fim-ebpf

FIM-eBPF: Monitoreo de Integridad de Archivos con eBPF Un programa eBPF ligero para monitorear eventos de creación y modificación de archivos en Linux. Esta herramienta aprovecha eBPF Extended Berkeley Packet Filter para rastrear operaciones de archivos directamente desde el kernel, proporcionand...

ZeroAccess Rootkit Latest in Line of x64 Malware to Appear

Never ones to be left behind as progress marches on, attackers are beginning to develop more and more tools aimed specifically at exploiting 64-bit machines. The latest entry into the field is an x64 version of the ZeroAccess rootkit, a nasty piece of malware that’s been circulating for some time...

Dissecting the ZeroAccess Rootkit

The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access t...