LINUX DETECTION ENGINEERING - A CONTINUATION ON PERSISTENCE MECHANISMS

Summary from the TLDR InfoSec newsletter

This blog post is part of a three part series from Elastic Security that covers various persistence mechanisms and utilizes PANIX, a custom-built Linux persistence tool. It goes in-depth on various techniques like Dynamic Linker Hijacking that exploit LD_PRELOAD and LD_LIBRARY_PATH to inject malicious libraries, Kernel Module Persistence, Web Shell persistence, and system account SSH backdoors. The post also provides key detection and mitigation strategies file, configuration monitoring, as well as examples of utilizing ElasticSearch and OSquery for hunting.