Andre Pawlowski

IT-security enthusiast. Maker. Member of @FluxFingers. Author of

[Craig Rowland - Agentless Linux Security @CraigHRowland]

Mission Impossible: Elite xz SSH backdoor used to access your network.

Mission Reality: Your org still has default accounts with easily guessed passwords all over.

[Andre Pawlowski @sqall01]

Never used it. But the idea for this "diff detection" between Linux hosts is amazing.

[Craig Rowland - Agentless Linux Security @CraigHRowland]

Here I use @SandflySecurity agentless drift detection on Linux to rapidly find a compromised host. It works like the diff command, but against any Linux host to show you what is different in seconds. It's like magic for IR teams.

[Andre Pawlowski @sqall01]

https://t.co/X54ES43WZM seems to be a good starting point to find reports. However, choosing which Linux malware is still "at random"

[Andre Pawlowski @sqall01]

Does anyone know a good resource to get detailed Linux malware reports (the behavior of the Linux malware on the host)? Any source I know focuses on Windows and just "googling" it gives me a lot of superficial (news) reports

[Andre Pawlowski @sqall01]

@curi0usJack @threadreaderapp unroll

[Andre Pawlowski @sqall01]

TIL: if you are searching for suspicious processes on a Linux host by looking if the /proc/<pid>/exe points to a deleted file, it can point to "/ (deleted)". Apperently the Linux kernel also spawns processes: https://t.co/tyPOavGVZs

[Craig Rowland - Agentless Linux Security @CraigHRowland]

Here is a quick way to find tainted Linux kernel modules that are not maliciously hiding:

cat /proc/modules | grep \(.*\)

Sample "malicious_module" is both out-of-tree and unsigned which would warrant a closer look.

[Andre Pawlowski @sqall01]

@CraigHRowland A generalized "firewall" device for sure. However, if the manufacturer of the medical device would adopt this infrastructure setting and build the "firewall" themselves and place them in front of their medical devices as the infrastructure setup, it would be easier.

[Andre Pawlowski @sqall01]

@CraigHRowland I have heard of research in the field that tried to place some kind of gateway before the network connection of the medical device as a "firewall" kind of thing. So you can still upgrade the "firewall" without breaking your FDA certification. But this was years ago...

[Andre Pawlowski @sqall01]

What are linux process environment variables you should take a closer look into if you find them for processes on your system?

I currently have in mind:

- HISTFILE (=/dev/null)
- HISTSIZE/HISTFILESIZE (=0)
- LD_PRELOAD
- SOCAT_*
- SSH_C* (if ppid=1 => left-over process)

[Tony Gore @nullg0re]

Dcsync without triggering traditional alerts?

https://t.co/9H97diYbjB

[Cooper @Ministraitor]

Kunai: Your New Threat Hunting Tool For Linux
- Quentin Jerome
https://t.co/ab8Ghsu6eO
#hacklu @hack_lu

[Eric Leblond @Regiteric]

Kunai is an open source sysmon "clone" developed in rust and based on eBPF (cc @alexei_ast) that has just been presented at #hacklu https://t.co/ASRDqHNrIL

[Andre Pawlowski @sqall01]

It is back. Contribute if you can to this nice project. And good to see that @gynvael's health is up for doing side projects again :)

[Hussein Muhaisen @husseinmuhaisen]

Come contribute an article to @pagedout_zine Issue #3 is in the making.

Stumbled upon something cool during your cybersecurity adventure? Nice! write a 1 pager about it.

Any questions -- reply below 👇

More information regarding article submission: https://t.co/v77SYCAjtF

[Andre Pawlowski @sqall01]

@LiveOverflow Can you paste the link to the video with these comments? I am curious what kind of video it is.

[Giuseppe `N3mes1s` @N3mes1s]

Pitfalls of relying on eBPF for security monitoring (and some solutions) from ⁦@trailofbits⁩

Very nice overview and production problem you could encountered creating a security solution based on ebpf. And even some bypass 😁 https://t.co/kW432PoHYd

[Andre Pawlowski @sqall01]

@SandflySecurity I found it actually quite hard to do so without console commands. I wrote something in C# and got the file size directly (FileInfo) and read the whole file and counted bytes (File.ReadAllText). Result was: C# could read the file with the data hidden by reptile 🤷‍♀️

[Craig Rowland - Agentless Linux Security @CraigHRowland]

Here's how to use simple Linux command line tools to investigate and de-cloak Reptile stealth rootkit and others like it.

grep . /etc/modules
dd count=10000 bs=1 if=/etc/modules 2>/dev/null
cat /etc/modules | wc -c

[Craig Rowland - Agentless Linux Security @CraigHRowland]

Finally, check that the kernel and filesystem byte counts match. Feeding the file through a simple "wc -c" command will count the bytes the filesystem thinks is present. If these values don't match, something is hiding.

cat /etc/modules | wc -c

[Jose Enrique Hernandez @_josehelps]

Hey, infosec brains trust! 🧠 Ever felt like you're juggling digital chainsaws? 🪚💻 I've been in the trenches with:

🔹#LOLBAS 🛠️: Your multi-tool for Windows. A treasure trove of Binaries, Scripts, and Libraries that adversaries may use to live off your land.

🔹#GTFOBINS ⚙️: Your field guide to Unix binaries, masterfully navigating through airtight local security restrictions.

🔹#LOLDRIVERS 🚀: A rogues' gallery of Windows drivers, exploited by adversaries to bypass security controls and wreak havoc.

These projects are more than just a catalog for abuses of the OS; they're a rich wellspring of intel and detection enrichment. 📚🔍 I'm curious, have you spun these into threat detection tools (sigma rules) or defenses? How did you automate the data collection process from these projects?

The million-dollar question 💰: Have you rolled up your sleeves and used all the LOL resources in https://t.co/u6tdIrcq8n by @br0k3ns0und, or just cherry-picked a few?

🔄🔒 #DefenseDIY #InfoSecJugglers #LOLBinLife