BUG FIX: /usr/bin/.sshd was listed as a suspicious file and should have been a suspicious directory BUG FIX: ps output check looked for "mine" and if any accounts contained "mine" it would detect as false positie (anchored it). BUG FIX: DirtyCow check looked for backup passwd file in /tmp and if not found, returned an error - Fixed this. NEW: --userscan now uses suspicious_strings.yara file if ClamAV is installed, reverts to original scan if not. (much faster/more reliable) NEW: Added check for lilocked ransomware NEW: Added check for Crypt0l0cker ransomware NEW: Check /etc/sudoers file for non-root users with ALL or NOPASSWD set and WARN accordingly. NEW: Look for processes in /root/.bash_history that can (or have been known to) spawn a TTY shell NEW: Added lots of files to the suspicious files check subroutine (checks for over 300 now) NEW: Add check for xmg/xmgs user-level coin miner NEW: Update check for Linux/Lady rootkit.  Listens only on port 6379 (same as redis server). NEW: Add IMMUTABLE check to /etc/ssh/sshd_config file NEW: Removed --skipELF option and instead added 3 new switches (--shadow, look for shadow.roottn.bak email hack, --symlink, look for symlink hacks, --elfcheck, check for ELF binaries that masquerade as images).  Or --full for all of these checks.
BUG FIX: /usr/bin/.sshd was listed as a suspicious file and should have been a suspicious directory
BUG FIX: ps output check looked for "mine" and if any accounts contained "mine" it would detect as false positie (anchored it).
BUG FIX: DirtyCow check looked for backup passwd file in /tmp and if not found, returned an error - Fixed this.
NEW: --userscan now uses suspicious_strings.yara file if ClamAV is installed, reverts to original scan if not. (much faster/more reliable)
NEW: Added check for lilocked ransomware
NEW: Added check for Crypt0l0cker ransomware
NEW: Check /etc/sudoers file for non-root users with ALL or NOPASSWD set and WARN accordingly.
NEW: Look for processes in /root/.bash_history that can (or have been known to) spawn a TTY shell
NEW: Added lots of files to the suspicious files check subroutine (checks for over 300 now)
NEW: Add check for xmg/xmgs user-level coin miner
NEW: Update check for Linux/Lady rootkit.  Listens only on port 6379 (same as redis server).
NEW: Add IMMUTABLE check to /etc/ssh/sshd_config file
NEW: Removed --skipELF option and instead added 3 new switches (--shadow, look for shadow.roottn.bak email hack, --symlink, look for symlink hacks, --elfcheck, check for ELF binaries that masquerade as images).  Or --full for all of these checks.

cPanelTechs/CSI