Record · corpus.blog/posts/01a0bdf4-0aa7-71fe-bec8-ba42c099ed0b

Investigating server compromises with cgroups: A Linux DFIR primer

Red Canary · published 13 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at redcanary.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 25
Words captured: 2,747

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

The detection engineer’s guide to Linux Read at the source ↗

redcanary.com

https://redcanary.com/blog/threat-detection/better-know-a-data-source/better-know-a-data-source-network-telemetry/

redcanary.com

https://www.freedesktop.org/software/systemd/man/latest/systemd.slice.html

freedesktop.org

https://www.freedesktop.org/software/systemd/man/latest/systemd.scope.html

freedesktop.org

https://redcanary.com/blog/threat-detection/better-know-a-data-source/logon-sessions/

redcanary.com

https://redcanary.com/blog/linux-security/edr-linux/

redcanary.com

https://opencontainers.org/

opencontainers.org

https://github.com/opencontainers/runtime-spec/blob/main/config-linux.md

github.com

https://kubernetes.io/docs/concepts/workloads/pods/pod-qos/

kubernetes.io

https://kubernetes.io/docs/setup/production-environment/container-runtimes/

kubernetes.io

https://falco.org/

falco.org

https://redcanary.com/products/security-data-lake/

redcanary.com

https://gist.github.com/rctgardner/5b69e0f5e87a19ba244cdfe50ce1664f

gist.github.com

https://falco.org/docs/getting-started/falco-kubernetes-quickstart/

falco.org

https://falco.org/docs/getting-started/falco-linux-quickstart/

falco.org

https://redcanary.com/products/linux-edr/

redcanary.com

https://falco.org/about/

falco.org

https://gist.github.com/rctgardner/b656764e622a1f712b6301448d9c7be5

gist.github.com

https://redcanary.com/blog/threat-detection/ebpf-for-security/

redcanary.com

https://docs.ebpf.io/linux/helper-function/bpf_get_current_cgroup_id/

docs.ebpf.io

https://docs.ebpf.io/linux/map-type/BPF_MAP_TYPE_CGRP_STORAGE/

docs.ebpf.io

https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/

bleepingcomputer.com

https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/

blog.talosintelligence.com

https://www.endorlabs.com/learn/teampcp-isnt-done

endorlabs.com

https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage

security.com