Blog

Why Agentless Security is Needed on Linux

Linux Security
Linux Forensics
August 20, 2018

When looking to secure Linux, you may be wondering: What is the main advantage of an agentless product like Sandfly over agent-based security solutions that exist? The answer is simple: It’s…

Linux Malware Cryptominer Detection and Forensics

Malware
Rootkits
Linux Forensics
Linux Security
July 25, 2018

This year we have seen a huge uptick in cryptomining malware against Linux servers. The usual attack vector is the following: A brute force attack against SSH accounts. Automated install of a pre…

The Pyramid of Pain and Sandfly

Linux Security
Linux Forensics
June 20, 2018

There is a great post called The Pyramid of Pain by David Blanco that details the six ways to cause adversaries the most trouble when attacking your network. The Pyramid of Pain is below: We’ve been…

Detecting Linux Binary File Poisoning

Malware
Rootkits
Linux Security
Linux Forensics
June 13, 2018

Let’s talk about Linux binary poisoning. Binary poisoning is tampering with a system command and replacing it with a malicious version. This can be a wholesale replacement with a new file designed to…

Christchurch Hacker Con 2017 Linux Forensics Slides

Linux Security
Linux Forensics
Presentations
May 29, 2018

The slides for Craig’s talk on command line Linux Forensics from the 2017 Christchurch Hacker Con can be found here: Christchurch Hacker Con 2017 Linux Digital Forensics Presentation The slides cover…

Linux Malware Persistence with Cron

Malware
Rootkits
Linux Security
Linux Forensics
May 01, 2018

If malware is anything at all, it’s persistent. On Linux, just like Windows, malware once loaded wants to stay loaded. On Windows systems this is usually done with a variety of registry mechanisms.…