BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.bsidescbr.com.au//bsides-canberra-2026//talk//ZYRVZ
 G
BEGIN:VTIMEZONE
TZID:Australia/Sydney
BEGIN:STANDARD
DTSTART:20250925T000000
TZNAME:AEST
TZOFFSETFROM:+1000
TZOFFSETTO:+1000
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20251005T030000
RDATE:20261004T030000
TZNAME:AEDT
TZOFFSETFROM:+1000
TZOFFSETTO:+1100
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20260405T030000
RDATE:20270404T030000
TZNAME:AEST
TZOFFSETFROM:+1100
TZOFFSETTO:+1000
END:STANDARD
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Hooked: Tracking Linker and Generator Persistence on Linux - Jason
 Trapp
DTSTART;TZID=Australia/Sydney:20260925T120000
DTEND;TZID=Australia/Sydney:20260925T122500
DTSTAMP:20260727T190122Z
UID:pretalx-bsides-canberra-2026-ZYRVZG@cfp.bsidescbr.com.au
DESCRIPTION:Standard Linux persistence tracking typically focuses heavily 
 on the more obvious artefacts like cron jobs\, rc.local scripts\, and stan
 dard systemd services. Because security teams look there first\, modern at
 tackers are shifting to more elegant\, hook-based execution vectors that b
 ypass traditional file-integrity monitoring.\nThis talk dives into dissect
 ing two low-overhead Linux persistence mechanisms: dynamic linker hijackin
 g and Systemd Generators. We will look at the underlying OS mechanics of b
 oth vectors\, look at a live example of how easily it can blend into legit
 imate infrastructure and how you can audit them across your entire fleet t
 omorrow.
LOCATION:Off-Main Track
URL:https://cfp.bsidescbr.com.au/bsides-canberra-2026/talk/ZYRVZG/
END:VEVENT
END:VCALENDAR