i think ss and netstat just look at procfs gonna see how osq

Question

i think ss and netstat just look at procfs gonna see how osquery does it

blink · Answer

so osquery does the same parses procfs so it seems like the rootkit only patches the utilities and not the kernel

blink · Answer

``` family 2 fd 3 local address 45 55 41 97 local port 22 net namespace 4026531957 path pid 29831 protocol 6 remote address 128 199 169 146 remote port 42266 socket 32357509 state ESTABLISHED ```

blink · Answer

That remote address is on a list of known malicious hosts

zwass · Answer

yikes

blink · Answer

no activity in var log auth or in `who` `last`