Security Weekly - A CRA Resource: Your Linux System Can Lie To You

On a compromised Linux or Unix system, an attacker may manipulate the tools and mechanisms investigators rely on. A command such as ps could potentially return altered information through modified binaries, hooked system calls, libraries, or kernel-level tampering.

If the utilities on disk cannot be trusted, neither can their view of the system. Bringing trusted binaries—or otherwise using independent collection mechanisms—can reduce that risk during investigation.

When investigating a potentially compromised Linux system, how much should you trust the tools already installed on it?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#LinuxSecurity #ThreatHunting #IncidentResponse #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec