I just posted a Handler's Diary, I've released a python script to find Linux files with the immutable bit set. #FOR577 @sans_isc #SANSDFIR https://isc.sans.edu/diary/New+tool+immutablepy/31598/