E-Crime

Adversaries modify SSH authorized_keys files on Linux systems to establish persistent access and bypass authentication, a technique detectable through process execution monitoring.

Adversaries use the Linux 'dd' utility to perform destructive file overwriting, leading to data loss and system service disruption.

Detection of unauthorized deletion of Volume Shadow Copies using native Windows utilities vssadmin.exe or wmic.exe, a common technique employed by ransomware actors to prevent system recovery.