On 03/19/2014 09:01 AM, Johnny Hughes wrote: > On 03/19/2014 08:50 AM, Timothy Murphy wrote: >> SlashDot had an article today on a Linux server malware attack, >> <http://it.slashdot.org/story/14/03/18/2218237/malware-attack-infected-25000-linuxunix-servers>. >> >> I wonder if there is a simple test to see if a CentOS machine >> has been infected in this way? >> >> The article mentions Yara and Snort rules to test for this, >> but I wonder if there is something simpler? >> Alternatively, are there Yara or Snort packages for CentOS? >> ("Yum search" didn't seem to find anything.) >> >> >> > Look at this PDF: > > http://bit.ly/1qCEQFi > Specifically: 1. ssh -G and a couple of curl commands to check for a website issues .. in the section on IOC starting on page 57. Also, here is a git repo if/when the writers start changing the items: https://github.com/eset/malware-ioc
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
