Regarding RAM, this is the most difficult part, and you may skip this part for the moment because it's more advanced. Running command from external host assures you it is being run at all in first place, and it's simple and efficient method in the end.
#Why does malwarebytes scan for rootkits by default software
Rundeck may be software to help you with this. with latest checksums calculated from git repo were are configs), run the check and return result. Such script can be run from external host which connects over ssh, uploads the generated script (e.g. Regarding filesystems, you can also use normal script to check for the consistency of the binaries (for example, using standard rpm or dpkg commands), and also check consistency of config files. But this is less useful, it would only detect hidden network connections, and if you search internet, you might find some helpful scripts already. outgoing tcp connections, which upon initial detection can be whitelisted if not malicious.Īnother easy way would be to run tcpdump, then netstat and run comparison. which packets you want to capture), these could be basically anything unusual but permitted, e.g. The only thing is you need to invent proper patters (e.g. It's cheap, easy, multi-purpose and effective. A lot of unusual traffic can be successfully detected not only related to hacking and that helps a lot. So for example, you can select patters for packets to raise alarm. Using ready-made software would be more efficient. If you want to try by yourself, try setting up Netflow (sflow) monitoring and with just this, you can successfully detect malicious traffic when it happens. However, there can be done some trade-offs, you might want to evaluate some software to do some of it, and then it may be easier to do, see below.
Also if these servers run various things and are not the same kind of server. a lot of servers, let's say, 10.000 of them or more, that would make sense. Now the problem is, since it's quite custom job, you won't be able to really rely on the results before sufficient time and money are spent on the development of such solution, so it works, but on large scale, e.g.
0 kommentar(er)
