Threat briefs

Adversaries modify SSH authorized_keys files on Linux systems to establish persistent access and bypass authentication, a technique detectable through process execution monitoring.

Adversaries leverage the Linux base64 utility to deobfuscate malicious payloads and scripts, a common tactic for evading static analysis and security controls during the execution phase.

Adversaries with root privileges may abuse the Linux Magic SysRq interface via /proc/sysrq-trigger to perform unauthorized system reboots, process termination, or system destabilization.

Detection of the kmod process enumerating kernel modules, a common discovery step used by attackers to profile systems before loading malicious rootkits or kernel-level persistence.

The execution of the insmod utility on Linux systems is a high-risk indicator often associated with the deployment of rootkits for persistence and privilege escalation.

Detection of malicious actors using the curl utility on Linux systems to download remote scripts or binaries via common command-line flags.

This brief outlines the monitoring of curl and wget execution on Linux systems to detect the ingress of malicious tools, a common technique employed by adversaries for payload delivery and post-compromise activity.

Attackers can achieve container escape and escalate privileges on Linux hosts by mounting the entire host filesystem into a container with elevated privileges.

Detection of attackers using base64 decoding utilities coupled with pipe redirection to Linux shells to execute obfuscated malicious payloads.

Adversaries use the Linux 'dd' utility to perform destructive file overwriting, leading to data loss and system service disruption.

The TeamTNT threat group leverages the curl utility to exfiltrate sensitive AWS credential and configuration files to remote attacker-controlled servers.

Adversaries leverage the Linux xclip command-line utility to intercept or exfiltrate sensitive information stored in the system clipboard.

This detection brief addresses the use of the 'whoami' command on Linux systems for post-exploitation reconnaissance to identify user identity and privilege levels.

Adversaries leverage service termination techniques on Linux systems to disable security controls and disrupt operations, as documented in the Industroyer2 malware campaign.

This detection targets adversary efforts to perform credential dumping on Linux systems by monitoring for the usage of standard utilities to access /etc/passwd and /etc/shadow files.

This detection monitors for the execution of the 'insmod' utility on Linux systems, a technique frequently leveraged by attackers to deploy rootkits, gain kernel-level persistence, and escalate privileges.

This detection identifies suspicious reconnaissance activity on Linux systems where utilities like find or grep are used to locate sensitive document files, a technique commonly used by attackers for data identification and exfiltration.

Adversaries utilize the dd command to irreversibly overwrite system files with null bytes, facilitating data destruction and service disruption.

Detection of adversaries utilizing the 'xclip' utility on Linux systems to exfiltrate sensitive information stored in the system clipboard.

This detection monitors for the creation of new user accounts on Linux systems, a common technique employed by adversaries to establish persistence on compromised hosts.

Attackers can abuse the Linux 'at' or 'atd' utilities to maintain unauthorized access or escalate privileges by scheduling malicious tasks.

Adversaries often create new user accounts on Linux systems using 'useradd' or 'adduser' to establish persistence and facilitate privilege escalation, which can be identified through process execution monitoring.

Adversaries leverage the Impacket wmiexec.py tool to facilitate lateral movement and remote code execution by spawning processes via wmiprvse.exe using distinct command-line obfuscation and hidden share access patterns.

Attackers abuse the Windows attrib.exe binary with the +h flag to conceal malicious files and directories from users and security software as part of a defense evasion strategy.

Adversaries utilize the Get-WmiObject cmdlet via PowerShell to perform Active Directory domain computer enumeration, facilitating lateral movement planning.

Adversaries utilize the Get-LocalUser PowerShell cmdlet for account discovery and situational awareness on compromised Windows endpoints.

Adversaries utilize the PowerView PowerShell cmdlet 'Get-DomainGroup' to perform Active Directory reconnaissance and map domain structures, facilitating subsequent privilege escalation and lateral movement.

Adversaries leverage the PowerView cmdlet 'Get-DomainGroup' via PowerShell to perform Active Directory reconnaissance and identify group memberships for lateral movement.

This detection targets the execution of the PowerShell command 'Get-DomainController', often used by attackers to enumerate domain infrastructure as part of Active Directory discovery.

Adversaries may use the .NET System.Security.Principal.WindowsIdentity::GetCurrent() method via PowerShell to perform system discovery and identify the current user context.