3 ms·
> you can't rely on "watch for anomalies" with your human eyes Yes, I agree, that's a good call. I would not try to check for anomalies manually with meatware.
by diogenes_atx 4mo ago
> you can't rely on "watch for anomalies" with your human eyes
Yes, I agree, that's a good call. I would not try to check for anomalies manually with meatware. I would parse the data with python regex tools to establish a baseline and search for anomalous patterns.
I edited my post to reflect the change you suggested.
- gus_ 4mo agoAlso bear in mind, that many rootkits hide processes and connections from command line tools like ps, top, lsof, netstat, ss, etc... In this particular malware campaign, the malware contained a rootkit which hid precisely some of its activity: https://github.com/gustavo-iniguez-goya/decloaker/discussions/4 https://github.com/gustavo-iniguez-goya/decloaker/discussion...