by Thinkst Applied Research
Canaryfy is an example Linux file read monitor. It watches individual files or files in directories, and triggers a Canarytoken when a read occurs. It relies on the inotify(7) API for firing on file reads.
make which will compile to a
To get the version which searches for a low PID, uncomment the DEFINES line with
-DLOWPID in the Makefile.
Move the binary to an unexpected location (e.g.
canaryfy <process_name> <dns_canarytoken> <path> [ <path> ,]
process_nameis what will appear in the
pslisting. e.g. '[kswapd1]'
dns_canarytokenis a new token from Canarytoken.
pathis a full path to a file or directory