Re:Google Chrome Keystone is modifying /var symlink on non S...
by universenz on Wednesday September 25, 2019 @02:38PM
(#21073794)
You should check out BlockBlock[1] by the cool dudes at Objective-See..
"Malware installs itself persistently, to ensure it's automatically re-executed at reboot. BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS."
"Malware installs itself persistently, to ensure it's automatically re-executed at reboot. BlockBlock continually monitors common persistence locations and displays an alert whenever a persistent component is added to the OS."
[1] https://www.objective-see.com/products/blockblock.html