Linux Threat Hunting - PSW #942
Summary
Paul Sedorian leads a technical segment on Linux threat hunting, detailing how attackers abuse startup services, systemd overrides, and legacy init scripts to hide indicators of compromise. He emphasizes the need to verify system integrity by comparing file hashes and using external binaries, as local utilities may be compromised. The discussion highlights that despite decades of knowledge, many organizations still fail to monitor these basic persistence mechanisms effectively. The episode also covers security news, including SonicWall zero-days, Cisco vulnerabilities, and a critical infras…
Listen ad-free on Castria