Enhancing Linux Threat Detection: A Sysmon - Based Approach to Identifying Sandworm TTPs

Linux systems have become foundational across modern IT enterprises. Threat actors are increasingly targeting Linux systems, including well - known advanced persistent threats (APTs) such as Sandworm. This research evaluates the effectiveness of Sysmon for Linux in detecting Sandworm tactics, techniques, and procedures (TTPs) compared to the more established Linux audit subsystem (auditd).