Tech notes
seek to understand the question
  • Home
  • Posts
  • OSQuery
  • query-index
  • About
  • Privacy
  1. Home
  2. linux

Kenga3 Rootkit

OSquery
select * from file where path in ('/usr/include/. .');
View Full Query Details

Kernel Modules

OSquery
select * from kernel_modules;
View Full Query Details

Knark Installed

OSquery
select * from file where path in ('/proc/knark', '/dev/.pizda', '/dev/.pula', '/dev/.pula');
View Full Query Details

Ldp Worm

OSquery
select * from file where path in ('/dev/.kork', '/bin/.login', '/bin/.ps');
View Full Query Details

Lion Worm

OSquery
select * from file where path in ('/dev/.lib', '/dev/.lib/1iOn.sh', '/bin/mjy', '/bin/in.telnetd', '/usr/info/torn');
View Full Query Details

Loc Rookit

OSquery
select * from file where path in ('/tmp/xp', '/tmp/kidd0.c', '/tmp/kidd0');
View Full Query Details

Lrk Rootkit

OSquery
select * from file where path in ('/dev/ida/.inet');
View Full Query Details

Madalin Rootkit

OSquery
select * from file where path in ('/usr/include/icekey.h', '/usr/include/iceconf.h', '/usr/include/iceseed.h');
View Full Query Details

Maniac Rk

OSquery
select * from file where path in ('/usr/bin/mailrc');
View Full Query Details

Mithra`s Rootkit

OSquery
select * from file where path in ('/usr/lib/locale/uboot');
View Full Query Details
Previous 1 2 3 4 5… 7 Next

Recent Posts

  • Connect private network to AWS using ZeroTier
  • Using kitchen-salt for testing salt-formulas
  • RPM package creation for BRO IDS Deployments
  • Installing pf_ring on CentOS 7 using yum
  • Using a systemd.service file to control promiscuous mode automatically at boot

Platforms

  • darwin 32
  • linux 65
  • posix 21
  • windows 4

Categories

  • Linux 25
  • Logging 14
  • NSM 1
  • Open Source 3
  • OSquery 269
  • SaltStack 4
  • Security 15
  • Sys Admin 30
  • VMware 2

Archives

  • September 2019 1
  • August 2019 1
  • July 2018 2
  • February 2018 1
  • April 2017 1
  • January 2017 1
  • December 2016 8
  • June 2016 1
  • January 2016 5
  • February 2015 11

Post Series

  • Setting up a multi-tiered log infrastructure
  • Setup internal yum repositories for CentOS and RedHat Servers
© 2025 Tech notes. Generated with Hugo and a heavily modified Roadster theme.