RGROSEC
open-menucloseme
Home
About me
github linkedin
  • Linux Detection Engineering - The Grand Finale on Linux Persistence Mechanisms

    calendar Feb 25, 2025 · 1 min read · Detection Engineering Hunting Linux Persistence Elastic  ·
    Share on: twitter facebook linkedin copy
    Linux Detection Engineering - The Grand Finale on Linux Persistence Mechanisms

    In the fifth and final part of the Linux Persistence Detection Engineering series, we bring the journey to its grand finale by exploring some of the most obscure, creative, and complex persistence mechanisms. Building on the foundational concepts covered in previous publications, this final installment focuses on …


    Read More
  • Linux Detection Engineering - Approaching the Summit on Persistence Mechanisms

    calendar Feb 11, 2025 · 1 min read · Detection Engineering Hunting Linux Persistence Elastic  ·
    Share on: twitter facebook linkedin copy
    Linux Detection Engineering -  Approaching the Summit on Persistence Mechanisms

    In the fourth part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment delves into additional creative and complex methods adversaries use to maintain persistence on Linux …


    Read More
  • Linux Detection Engineering - A Continuation on Persistence Mechanisms

    calendar Jan 27, 2025 · 1 min read · Detection Engineering Hunting Linux Persistence Elastic  ·
    Share on: twitter facebook linkedin copy
    Linux Detection Engineering -  A Continuation on Persistence Mechanisms

    In the third part of the Linux Persistence Detection Engineering series, I continue exploring advanced Linux persistence techniques, expanding on the foundation set in previous publications. This latest installment dives into more creative and complex persistence methods, providing security researchers and defenders …


    Read More
  • Linux Detection Engineering - A sequel on persistence mechanisms

    calendar Aug 29, 2024 · 1 min read · Detection Engineering Hunting Linux Persistence Elastic  ·
    Share on: twitter facebook linkedin copy
    Linux Detection Engineering - A sequel on persistence mechanisms

    In this second part of the Linux Persistence Detection Engineering series, I explore the world of more advanced Linux persistence techniques. This part builds upon the knowledge obtained from the previous persistence blog dubbed "Linux Detection Engineering - A Primer on Persistence Mechanisms". This sequel …


    Read More
  • Linux Detection Engineering - A primer on persistence mechanisms

    calendar Aug 23, 2024 · 1 min read · Detection Engineering Hunting Linux Persistence Elastic  ·
    Share on: twitter facebook linkedin copy
    Linux Detection Engineering -  A primer on persistence mechanisms

    In this first installment of the Linux Persistence Detection Engineering series, I delve into Linux persistence mechanisms, exploring both common and complex techniques to enhance the knowledge of defenders and security researchers. I examine how these persistence methods operate, how to set them up, and most …


    Read More

Ruben Groenewoud

Security researcher at Elastic, writing about detection engineering, Linux security, and offensive security.
Read More

Featured Posts

  • Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
  • Hooked on Linux: Rootkit Detection Engineering
  • Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework
  • Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario
  • Linux & Cloud Detection Engineering - Getting Started with Defend for Containers (D4C)
  • Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft
  • Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective
  • Linux Detection Engineering - The Grand Finale on Linux Persistence Mechanisms

Recent Posts

  • Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
  • Hooked on Linux: Rootkit Detection Engineering
  • Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework
  • Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario
  • Linux & Cloud Detection Engineering - Getting Started with Defend for Containers (D4C)
  • Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft
  • Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective
  • Linux Detection Engineering - The Grand Finale on Linux Persistence Mechanisms

Categories

ELASTIC 18 DETECTION ENGINEERING 12 LINUX 12 MALWARE ANALYSIS 7 WALKTHROUGHS 7 PERSISTENCE 5 WEB APPLICATION HACKING 4 BINARY EXPLOITATION 2 PRIVILEGE ESCALATION 2 CVE 1

Tags

LINUX 25 ELASTIC 18 DETECTION ENGINEERING 12 HACK THE BOX 7 MALWARE ANALYSIS 7 HUNTING 5 PERSISTENCE 5 OWASP 4 WEBAPP 4 WINDOWS 4 BUFFER OVERFLOW 2 CONTAINERS 2 PRIVILEGE ESCALATION 2 ROOTKIT 2
All Tags
AUDITD1 BUFFER OVERFLOW2 CONTAINERS2 CVE1 DETECTION ENGINEERING12 ELASTIC18 HACK THE BOX7 HUNTING5 LINUX25 MALWARE ANALYSIS7 OWASP4 PERSISTENCE5 PRIVILEGE ESCALATION2 ROOTKIT2 WEBAPP4 WINDOWS4
[A~Z][0~9]
RGROSEC

Copyright  RGROSEC. All Rights Reserved

to-top