BPFDoor Evasive Linux Backdoor and Malware Forensic Investigation Presentation

This is a presentation on evasive Linux malware featuring BPFDoor given at the Oslo FIRST Cold Incident Response Conference in Norway. This presentation will use BPFDoor as an example of how to investigate evasive Linux malware using command line forensics and investigation techniques. BPFDoor was a professional piece of malware showing that you don't need to use elaborate stealth rootkit techniques to be effective. Simple and evasive hiding methods can take you a long way on Linux and allow sophisticated malware to hide very effectively and persist. This presentation discusses these elements of BPFDoor and what makes a piece of malware professional vs. amateur in execution. Sandfly's agentless intrusion detection and incident response platform for Linux easily finds BPFDoor operating. Please see our website for a free license to check your systems today instantly. Be sure to subscribe and follow us: https://www.sandflysecurity.com   / sandflysecurity     / sandfly