dfir.chwriteupAbusing Linux fanotify for Anti-Forensics
Abusing Linux fanotify for anti-forensics: a privileged userspace process can use the fanotify API to deny other processes the right to open an otherwise normal file. Reads fail with EPERM even for root, while name, ownership, timestamps and permissions look ordinary, so a scanner that cannot open a file may report no detections without inspecting it. Defenders can find malicious fanotify groups and marks via /proc/<pid>/fdinfo, or acquire at the filesystem level instead of opening the pathname.
TL;DR Shows how a privileged Linux process uses fanotify to make files unreadable to scanners, and how to detect and bypass it.
Organisations named here
- InfoGuard Labs
Technologies named here
- Linux
- fanotify
Techniques named here
- Anti-forensics
- Abuse of fanotify for anti-forensics
- Filesystem-level acquisition
Concepts named here
- EPERM (Operation not permitted)
- fanotify
- Incomplete scan coverage
Related in Blue Team & Detection
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup