3 ms·
When I read this (interesting) article, I was wondering whether there is any free or commercial tool for detecting those indicators of compromise on GNU/Linux m
by jonathanstrange 9y ago
When I read this (interesting) article, I was wondering whether there is any free or commercial tool for detecting those indicators of compromise on GNU/Linux machines. I know rootkithunter, but that seems to be fairly weak heuristically. Other tools like tripwire, on the other hand, are based on snapshots and hashes and only monitor changes.
I'd be interested in a tool that can indicate suspicious kernel modifications, USB drivers and other software that behaves in unusual ways without triggering tons of false positives and independently of any certificates or whether the software comes from a supposedly trusted repository. But AFAIK, there is not even a key logger detection tool for Linux.
- DyslexicAtheist 9y agofor production systems you could run the kernel under an apparmor profile. also mentioned in this awesome talk[1] [1] https://www.youtube.com/watch?v=346WmxQ5xtk https://www.youtube.com/watch?v=346WmxQ5xtk
- irundebian 9y agoI don't think that it makes sense in a technical point of view to try to observe something if an attacker has already compromised your kernel. As soon as this happens, there is nothing you can do, which is foolproof as long we don't have kernels which are separating privileges within the system. If you want to observer something you have to depend on a trust anchor. In most today systems you don't have a trust anchor when the kernel is compromised.
- deleted 9y ago[deleted]
- spydum 9y agosure, IOC monitoring can be done via osquery (free), or tanium ($$$). You just have to build your own ruleset to pickup IOCs. Linux has AV, and nextgen stuff like Cylance (works but super buggy, runs as a kernel module). You also have other HIDS, like bro, snort, and so on, but those mostly look for suspicious network traffic. Microsoft OMS has been making some plays here, it frequently flags unusually process execution for me (eg: Python running from an uncommon path or some such)
- debeers 9y agoYara is used to find file system artifacts https://virustotal.github.io/yara/ https://virustotal.github.io/yara/
- arca_vorago 9y agoLet me introduce you to ossec and syslog/rsyslog/syslog-ng along with the newfound power of systemd and some gpg fun, with a side of nftables.