{"id":12528,"date":"2025-04-02T13:21:17","date_gmt":"2025-04-02T13:21:17","guid":{"rendered":"\/cybersecurity-blog\/?p=12528"},"modified":"2025-04-02T13:21:18","modified_gmt":"2025-04-02T13:21:18","slug":"how-to-hunt-and-investigate-linux-malware","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-to-hunt-and-investigate-linux-malware\/","title":{"rendered":"How to Hunt and Investigate Linux Malware\u00a0"},"content":{"rendered":"\n

Linux<\/a> cyber threats may be less common than Windows ones, but they can be equally if not more damaging. Defending against these requires proactive efforts. <\/p>\n\n\n\n

Eric Parker, a popular YouTube blogger and malware analyst, recently showed his approach<\/a> to investigating and collecting intelligence on Linux malware. <\/p>\n\n\n\n

Here is a recap of his video. <\/p>\n\n\n\n

How to find Linux malware in Threat Intelligence Lookup <\/h2>\n\n\n\n

TI Lookup<\/a> offers a centralized database of fresh IOCs, IOAs, and IOBs. It lets you search across threat data extracted from the latest malware and phishing samples analyzed by over 500,000 professionals and 15,000 companies around the globe<\/a> in ANY.RUN\u2019s Interactive Sandbox<\/a>. <\/p>\n\n\n\n

To start searching for Linux threats in TI Lookup, we can begin with the search query specifying the Ubuntu OS version used in the Interactive Sandbox. <\/p>\n\n\n\n

Here is the query:  <\/p>\n\n\n\n

os:\u201d22.04.2\u201d<\/a> <\/p>\n\n\n

\n
\"\"
TI Lookup displaying results for the query<\/em> <\/figcaption><\/figure><\/div>\n\n\n

Among the results, we can see shell scripts, malware, and can get an idea of what indicators of compromise there are.  <\/p>\n\n\n\n\n

\n\n

\nTry threat hunting with TI Lookup<\/span>
Get 50 trial requests to collect your first intel  \n<\/p>\n\n\nTry now\n<\/a>\n<\/div>\n\n\n\n