Agentless Linux security. We post threat hunting, DFIR and hardening for people running Linux in production. No agents, no kernel modules.
Christchurch, New Zealand
Joined March 2017
- Tweets757
- Following55
- Followers3K
- Likes521
Sandfly Security retweeted
This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him.
Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.
Sandfly Security retweeted
A new #DestinationLinux has hit the road! 😂💖🐧🐧🐧
youtu.be/jQ03ujFAlNM
Black Hat Agentic AI Hype,
AI Guardrails Fall Short,
Linux Turns 35! 🎉 🐧
Valve Turns 30! 🥳
#Linux #podcast #opensource
#security #privacy
Thank you @SandflySecurity!
l1nq.com/b2fxk6a
Sandfly Security retweeted
I'll be out at Black Hat at our booth and talking Linux security. If you want to meet in-person check out the link below. Also, we are offering free and deeply discounted Pro and Home user licenses here for agentless Linux security monitoring.
Sandfly is heading to Black Hat at Startup City booth 6014. To celebrate, we're unlocking our Pro features for the entire community, whether you're meeting us at the show or monitoring your systems from home. Get a free 90 day pro license with no payment details required, 50% off Home User edition, or book a meeting. Offer good until August 8th. See more below.
ap1.hubs.ly/H016htG0
Sandfly Security retweeted
Sandfly will be at Black Hat in Vegas. Come by our booth to see our new agentless Linux response. We are also offering a no-obligation, and no credit card, 90 day trial of our Pro Version you can get right now. Learn more below and come meet us!
ap1.hubs.ly/H015Xm00
Sandfly Security retweeted
Our partnership with @SandflySecurity is bringing agentless Linux EDR to the Public Sector. Protect mission-critical systems without performance risk or agents. Learn more: carah.io/SandflySecurityPR #LinuxSecurity #EDR #PublicSectorCyber
Sandfly Security retweeted
This thing looks pretty noisy. @SandflySecurity we don't have an install path and can run under random binary names. Being targeted for disabling like other EDRs is harder. We also patrol randomly without a fixed username so the system appears unmonitored to attackers.
ShadowHS, a stealthy fileless Linux framework running entirely in memory for covert, adaptive post‑exploitation control.
Expanded EDR / AV fingerprinting
The payload performs aggressive EDR and AV discovery using both filesystem path checks and service-state enumeration. Compared to upstream hackshell, this variant significantly expands coverage to include commercial EDR platforms, cloud agents, OT/ICS tooling, and telemetry collectors.
P1 File Path-based EDR Detection
P2 Service-based EDR detection
cyble.com/blog/shadowhs-file…
Sandfly Security retweeted
We've gotten many questions about voidlink on Linux, and yes @SandflySecurity finds it out of the box as you see below with no need to update. The report below covers the details, but I have a few more here.
Check Point Research unveils #VoidLink, a highly modular Linux malware framework with 30+ plugins, cloud/container persistence, robust OPSEC (runtime encryption, rootkits, self-delete), and links to Chinese-affiliated actors. Full analysis on our blog
research.checkpoint.com/2026…
Sandfly Security retweeted
We have made major improvements to our unique and powerful agentless drift detection for Linux. With drift detection in operation, it's extremely hard for malicious activity happen on Linux without being noticed. Works on embedded/appliances, too!
Sandfly 5.6 introduces sweeping updates to our powerful agentless drift detection for Linux. Automated setup and built-in profile recommendations makes finding novel attacks against your entire Linux infrastructure fast and simple. See more below.
sandflysecurity.com/blog/san…
Sandfly Security retweeted
An interesting project on finding rootkits with timing methods. Attentive admins can actually see system impacts with stealth rootkits on Linux. I covered this idea in a much cruder way in a recent presentation. Top is no rootkit vs. rootkit on bottom with a find command.
This is nice - Detection of #Linux rootkit file hiding activities through analysis of shifts in kernel function execution times github.com/ait-aecid/rootkit…
Sandfly Security retweeted
It's a must-read if you run Linux infra on Droplets and want to deploy intrustion-detection w/o endpoint agents. 💯
Key Takeaways. 🗝️
🔐 Agentless Linux security with Sandfly—no endpoint install, no performance hit.
⚡ Instant setup via the DigitalOcean Marketplace 1-Click App, cutting deployment time from hours to minutes.
🛡️ Hardened architecture using service accounts, SSH keys, and DO Cloud Firewalls for layered security.
📡 Continuous, low-impact monitoring with automated scans and trickle mode.
📈 Scales easily across diverse Linux environments; watch Droplet count limits and choose the right Droplet size for best performance.
Sandfly Security retweeted
Folks at @SandflySecurity are amazing and equally amazing as their product!
Top quality articles and research!
In a world of AI slop, you should know all our articles on Linux malware are lovingly researched and hand-written to be accurate and helpful. If you want to learn more about Linux malware investigation without the AI grift, use this blog link:
sandflysecurity.com/blog/tag…
Sandfly Security retweeted
Linux attackers and malware work differently than what we see on Windows. I discuss some of these differences and why ignoring Linux security monitoring is a major mistake may organizations make.
In this episode of the @CloudSecPodcast, @SandflySecurity’s Founder & CEO unpacks their agentless approach, the role of AI in Linux defense, and why it’s time to rethink Linux security.
🎧 Listen here: bit.ly/4m9rMqT
Sandfly Security retweeted
A new #DestinationLinux has hit the road!
😂❤️🐧🐧🐧
tuxdigital.com/podcasts/dest…
Security Scoop with Sandfly Security!
Pebble Watch Returns,
Linux Turns 34 🎉
Jill, Ryan & Michael's 1st Linux distro
& More!
#Linux #SwitchtoLinux
Thank you @SandflySecurity!
destinationlinux.net/sandfly
Sandfly Security retweeted
@ThatTechKitten came up with a really slick update script for @SandflySecurity. Check it out below:
medium.com/@truvis.thornton/…
Sandfly Security retweeted
Another great write-up of enabling AI API access for @SandflySecurity. If you haven't tried our product yet with your favorite LLM, give it a go. Our Linux forensic data is extremely good which makes these systems really perform for incident and malware analysis.
I just published Sandfly Linux Security: Enabling and using AI Analysis — Using Gemini (Google), OpenAI ChatGPT… medium.com/p/sandfly-linux-s…
Sandfly Security retweeted
Playing with the Medusa stealth rootkit which is LD_PRELOAD style of hiding on Linux. If you think this kind of rootkit is on a box, you can easily poke around and de-cloak it by using a statically built version of busybox like shown here.
Sandfly Security retweeted
Our new AI Analysis feature is really cool. You can ask follow-up questions if you are confused and it can help guide you. Here I told it that I can't see the hidden directories with the "ls" command and it immediately suggested LD_PRELOAD rootkit at play.
Sandfly Security retweeted
Blog version of this for easier sharing:
sandflysecurity.com/blog/lin…
Sandfly Security retweeted
We have seen malware using XDG autostart for persistence as well. It will be targeting personal desktop machines to execute when the windows manager starts on login. @SandflySecurity checks these areas for suspicious activity.
This might be a niche persistence mechanism, but during an investigation, I stumbled upon the following file on a Linux server:
/home/<user>/.config/autostart/set_trusted.desktop
With the following content:
[Desktop Entry]
Encoding=UTF-8
Exec=/usr/bin/set_trusted.sh
Name=Set trusted
Comment=Set desktop file trusted
Terminal=false
OnlyShowIn=GNOME
Type=Application
X-GNOME-Autostart-enabled=true
Do you spot the "exec" command? An attacker could replace the legitimate path to the "set_trusted.sh" file with an arbitrary file, thereby (potentially?) gaining code execution whenever the user logs in.
I don't know how widespread that feature is, and how many distributions are supporting it (Nautilus?), but maybe it will come in handy for someone :)
Sandfly Security retweeted
Linux security in minutes with @SandflySecurity & DigitalOcean. 🕐☁️🔒
Now available as a Droplet 1-Click in the #DigitalOcean Marketplace, Sandfly Security's agentless Linux security platform is designed for safety & performance on all #Linux systems. 🔗 do.co/3Zl05mu