Hunting payloads in Linux extended file attributes
Автор: SANS Digital Forensics and Incident Response
Загружено: 2025-12-10
Просмотров: 361
Hunting payloads in Linux extended file attributes
Xavier Mertens, Freelance Cybersecurity Consultant - Xameco SRL
DFIR Prague 2025
Linux Extended File Attributes provide functionality similar to NTFS Alternate Data Streams (ADS). While often used for legitimate purposes, they can also be abused to conceal malicious content. Attackers may hide payloads, encrypted data, or other artifacts within these attributes —making detection and forensic analysis more challenging. This session will demonstrate both sides of the equation: How adversaries can hide a simple payload in extended attributes and how defenders can detect and investigate such misuse. Gain practical insights into the offensive and defensive techniques surrounding Linux extended attributes, to help you strengthen your hunting and incident response capabilities.
#cybercrime | #dfir
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
