E-Crime - CraftedSignal Threat Feed

Detection of Linux SSH Authorized Keys Modification

hello@craftedsignal.io — Mon, 12 Oct 2026 17:51:36 +0000

Adversaries frequently target the Linux ~/.ssh/authorized_keys file to establish persistent access to compromised endpoints. By injecting their own public keys into this file, attackers can bypass standard authentication mechanisms and maintain long-term unauthorized access to the system. This technique is often observed as part of broader campaigns involving Living off the Land (LotL) binaries, as well as specific threat activities attributed to malware like Hellcat Ransomware and VoidLink. Defenders must monitor process execution telemetry for common command-line tools interacting with these configuration files to identify potential persistence creation.

Impact

Successful modification of authorized_keys allows an attacker to maintain persistent, high-privilege access to the target host. This unauthorized access can lead to lateral movement, further exploitation, or long-term data exfiltration. The technique is a common component of modern Linux-based threats, including those linked to ransomware operations and cloud-native malware deployments.

Recommendation

Prioritize detection engineering efforts to monitor process execution paths targeting SSH configuration files.

Deploy the Sigma rule below to monitor for process activity interacting with authorized_keys files.
Implement filtering to exclude benign system administration activity, such as legitimate key management scripts utilizing 'echo' or 'ssh-keygen'.
Configure Sysmon for Linux (Event ID 1) to capture full process command lines and parent process information.
Use the provided drilldown search logic to investigate specific users and destinations associated with detected key modifications.

Detection of Malicious File Overwriting via Linux dd Command

hello@craftedsignal.io — Mon, 12 Oct 2026 17:50:21 +0000

This threat brief focuses on the malicious abuse of the standard Linux 'dd' utility to perform unauthorized file overwriting. Adversaries leverage this command to irreversibly destroy target files or entire partitions, significantly impacting system availability and recovery capabilities. This technique is often associated with data destruction campaigns, such as those observed in the Industroyer2 ecosystem. Defenders must monitor process execution logs for 'dd' commands containing output redirection flags ('of=') that target sensitive system files or data directories. This activity is a high-confidence indicator of destructive intent when observed outside of legitimate administrative maintenance windows.

Impact

The abuse of the 'dd' command for file destruction can render a Linux system inoperable, resulting in critical data loss and extended downtime. Successful execution of these commands effectively deletes or corrupts files, requiring complete system re-imaging or restoration from secure offline backups, which may not be readily available for all impacted sectors.

Recommendation

Deploy the provided Sigma rule to detect process execution of 'dd' with output redirection flags.
Enable Sysmon for Linux or equivalent EDR telemetry to capture full command-line arguments for all executed processes.
Establish a baseline of authorized administrative tasks to identify and filter out legitimate usage of 'dd' by system operators.
Monitor for suspicious process parent-child relationships where 'dd' is spawned by unexpected shell processes or web services.

Detection of Shadow Copy Deletion via System Utilities

hello@craftedsignal.io — Mon, 12 Oct 2026 17:38:57 +0000

The unauthorized deletion of Volume Shadow Copies is a prevalent technique used by ransomware operators and advanced persistent threat (APT) actors to hinder incident response and system restoration efforts. By leveraging legitimate, pre-installed Windows utilities such as vssadmin.exe and wmic.exe, attackers can effectively destroy local backups of files. This behavior is a hallmark of numerous ransomware families, including LockBit, Clop, Black Basta, Rhysida, and others. Security teams should monitor for the execution of these utilities with specific command-line arguments involving the deletion of shadow storage. Because these tools are also used by system administrators for legitimate maintenance, it is essential to baseline environment-specific behaviors to differentiate malicious activity from standard management tasks.

Attack Chain

Initial access is established on the Windows host via spearphishing, exploit, or credential abuse.
The attacker gains sufficient privileges to interact with system management utilities.
The attacker executes a discovery phase to locate existing volume shadow copies.
The attacker invokes vssadmin.exe or wmic.exe with specific parameters to target the shadow storage.
The utility processes the deletion command, effectively purging backup snapshots from the disk.
The attacker may then proceed to encrypt files, overwrite data, or deploy secondary payloads.
The final objective is reached when the victim is unable to restore data from local snapshots, increasing pressure to pay a ransom.

Impact

Successful deletion of shadow copies eliminates the ability for victims to perform simple, local restoration of encrypted or stolen data. This activity is frequently the precursor to a broader ransomware event, leading to significant operational disruption, data loss, and exfiltration. This TTP has been observed across various sectors and is a standard component of major ransomware operations, often occurring just before the encryption phase of an attack.

Recommendation

Deploy the Sigma rule provided in this brief to detect the usage of vssadmin.exe and wmic.exe for shadow copy deletion.
Enable Sysmon process-creation logging (Event ID 1) or Windows Security event logging (Event ID 4688) to capture complete command-line arguments.
Configure SIEM alerts to trigger specifically on process executions where the command line contains both 'delete' and 'shadow' keywords.
Investigate occurrences of this activity to determine if the deletion was performed by a known administrator or an unauthorized process, especially if the parent process is unexpected.