File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

Modifies sudoers policy

Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Abuse sudo or cached sudo credentials to execute code.

Adds a user to the system

Creates/modifies environment variables

Creating/modifying environment variables is a common persistence mechanism.

Deletes log files

Deletes log files on the system.

Enumerates running processes

Discovers information about currently running processes on the system

Modifies init.d

Adds/modifies system service, likely for persistence.

Write file to user bin folder

Writes file to system bin folder

Modifies Bash startup script