Checking Weird Binaries

strace $binaryname 2>&1 | grep -iE “open|access|no such file”

• searches missing objects that we could potentially load a malicious version of and run code as root