ebury detection commands

gistfile1.txt

# doc: https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf
# repo git: https://github.com/eset/malware-research/tree/master/ebury

url=https://raw.githubusercontent.com/eset/malware-research/master/ebury/detect_ebury.sh
curl -s $url > /tmp/detect_ebury.sh 
chmod +x /tmp/detect_ebury.sh

# disable ebury (environnement variable) or login with console (not SSH)
# Ebury, can mask it presence with login with SSH.
export LD_PRELOAD=
export H=1

# run Ebury detection script. Mainly based on socket presence
# - https://github.com/eset/malware-research/blob/master/ebury/detect_ebury.sh#L38
/tmp/detect_ebury.sh