3 ms·
I'm not familiar with the state-of-the-art in Linux EDRs but I assumed checking LD_PRELOAD was table stakes.
by Retr0id 1y ago
I'm not familiar with the state-of-the-art in Linux EDRs but I assumed checking LD_PRELOAD was table stakes.
- nathan_naveen 1y agoYeah... we thought the same thing but we checked a couple other EDRs and saw that a few of them don't do this. If you guys know some EDRs that do this, let us know :)
- bpt3 1y agoWhat did you check? Nearly every EDR product does this to my knowledge.
- nathan_naveen 1y agoKubeArmor...
- bpt3 1y agolol, ok. That's not really an EDR product, and it's open source (which generally produces poor quality security tools, see ClamAV as a long-running joke). I can't think of a commercial Linux EDR product that doesn't monitor /etc/ld.so.conf and the alternatives.
- gabriel 1y agoI would back it up a little bit and say that any EDR thing would be capable of observing the source of the functions that a program will run and detect outliers. It's a great program to write, everyone should give it a try! It can also be unexpectedly complicated to get all of the corner cases right and you'll drive yourself mad once you try to think of the ways your detection method can be circumvented.