Why You Must Monitor Linux for Signs of Intruders
When Sandfly Founder Craig Rowland was brought in to do his first penetration test many years ago, one of the first systems he broke into was a Unix system that had an uptime of four …
Hunting for Linux Intrusion Tactics is Better than Searching for Exploit Signatures
When the NSA and CIA source code leaked a couple years back, Sandfly founder Craig Rowland ignored the zero day attacks they had and studied their tactics in the code instead. In this video he’ll …
READ MOREHunting for Linux Intrusion Tactics is Better than Searching for Exploit Signatures
Ninjas on Rooftops – A Better Approach to Linux Threat Hunting
Intrusion detection thought for the day: Someone trying to hide is a signature. In this video, Sandfly founder Craig Rowland discusses why hunting for hiding tactics vs. specific exploit signatures is an effective way to …
READ MORENinjas on Rooftops – A Better Approach to Linux Threat Hunting
Why You Should Be Searching for Linux Anti-Forensics
In this video Sandfly founder Craig Rowland discusses the importance of searching for Linux anti-forensic techniques on hosts you are protecting. Anti-forensics are techniques many intruders and malware use on Linux hosts to conceal their …
READ MOREWhy You Should Be Searching for Linux Anti-Forensics
1000 to 1 Rule of Intrusion Detection
This is the first in an ongoing series of short videos on topics around intrusion detection, Linux security, digital forensics, malware and anything else Sandfly Founder Craig Rowland finds interesting. Be sure to subscribe to …
Sandfly 1.6.1 – Host ID Updates and Other Fixes
Sandfly 1.6.1 is released and has some important updates. Install Simplified The install procedure for Sandfly has been greatly simplified. You now need to run one script on the server and enter some basic information …
Sandfly 1.6.0 – 200 Sandflies!
Sandfly 1.6.0 is now available. We now have 200 sandfly checks covering a wide range of Linux rootkit, malware and intrusion detection. Our agentless approach is fast and extensive in investigating threats against Linux. Here …
Sandfly 1.5.0 Released – Enhanced Linux Process Forensics, Rootkit and Network Sniffer Hunting
Sandfly 1.5.0 has been released with many new detection methods for Linux rootkits, malware and suspicious activity. The latest update expands on our already thorough intrusion detection and threat hunting net for Linux. This version …
Command Line Compromise Detection for Linux Cheat Sheet
Below is our command line compromise detection for Linux cheat sheet and presentation given at Purplecon 2018: Linux Compromise Detection Command Cheat Sheet Linux Compromise Detection Presentation Linux Compromise Detection Video The presentation and cheat …
READ MORECommand Line Compromise Detection for Linux Cheat Sheet