Lesson 5.30: Hash sweeps against allow-lists and IOCs
A file's SHA-256 is its fingerprint: if a single byte changes, the hash changes. Comparing every executable on a host with two lists answers three questions at once: which files are known bad (in a threat-intelligence IOC list), which known files were modified (hash differs from the allow-list), and which files nobody knows (in neither). Packaged files have their own list, kept by dpkg. In the lab you sweep a Northwind application server, sort the results into those groups with sort, comm and grep -F, check the packaged binaries with dpkg -V, and write a short report.
18 min
You will learn to
- Hash every executable in a set of directories
- Compare with an allow-list using sort and comm
- Match against an IOC list with grep -Ff
- Tell modified files from unknown ones
- Verify packaged files with dpkg -V
Key terms
- Hash sweep
- Hashing many files and comparing them with reference lists.
- Allow-list
- Hashes of the files that should be there, e.g. from a golden image.
- IOC
- Indicator of compromise: a hash, address or name known to belong to an attack.
- comm
- Compares two sorted files line by line: -23 prints lines only in the first.
- grep -Ff
- Uses each line of a file as a fixed-string pattern.
- dpkg -V
- Verifies installed packaged files against their recorded checksums.
← Service secrets with systemd credentials · All lessons · SBOMs and vulnerability matching →