Threat Hunting Articles

Tutorials Jun 10, 2026Advanced

Linux Memory Forensics with Volatility 3: Hunting Rootkits and Implants in 2026

A practical walkthrough of Linux memory forensics with Volatility 3 in 2026: capturing RAM with AVML or LiME, building ISF symbol tables, running the plugin chain that catches LKM, LD_PRELOAD, and eBPF rootkits, and mapping each detection back to a hardening control.

Felix Lindqvist 14 min read

Tutorials Apr 23, 2026

osquery for Linux Security: Threat Hunting, Fleet Monitoring, and SIEM Integration in 2026

osquery turns your Linux fleet into a SQL-queryable database for real-time threat hunting and endpoint telemetry. This practical guide walks through osquery 5.22 deployment, high-value security queries, FleetDM at scale, SIEM integration, and a frank take on osquery vs auditd in 2026.

Priya Ramaswamy 15 min read