1639426387-kinsing-malicious-process-sandfly-hunterhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild07-kinsing-suspicious-library.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild07-kinsing-suspicious-libraryblog-imageslog4j-kinsing-linux-malware-in-the-wild07-kinsing-suspicious-libraryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639422360-kinsing-ld-preload-malicious-data-path.png1639422360-kinsing-ld-preload-malicious-data-path1639422360-kinsing-ld-preload-malicious-data-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild08-kinsing-malicious-network-connection.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild08-kinsing-malicious-network-connectionblog-imageslog4j-kinsing-linux-malware-in-the-wild08-kinsing-malicious-network-connectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild09-kinsing-malcious-process-tcpip-data.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild09-kinsing-malcious-process-tcpip-datablog-imageslog4j-kinsing-linux-malware-in-the-wild09-kinsing-malcious-process-tcpip-datahttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild01-kinsing-alerts.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild01-kinsing-alertsblog-imageslog4j-kinsing-linux-malware-in-the-wild01-kinsing-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild02-kinsing-malicious-cron.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild02-kinsing-malicious-cronblog-imageslog4j-kinsing-linux-malware-in-the-wild02-kinsing-malicious-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639422331-kingsing-ld-preload-non-empty.png1639422331-kingsing-ld-preload-non-empty1639422331-kingsing-ld-preload-non-emptyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild05-kingsing-ld-preload-non-empty.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild05-kingsing-ld-preload-non-emptyblog-imageslog4j-kinsing-linux-malware-in-the-wild05-kingsing-ld-preload-non-emptyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild10-kingsing-etc-kinsing-suspicious-binary.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild10-kingsing-etc-kinsing-suspicious-binaryblog-imageslog4j-kinsing-linux-malware-in-the-wild10-kingsing-etc-kinsing-suspicious-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639421818-kingsing-malicious-cron-raw.png1639421818-kingsing-malicious-cron-raw1639421818-kingsing-malicious-cron-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild06-kinsing-ld-preload-malicious-data-path.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild06-kinsing-ld-preload-malicious-data-pathblog-imageslog4j-kinsing-linux-malware-in-the-wild06-kinsing-ld-preload-malicious-data-pathhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639419406-kinsing-alerts.png1639419406-kinsing-alerts1639419406-kinsing-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Log4j%20Kinsing%20Linux%20Stealth%20Malware%20in%20the%20Wild/blog-imageslog4j-kinsing-linux-malware-in-the-wild03-kingsing-malicious-cron-raw.pngblog-imageslog4j-kinsing-linux-malware-in-the-wild03-kingsing-malicious-cron-rawblog-imageslog4j-kinsing-linux-malware-in-the-wild03-kingsing-malicious-cron-rawhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639423447-kingsing-etc-kinsing-suspicious-binary.png1639423447-kingsing-etc-kinsing-suspicious-binary1639423447-kingsing-etc-kinsing-suspicious-binaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639421780-kinsing-malicious-cron.png1639421780-kinsing-malicious-cron1639421780-kinsing-malicious-cronhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1637270429-incident-host-results-1.png1637270429-incident-host-results-11637270429-incident-host-results-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1639422704-kinsing-malicious-systemd.png1639422704-kinsing-malicious-systemd1639422704-kinsing-malicious-systemdhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/detecting-linux-memfd-create-fileless-malware-with-command-line-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217638-malware-recover-exe-1.png1635217638-malware-recover-exe-11635217638-malware-recover-exe-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217609-malware-comm-cmdline-mismatch.png1635217609-malware-comm-cmdline-mismatch1635217609-malware-comm-cmdline-mismatchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217619-malware-maps.png1635217619-malware-maps1635217619-malware-mapshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217631-malware-environ.png1635217631-malware-environ1635217631-malware-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217644-malware-sandfly-list.png1635217644-malware-sandfly-list1635217644-malware-sandfly-listhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217568-malware-grep-memfd-deleted.png1635217568-malware-grep-memfd-deleted1635217568-malware-grep-memfd-deletedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217599-malware-proc-ls-listing.png1635217599-malware-proc-ls-listing1635217599-malware-proc-ls-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1743104493-bincrypter-man.jpg1743104493-bincrypter-man1743104493-bincrypter-manhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217589-malware-ps.png1635217589-malware-ps1635217589-malware-pshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217578-malware-netstat.png1635217578-malware-netstat1635217578-malware-netstathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217625-malware-environ.png1635217625-malware-environ1635217625-malware-environhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635217558-malware-ssh-execution.png1635217558-malware-ssh-execution1635217558-malware-ssh-execution2026-09-28https://sandflysecurity.com/blog/sandfly-2-4-0-splunk-support-reconnaissance-process-injection-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-recon-sandflies.png1635216293-recon-sandflies1635216293-recon-sandflieshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216329-default-process-network-operating.png1635216329-default-process-network-operating1635216329-default-process-network-operatinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-splunk-sandfly-dashboard.png1635216301-splunk-sandfly-dashboard1635216301-splunk-sandfly-dashboardhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216313-splunk-search-sha1-process-hash.png1635216313-splunk-search-sha1-process-hash1635216313-splunk-search-sha1-process-hashhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216321-sandfly-process-injection.png1635216321-sandfly-process-injection1635216321-sandfly-process-injectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/1000-to-1-rule-of-intrusion-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/advantages-of-agentless-edr-for-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784863456-typhoon-image-cropped.png1784863456-typhoon-image-cropped1784863456-typhoon-image-croppedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1767737702-advantages-of-agentless-linux-edr-graphic.png1767737702-advantages-of-agentless-linux-edr-graphic1767737702-advantages-of-agentless-linux-edr-graphichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/risky-business-snake-oilers-interview-with-sandfly-securityhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426305-thumbnail-reverse-shell-forensics.png1733426305-thumbnail-reverse-shell-forensics1733426305-thumbnail-reverse-shell-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-1-1-4-updateshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-updatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update05-linux-executable-masquerading-attack.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update05-linux-executable-masquerading-attackblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update05-linux-executable-masquerading-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update04-pid-is-not-an-integer.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update04-pid-is-not-an-integerblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update04-pid-is-not-an-integerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216318-pid-is-not-an-integer.png1635216318-pid-is-not-an-integer1635216318-pid-is-not-an-integerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update06-suspicious-executable-under-etc.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update06-suspicious-executable-under-etcblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update06-suspicious-executable-under-etchttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update01-high-entropy-pid-file-alert.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update01-high-entropy-pid-file-alertblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update01-high-entropy-pid-file-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216301-pid-file-is-too-large-alert.png1635216301-pid-file-is-too-large-alert1635216301-pid-file-is-too-large-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update03-pid-file-is-an-executable.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update03-pid-file-is-an-executableblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update03-pid-file-is-an-executablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216311-pid-file-is-an-executable.png1635216311-pid-file-is-an-executable1635216311-pid-file-is-an-executablehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-high-entropy-pid-file-alert.png1635216293-high-entropy-pid-file-alert1635216293-high-entropy-pid-file-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216352-linux-executable-masquerading-attack.png1635216352-linux-executable-masquerading-attack1635216352-linux-executable-masquerading-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216359-suspicious-executable-under-etc.png1635216359-suspicious-executable-under-etc1635216359-suspicious-executable-under-etchttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Linux%20File%20Masquerading%20and%20Malicious%20PIDs%20Sandfly%20126%20Update/blog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update02-pid-file-is-too-large-alert.pngblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update02-pid-file-is-too-large-alertblog-imageslinux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update02-pid-file-is-too-large-alert2026-09-28https://sandflysecurity.com/blog/deleted-process-binary-attack-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1736976890-video-thumb-hidden-linux-binary-threats.png1736976890-video-thumb-hidden-linux-binary-threats1736976890-video-thumb-hidden-linux-binary-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734638383-video-thumb-linux-process-running-from-ram-disk-attack.png1734638383-video-thumb-linux-process-running-from-ram-disk-attack1734638383-video-thumb-linux-process-running-from-ram-disk-attackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1734638370-video-thumb-deleted-process-binary-attack-on-linux.png1734638370-video-thumb-deleted-process-binary-attack-on-linux1734638370-video-thumb-deleted-process-binary-attack-on-linux2026-09-28https://sandflysecurity.com/blog/christchurch-hacker-con-2017-linux-forensics-slideshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/webinar-5-linux-security-blind-spots-putting-government-agencies-at-riskhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1775695829-5-linux-security-blind-spots-webinar_fb-li.jpg1775695829-5-linux-security-blind-spots-webinar_fb-li1775695829-5-linux-security-blind-spots-webinar_fb-lihttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1775668639-5-linux-security-blind-spots-webinar_tw.jpg1775668639-5-linux-security-blind-spots-webinar_tw1775668639-5-linux-security-blind-spots-webinar_twhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1747098840-sysk-sandfly-696x464.webp1747098840-sysk-sandfly-696x4641747098840-sysk-sandfly-696x464https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-2-7-2-performance-updatehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM2026-09-28https://sandflysecurity.com/blog/sandfly-5-4-cisco-and-juniper-network-device-supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745358617-juniper-os-view.png1745358617-juniper-os-view1745358617-juniper-os-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745338340-sandfly_5-4-cisco-juniper.png1745338340-sandfly_5-4-cisco-juniper1745338340-sandfly_5-4-cisco-juniperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745346762-tinyshell-backdoor.png1745346762-tinyshell-backdoor1745346762-tinyshell-backdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking.png1728261226-thumbnail-root-kit-decloaking1728261226-thumbnail-root-kit-decloakinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/sandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics04-process-ngrep-sniffer-masquerading.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics04-process-ngrep-sniffer-masqueradingblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics04-process-ngrep-sniffer-masqueradinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216331-sandfly-custom-packet-sniffer-detection.png1635216331-sandfly-custom-packet-sniffer-detection1635216331-sandfly-custom-packet-sniffer-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics01-process-masquerading-sniffer-1.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics01-process-masquerading-sniffer-1blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics01-process-masquerading-sniffer-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216323-process-ngrep-sniffer-masquerading.png1635216323-process-ngrep-sniffer-masquerading1635216323-process-ngrep-sniffer-masqueradinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics05-sandfly-custom-packet-sniffer-detection.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics05-sandfly-custom-packet-sniffer-detectionblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics05-sandfly-custom-packet-sniffer-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics06-process-apache-open-file-descriptors.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics06-process-apache-open-file-descriptorsblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics06-process-apache-open-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216305-process-tcpdump-running.png1635216305-process-tcpdump-running1635216305-process-tcpdump-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216316-process-sniffer-hidden-name.png1635216316-process-sniffer-hidden-name1635216316-process-sniffer-hidden-namehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics02-process-tcpdump-running.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics02-process-tcpdump-runningblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics02-process-tcpdump-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216340-process-apache-open-file-descriptors.png1635216340-process-apache-open-file-descriptors1635216340-process-apache-open-file-descriptorshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216348-linux-kernel-thread-masquerading-detection.png1635216348-linux-kernel-thread-masquerading-detection1635216348-linux-kernel-thread-masquerading-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics07-linux-kernel-thread-masquerading-detection.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics07-linux-kernel-thread-masquerading-detectionblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics07-linux-kernel-thread-masquerading-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216293-process-masquerading-sniffer-1.png1635216293-process-masquerading-sniffer-11635216293-process-masquerading-sniffer-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%202.3.2%20%E2%80%93%20Linux%20Packet%20Sniffer%20Detection%20and%20Faster%20Process%20Forensics/blog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics03-process-sniffer-hidden-name.pngblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics03-process-sniffer-hidden-nameblog-imagessandfly-2-3-2-linux-packet-sniffer-detection-and-faster-process-forensics03-process-sniffer-hidden-namehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/hunting-linux-implants-agentlessly-at-locked-shields-2026https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1781475762-nato-locked-shields.png1781475762-nato-locked-shields1781475762-nato-locked-shieldshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745338340-sandfly_5-4-cisco-juniper.png1745338340-sandfly_5-4-cisco-juniper1745338340-sandfly_5-4-cisco-juniperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728971541-thumbnail-rob-joyce-interview.png1728971541-thumbnail-rob-joyce-interview1728971541-thumbnail-rob-joyce-interviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/blog/how-linux-malware-works-from-simple-to-sophisticatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1781288662-linux-malware-simple-to-sophisticated.png1781288662-linux-malware-simple-to-sophisticated1781288662-linux-malware-simple-to-sophisticated2026-09-28https://sandflysecurity.com/blog/bpfdoor-coverage-in-bleeping-computerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/sandfly-5-1-1-important-performance-upgrade-and-yescrypt-supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1723695502-screenshot-2024-08-15-at-4-13-53-pm.png1723695502-screenshot-2024-08-15-at-4-13-53-pm1723695502-screenshot-2024-08-15-at-4-13-53-pmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-4.png1712190688-thumbnail-generic-41712190688-thumbnail-generic-4https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1723695686-screenshot-2024-08-15-at-4-21-00-pm.png1723695686-screenshot-2024-08-15-at-4-21-00-pm1723695686-screenshot-2024-08-15-at-4-21-00-pmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.1.1%20-%20Important%20Performance%20Upgrade%20and%20Yescrypt%20Support/blog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support02-tracer-pid-running.pngblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support02-tracer-pid-runningblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support02-tracer-pid-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.1.1%20-%20Important%20Performance%20Upgrade%20and%20Yescrypt%20Support/blog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support01-screenshot-2024-08-15-at-4-21-00-pm.pngblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support01-screenshot-2024-08-15-at-4-21-00-pmblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support01-screenshot-2024-08-15-at-4-21-00-pmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1723672768-tracer-pid-running.png1723672768-tracer-pid-running1723672768-tracer-pid-runninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.1.1%20-%20Important%20Performance%20Upgrade%20and%20Yescrypt%20Support/blog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support03-screenshot-2024-08-15-at-4-13-53-pm.pngblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support03-screenshot-2024-08-15-at-4-13-53-pmblog-imagessandfly-5-1-1-important-performance-upgrade-and-yescrypt-support03-screenshot-2024-08-15-at-4-13-53-pm2026-09-28https://sandflysecurity.com/resources/digitalocean-cloud-deploymenthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1747867092-do_logo_horizontal_white.svg1747867092-do_logo_horizontal_white1747867092-do_logo_horizontal_whitehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/hunting-for-embedded-linux-systems-threatshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651627046-embedded-host-architecture.png1651627046-embedded-host-architecture1651627046-embedded-host-architecturehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651627055-embedded-host-view-1.png1651627055-embedded-host-view-11651627055-embedded-host-view-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651627055-embedded-host-view.png1651627055-embedded-host-view1651627055-embedded-host-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1651627067-embedded-host-details.png1651627067-embedded-host-details1651627067-embedded-host-details2026-09-28https://sandflysecurity.com/blog/sandfly-security-partners-with-digitaloceanhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733861103-risky-business-snake-oilers-sandfly-security-thumb-1.png1733861103-risky-business-snake-oilers-sandfly-security-thumb-11733861103-risky-business-snake-oilers-sandfly-security-thumb-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1772142934-sandfly-ericsson-1200-x-675-social.png1772142934-sandfly-ericsson-1200-x-675-social1772142934-sandfly-ericsson-1200-x-675-socialhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/linux-default-user-password-attack-detection-and-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426336-thumbnail-no-login-shell-rename-attacks.png1733426336-thumbnail-no-login-shell-rename-attacks1733426336-thumbnail-no-login-shell-rename-attackshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426382-thumbnail-default-user-password-attack.png1733426382-thumbnail-default-user-password-attack1733426382-thumbnail-default-user-password-attack2026-09-28https://sandflysecurity.com/blog/linux-stealth-rootkit-process-decloaking-tool-sandfly-processdecloakhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216313-module-mismatch.png1635216313-module-mismatch1635216313-module-mismatchhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216294-reptile-decloak.png1635216294-reptile-decloak1635216294-reptile-decloakhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1668993564-process-decloak-backdoor-found.png1668993564-process-decloak-backdoor-found1668993564-process-decloak-backdoor-foundhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/immutable-file-attack-persistence-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733425718-thumbnail-obsolete-password-hashes.png1733425718-thumbnail-obsolete-password-hashes1733425718-thumbnail-obsolete-password-hasheshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426382-thumbnail-default-user-password-attack.png1733426382-thumbnail-default-user-password-attack1733426382-thumbnail-default-user-password-attack2026-09-28https://sandflysecurity.com/why-sandfly/case-studies/vays-remote-driving-fleethttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/teledrive_station.jpgteledrive_stationteledrive_stationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/vay_us.jpgvay_usvay_ushttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-18https://sandflysecurity.com/blog/sandfly-57-performance-upgradehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade04-syslog-config.pngblog-imagessandfly-57-performance-upgrade04-syslog-configblog-imagessandfly-57-performance-upgrade04-syslog-confighttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774482030-claud-api-support.png1774482030-claud-api-support1774482030-claud-api-supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774481600-host-view-limit.png1774481600-host-view-limit1774481600-host-view-limithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774486183-5-7-thumbnail-no-logo.png1774486183-5-7-thumbnail-no-logo1774486183-5-7-thumbnail-no-logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774485718-5-7-thumbnail.png1774485718-5-7-thumbnail1774485718-5-7-thumbnailhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade06-claud-api-support.pngblog-imagessandfly-57-performance-upgrade06-claud-api-supportblog-imagessandfly-57-performance-upgrade06-claud-api-supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774481917-server-settings.png1774481917-server-settings1774481917-server-settingshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade01-5-7-thumbnail-no-logo.pngblog-imagessandfly-57-performance-upgrade01-5-7-thumbnail-no-logoblog-imagessandfly-57-performance-upgrade01-5-7-thumbnail-no-logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774481871-syslog-config.png1774481871-syslog-config1774481871-syslog-confighttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade03-host-view-limit.pngblog-imagessandfly-57-performance-upgrade03-host-view-limitblog-imagessandfly-57-performance-upgrade03-host-view-limithttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade05-server-settings.pngblog-imagessandfly-57-performance-upgrade05-server-settingsblog-imagessandfly-57-performance-upgrade05-server-settingshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.7%20-%20Performance%20Upgrade/blog-imagessandfly-57-performance-upgrade02-process_backdoor_shell_no_loginuid_network.pngblog-imagessandfly-57-performance-upgrade02-process_backdoor_shell_no_loginuid_networkblog-imagessandfly-57-performance-upgrade02-process_backdoor_shell_no_loginuid_networkhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1754270867-fallback.png1754270867-fallback1754270867-fallbackhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1774484704-process_backdoor_shell_no_loginuid_network.png1774484704-process_backdoor_shell_no_loginuid_network1774484704-process_backdoor_shell_no_loginuid_network2026-09-28https://sandflysecurity.com/blog/linux-reverse-shell-detection-and-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1700002997-evasive-linux-malware-presentation-bpfdoor.png1700002997-evasive-linux-malware-presentation-bpfdoor1700002997-evasive-linux-malware-presentation-bpfdoorhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733426305-thumbnail-reverse-shell-forensics.png1733426305-thumbnail-reverse-shell-forensics1733426305-thumbnail-reverse-shell-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux.png1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linux1733781456-video-thumb-default-user-ssh-authorized-key-risks-on-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1750103401-tron-lightcycle-race-over-packets.jpg1750103401-tron-lightcycle-race-over-packets1750103401-tron-lightcycle-race-over-packetshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/blog/christchurch-hacker-con-linux-digital-forensics-videohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/sandfly-5-3-1-new-license-tiers-and-selinux-supporthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740348128-selinux-disabled-since-boot.png1740348128-selinux-disabled-since-boot1740348128-selinux-disabled-since-boothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745338340-sandfly_5-4-cisco-juniper.png1745338340-sandfly_5-4-cisco-juniper1745338340-sandfly_5-4-cisco-juniperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740349634-selinux-ssh-key-context-dev-shm.png1740349634-selinux-ssh-key-context-dev-shm1740349634-selinux-ssh-key-context-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.3.1%20-%20New%20License%20Tiers%20and%20SELinux%20Support/blog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support01-selinux-disabled-since-boot.pngblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support01-selinux-disabled-since-bootblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support01-selinux-disabled-since-boothttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.3.1%20-%20New%20License%20Tiers%20and%20SELinux%20Support/blog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support04-kovid-lkm-rootkit-detection.pngblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support04-kovid-lkm-rootkit-detectionblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support04-kovid-lkm-rootkit-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.3.1%20-%20New%20License%20Tiers%20and%20SELinux%20Support/blog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support03-selinux-ssh-key-context-dev-shm.pngblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support03-selinux-ssh-key-context-dev-shmblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support03-selinux-ssh-key-context-dev-shmhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740351998-ssh-port-forwarding.png1740351998-ssh-port-forwarding1740351998-ssh-port-forwardinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.3.1%20-%20New%20License%20Tiers%20and%20SELinux%20Support/blog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support05-ssh-port-forwarding.pngblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support05-ssh-port-forwardingblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support05-ssh-port-forwardinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Sandfly%205.3.1%20-%20New%20License%20Tiers%20and%20SELinux%20Support/blog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support02-selinux-unconfined-network-process.pngblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support02-selinux-unconfined-network-processblog-imagessandfly-5-3-1-new-license-tiers-and-selinux-support02-selinux-unconfined-network-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1737929316-sandfly-5-3-host-detailed-forensics.png1737929316-sandfly-5-3-host-detailed-forensics1737929316-sandfly-5-3-host-detailed-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1.png1740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-11740343878-sandfly-5-3-1-home-user-edition-selinux-stealth-rootkits-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740350705-kovid-lkm-rootkit-detection.png1740350705-kovid-lkm-rootkit-detection1740350705-kovid-lkm-rootkit-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740349400-selinux-unconfined-network-process.png1740349400-selinux-unconfined-network-process1740349400-selinux-unconfined-network-processhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM2026-09-28https://sandflysecurity.com/blog/detecting-linux-binary-file-poisoninghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Binary%20File%20Poisoning/blog-imagesdetecting-linux-binary-file-poisoning04-poisoned-linux-binary-sandfly-alert.pngblog-imagesdetecting-linux-binary-file-poisoning04-poisoned-linux-binary-sandfly-alertblog-imagesdetecting-linux-binary-file-poisoning04-poisoned-linux-binary-sandfly-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216314-poisoned-linux-binary-hidden-directory.png1635216314-poisoned-linux-binary-hidden-directory1635216314-poisoned-linux-binary-hidden-directoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216322-poisoned-linux-binary-sandfly-alert.png1635216322-poisoned-linux-binary-sandfly-alert1635216322-poisoned-linux-binary-sandfly-alerthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Binary%20File%20Poisoning/blog-imagesdetecting-linux-binary-file-poisoning02-poisoned-linux-binary-alarms.pngblog-imagesdetecting-linux-binary-file-poisoning02-poisoned-linux-binary-alarmsblog-imagesdetecting-linux-binary-file-poisoning02-poisoned-linux-binary-alarmshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Binary%20File%20Poisoning/blog-imagesdetecting-linux-binary-file-poisoning01-poison-bottle.jpgblog-imagesdetecting-linux-binary-file-poisoning01-poison-bottleblog-imagesdetecting-linux-binary-file-poisoning01-poison-bottlehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Linux%20Binary%20File%20Poisoning/blog-imagesdetecting-linux-binary-file-poisoning03-poisoned-linux-binary-hidden-directory.pngblog-imagesdetecting-linux-binary-file-poisoning03-poisoned-linux-binary-hidden-directoryblog-imagesdetecting-linux-binary-file-poisoning03-poisoned-linux-binary-hidden-directoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216304-poisoned-linux-binary-alarms.png1635216304-poisoned-linux-binary-alarms1635216304-poisoned-linux-binary-alarmshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimage2026-09-28https://sandflysecurity.com/blog/agentless-linux-edr-stopping-volt-and-salt-typhoon-in-ot-environmentshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1784863456-typhoon-image-cropped.png1784863456-typhoon-image-cropped1784863456-typhoon-image-croppedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1745338340-sandfly_5-4-cisco-juniper.png1745338340-sandfly_5-4-cisco-juniper1745338340-sandfly_5-4-cisco-juniperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1772142934-sandfly-ericsson-1200-x-675-social.png1772142934-sandfly-ericsson-1200-x-675-social1772142934-sandfly-ericsson-1200-x-675-socialhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1767737702-advantages-of-agentless-linux-edr-graphic.png1767737702-advantages-of-agentless-linux-edr-graphic1767737702-advantages-of-agentless-linux-edr-graphichttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-12026-09-28https://sandflysecurity.com/blog/rob-joyce-former-head-of-nsa-tailored-access-operations-joins-sandfly-advisoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1721601168-robjoyce_1658_2.jpg1721601168-robjoyce_1658_21721601168-robjoyce_1658_2https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1748472742-sandfly-do-2x-1.png1748472742-sandfly-do-2x-11748472742-sandfly-do-2x-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1643243329-results-by-host.png1643243329-results-by-host1643243329-results-by-host2026-09-28https://sandflysecurity.com/platform/ssh-key-monitoringhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/key-investigation.pngkey-investigationkey-investigationhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/host-violation-view.pnghost-violation-viewhost-violation-viewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/user-investigation.pnguser-investigationuser-investigation2026-09-18https://sandflysecurity.com/blog/defending-security-infrastructure-against-wild-weaselshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693778074-sandfly-malware-marketing-obfuscated-notated.png1693778074-sandfly-malware-marketing-obfuscated-notated1693778074-sandfly-malware-marketing-obfuscated-notatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693531021-jump-host-selection-drop-down.png1693531021-jump-host-selection-drop-down1693531021-jump-host-selection-drop-downhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels07-random-scheduler.pngblog-imagesdefending-security-infrastructure-against-wild-weasels07-random-schedulerblog-imagesdefending-security-infrastructure-against-wild-weasels07-random-schedulerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693530879-ssh-jump-hosts-mixing-virtual-tor.png1693530879-ssh-jump-hosts-mixing-virtual-tor1693530879-ssh-jump-hosts-mixing-virtual-torhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels06-binary-names.pngblog-imagesdefending-security-infrastructure-against-wild-weasels06-binary-namesblog-imagesdefending-security-infrastructure-against-wild-weasels06-binary-nameshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels02-sandfly-malware-marketing-obfuscated-notated.pngblog-imagesdefending-security-infrastructure-against-wild-weasels02-sandfly-malware-marketing-obfuscated-notatedblog-imagesdefending-security-infrastructure-against-wild-weasels02-sandfly-malware-marketing-obfuscated-notatedhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels01-wild-weasel.pngblog-imagesdefending-security-infrastructure-against-wild-weasels01-wild-weaselblog-imagesdefending-security-infrastructure-against-wild-weasels01-wild-weaselhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels05-jump-host-selection-drop-down.pngblog-imagesdefending-security-infrastructure-against-wild-weasels05-jump-host-selection-drop-downblog-imagesdefending-security-infrastructure-against-wild-weasels05-jump-host-selection-drop-downhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels03-adding-jump-host.pngblog-imagesdefending-security-infrastructure-against-wild-weasels03-adding-jump-hostblog-imagesdefending-security-infrastructure-against-wild-weasels03-adding-jump-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693524825-wild-weasel-1.png1693524825-wild-weasel-11693524825-wild-weasel-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693533112-random-scheduler.png1693533112-random-scheduler1693533112-random-schedulerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693531879-binary-names.png1693531879-binary-names1693531879-binary-nameshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1693530032-adding-jump-host.png1693530032-adding-jump-host1693530032-adding-jump-hosthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Defending%20Security%20Infrastructure%20Against%20Wild%20Weasels/blog-imagesdefending-security-infrastructure-against-wild-weasels04-ssh-jump-hosts-mixing-virtual-tor.pngblog-imagesdefending-security-infrastructure-against-wild-weasels04-ssh-jump-hosts-mixing-virtual-torblog-imagesdefending-security-infrastructure-against-wild-weasels04-ssh-jump-hosts-mixing-virtual-tor2026-09-28https://sandflysecurity.com/platform/threat-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/Images/dashboard.pngdashboarddashboard2026-09-18https://sandflysecurity.com/blog/sandfly-1-6-1-host-id-updates-and-other-fixeshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/ssh-lateral-movement-risks-on-linux-webinar-and-white-paperhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1740684197-video-thumb-ssh-risks-and-threats-webinar.png1740684197-video-thumb-ssh-risks-and-threats-webinar1740684197-video-thumb-ssh-risks-and-threats-webinarhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1783029184-agentless-edr-ai-are-a-powerful-combo.png1783029184-agentless-edr-ai-are-a-powerful-combo1783029184-agentless-edr-ai-are-a-powerful-combohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1741036373-linux-password-hash-security-overview.png1741036373-linux-password-hash-security-overview1741036373-linux-password-hash-security-overviewhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1739473747-thumbnail-obsolete-linux-password-hash-threats.png1739473747-thumbnail-obsolete-linux-password-hash-threats1739473747-thumbnail-obsolete-linux-password-hash-threats2026-09-28https://sandflysecurity.com/blog/using-linux-process-environment-variables-for-live-forensicshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216316-process-environ-strings-listing.png1635216316-process-environ-strings-listing1635216316-process-environ-strings-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20Process%20Environment%20Variables%20for%20Live%20Forensics/blog-imagesusing-linux-process-environment-variables-for-live-forensics03-process-environ-strings-listing.pngblog-imagesusing-linux-process-environment-variables-for-live-forensics03-process-environ-strings-listingblog-imagesusing-linux-process-environment-variables-for-live-forensics03-process-environ-strings-listinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216294-process-environ-attacker-prep.png1635216294-process-environ-attacker-prep1635216294-process-environ-attacker-prephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1635216306-process-envron-netstat.png1635216306-process-envron-netstat1635216306-process-envron-netstathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20Process%20Environment%20Variables%20for%20Live%20Forensics/blog-imagesusing-linux-process-environment-variables-for-live-forensics02-process-envron-netstat.pngblog-imagesusing-linux-process-environment-variables-for-live-forensics02-process-envron-netstatblog-imagesusing-linux-process-environment-variables-for-live-forensics02-process-envron-netstathttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Using%20Linux%20Process%20Environment%20Variables%20for%20Live%20Forensics/blog-imagesusing-linux-process-environment-variables-for-live-forensics01-process-environ-attacker-prep.pngblog-imagesusing-linux-process-environment-variables-for-live-forensics01-process-environ-attacker-prepblog-imagesusing-linux-process-environment-variables-for-live-forensics01-process-environ-attacker-prephttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-01-45-51-8420-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28https://sandflysecurity.com/blog/detecting-melofee-stealth-backdoor-targeting-redhat-linuxhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux06-melofee-kernel-module-drift-detection.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux06-melofee-kernel-module-drift-detectionblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux06-melofee-kernel-module-drift-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731541925-kworkerx-ls-sys-module-directory.png1731541925-kworkerx-ls-sys-module-directory1731541925-kworkerx-ls-sys-module-directoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux07-melofee-process-hidden.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux07-melofee-process-hiddenblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux07-melofee-process-hiddenhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731539830-melofee-kernel-module-hidden.png1731539830-melofee-kernel-module-hidden1731539830-melofee-kernel-module-hiddenhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1712190688-thumbnail-generic-4.png1712190688-thumbnail-generic-41712190688-thumbnail-generic-4https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux09-melofee-kernel-masquerade-alert-variant.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux09-melofee-kernel-masquerade-alert-variantblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux09-melofee-kernel-masquerade-alert-varianthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731540170-melofee-kernel-module-inconsistency.png1731540170-melofee-kernel-module-inconsistency1731540170-melofee-kernel-module-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux02-melofee-malware-sandfly-alerts.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux02-melofee-malware-sandfly-alertsblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux02-melofee-malware-sandfly-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731541232-melofee-kernel-masquerade-alerts.png1731541232-melofee-kernel-masquerade-alerts1731541232-melofee-kernel-masquerade-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM.png1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AM1770165159-sandfly-social-banners-1200x630_web-preview-Sep-14-2026-02-01-09-2102-AMhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux05-melofee-kernel-module-missing.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux05-melofee-kernel-module-missingblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux05-melofee-kernel-module-missinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731541027-melofee-process-hidden.png1731541027-melofee-process-hidden1731541027-melofee-process-hiddenhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731540558-melofee-kernel-module-missing.png1731540558-melofee-kernel-module-missing1731540558-melofee-kernel-module-missinghttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux04-melofee-kernel-module-inconsistency.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux04-melofee-kernel-module-inconsistencyblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux04-melofee-kernel-module-inconsistencyhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux08-melofee-kernel-masquerade-alerts.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux08-melofee-kernel-masquerade-alertsblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux08-melofee-kernel-masquerade-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731540755-melofee-kernel-module-drift-detection.png1731540755-melofee-kernel-module-drift-detection1731540755-melofee-kernel-module-drift-detectionhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux10-kworkerx-ls-sys-module-directory.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux10-kworkerx-ls-sys-module-directoryblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux10-kworkerx-ls-sys-module-directoryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731541303-melofee-kernel-masquerade-alert-variant.png1731541303-melofee-kernel-masquerade-alert-variant1731541303-melofee-kernel-masquerade-alert-varianthttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logohttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731545579-melofee-malware-sandfly-alerts.png1731545579-melofee-malware-sandfly-alerts1731545579-melofee-malware-sandfly-alertshttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1728261226-thumbnail-root-kit-decloaking-1.png1728261226-thumbnail-root-kit-decloaking-11728261226-thumbnail-root-kit-decloaking-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1731539030-virustotal-summary.png1731539030-virustotal-summary1731539030-virustotal-summaryhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/BLOG%20Detecting%20Melofee%20Stealth%20Backdoor%20Targeting%20Red%20Hat%20Linux/blog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux03-melofee-kernel-module-hidden.pngblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux03-melofee-kernel-module-hiddenblog-imagesdetecting-melofee-stealth-backdoor-targeting-redhat-linux03-melofee-kernel-module-hidden2026-09-28https://sandflysecurity.com/blog/sandfly-security-and-carahsoft-partnerhttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/SandflySecurity_September2026/image.pngimageimagehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo-1.pngSandfly Security Logo-1Sandfly Security Logo-1https://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Imported_Blog_Media/1773685960-sandfly-carahsoft-1200-x-675-social-blog-article.png1773685960-sandfly-carahsoft-1200-x-675-social-blog-article1773685960-sandfly-carahsoft-1200-x-675-social-blog-articlehttps://442867139.fs1.hubspotusercontent-ap1.net/hubfs/442867139/Sandfly%20Security%20Logo.pngSandfly Security LogoSandfly Security Logo2026-09-28