Cyberattacks on Linux systems are a growing concern for individual users and organizations alike. Although there are plenty of choices when it comes to tools for detecting and removing malware on Linux, some solutions offer better performance than others. Here are the top five free options that can help you secure your devices and infrastructure.
ANY.RUN
Proactive cybersecurity is the key to preventing infections. To implement this approach, using a malware sandbox like ANY.RUN for malware analysis of new and evolving threats and phishing attacks is essential.
By uploading files and links to this cloud-based service’s Linux virtual machines (VMs), you can quickly obtain a definitive verdict on their threat level without exposing your own system to risk.
ANY.RUN performs a comprehensive analysis of each sample, providing detailed information on:
- Malicious network and registry activity
- Malware-related processes
- Tactics, techniques, and procedures (TTPs)
- Indicators of compromise (IOCs)
The service gives you complete control over the VM, allowing you to interact with the infected system and obtain results where automated sandboxes fall short.
This feature is useful in various scenarios requiring user interaction, from checking a phishing link that requires manually solving a CAPTCHA to analyzing the contents of a password-protected archive.
A Suricata rule used for detecting Mirai in ANY.RUN
Just take a look at this analysis of an attack carried out by Mirai, one of the largest Linux botnets. ANY.RUN shows how the malware infects the device and establishes a connection with a command-and-control (C2) server to receive further instructions. The service detects botnet activity using Suricata rules, identifying the threat with tags and marking it as malicious.
Key benefits of ANY.RUN:
- Fast threat detection with first results within 40 seconds
- Free plan with access to unlimited analysis
- No infrastructure deployment or maintenance costs
- Shared space for teams
- Private mode for keeping uploaded data safe and secure
| Sign up for a free ANY.RUN account and analyze malicious files and links without limit. |
Linux Malware Detect
Linux Malware Detect (LMD) is a malware scanning tool made specifically for Linux systems. It has advanced detection capabilities, allowing users to identify a variety of common threats, such as trojans, rootkits, viruses, and other types of malicious programs.
The tool’s functionality is primarily based on threat signatures of common malware. LMD’s database gets regular updates with the latest malware variants. It is also equipped with a heuristic analysis mechanism for finding unknown threats by checking the presence of any suspicious behavior.
Cybersecurity professionals employ LMD to detect possible compromise by performing file integrity checks to track alterations to system files. One of the useful features of the tool is reports, which are generated after every analysis session that provide information about possible threats.
Key benefits of Linux Malware Detect:
- Extensive database of the latest signatures
- Automatic updates
- Easy-to-use
- Integration with other security tools (e.g., ClamAV)
Rootkit Hunter (rkhunter)
Rootkit Hunter is one of the simplest tools for scanning Linux-based servers for potential vulnerabilities, such as backdoors or rootkit activity. It conducts several operations, including checking if the system contains any files associated with malicious software using MD5 hashes. It also looks for suspicious strings in LKM and KLD modules.
Rootkit Hunter’s ability to compare the outputs of ‘ps’ command with ‘/proc’ directory makes it an invaluable tool for detecting hidden processes that are widely utilized by rootkits as a means of evasion. The tool is equally useful for exposing network-based attacks.
Reports generated by Rootkit Hunter offer valuable insights into the nature of any detected threats.
Key benefits of Rootkit Hunter:
- File and system integrity checking
- Regular updates to detect the latest threats
- Detailed logs for further analysis
OSSEC
OSSEC belongs to another class of cybersecurity tools, an intrusion detection system (IDS), available on several platforms, including Linux and Windows. It enables users to perform comprehensive log analysis, detect rootkits, set up time-based alerts, and facilitate incident response.
This host-based tool can notify users of any threats or compromises in real time, including multiple login attempts, system files manipulation, and suspicious network traffic. OSSEC can be configured to automatically block IPs, kill processes, and perform other actions to address security risks.
Key benefits of OSSEC:
- Real-time event correlation
- Policy monitoring for compliance
- Active response to incidents
Chkrootkit
Chkrootkit is another vulnerability scanner that lets you check for signs of a rootkit on Linux servers. It relies on several methods to conduct analysis, including detecting rootkit modification, suspicious directories, and comparing system commands’ outputs. Thanks to its simple command-line interface, the tool can be easily used for routine security checks.
Key benefits of Chkrootkit:
- Signatures for over 70 popular rootkits
- Free open-source project
- Regular updates
Conclusion
While these tools can help you detect and remove malware, they should be part of a broader security strategy that includes regular updates, best security practices, and regular backups. By taking these steps, you can ensure that your Linux system remains secure and resilient against malware threats.
