2ae7255eedd7f4d39a999f57209497235d632e543356e34f634ce90522d2b2b2

privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/gshadow	usermod
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	usermod
File opened for modification	/etc/shadow	usermod
File opened for modification	/etc/group	usermod

Modifies sudoers policy 1 IoCs

Adds/ Modifies rule files for sudoers policy, likely to grant additional privileges.

description	ioc	Process
File opened for modification	/etc/sudoers	install_cloud.sh

OS Credential Dumping 1 TTPs 3 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	usermod
File opened for reading	/etc/shadow	dpkg-preconfigure

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs

Abuse sudo or cached sudo credentials to execute code.

Sudo and Sudo Caching

T1548.003

pid	Process
757	sudo
1054	sudo
1063	sudo
1303	sudo

Adds a user to the system 1 IoCs

pid	Process
740	useradd

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/home/px_user/.bashrc	useradd
File opened for modification	/home/px_user/.profile	useradd

Deletes log files 1 TTPs 1 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/apt/eipp.log.xz	apt-get

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/newuidmap.dpkg-new	dpkg
File opened for modification	/usr/bin/newgidmap.dpkg-new	dpkg

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/home/px_user/.bashrc	useradd
File opened for modification	/home/px_user/.profile	useradd

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4
File opened for reading	/sys/devices/system/cpu/online	exim4

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	loginctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/crypto/fips_enabled	gpg-connect-agent
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	gpgconf
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	sendmail
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/sys/crypto/fips_enabled	gpgv
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/self/fd	apt-config

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
1037	dpkg-split
1037	dpkg-split
1037	dpkg-split
719	ip
1037	dpkg-split

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.WVuINu	apt
File opened for modification	/tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg	apt-key
File opened for modification	/tmp/fileutl.message.ITlt2j	apt-get
File opened for modification	/tmp/apt.sig.iu56w6	gpgv
File opened for modification	/tmp/fileutl.message.lqELkZ	apt
File opened for modification	/tmp/fileutl.message.TJGc0c	apt
File opened for modification	/tmp/apt.sig.gItymN	gpgv
File opened for modification	/tmp/fileutl.message.5hg0JO	apt
File opened for modification	/tmp/fileutl.message.yYKxGW	apt
File opened for modification	/tmp/fileutl.message.qL27Jm	apt-cache
File opened for modification	/tmp/apt-key-gpghome.qLTM5mVHz1/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.bLCYSs	gpgv
File opened for modification	/tmp/apt.data.QKX1yz	gpgv
File opened for modification	/tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.e3XmDnRMiS/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.data.ANzGdm	gpgv
File opened for modification	/tmp/apt-key-gpghome.RRg5d6XUnt/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.QhBwN9	apt
File opened for modification	/tmp/fileutl.message.OQSPVk	apt-get
File opened for modification	/tmp/fileutl.message.KjMDCJ	apt-get
File opened for modification	/tmp/apt-key-gpghome.zxl8LJzSiG/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.Ezd1lD	apt
File opened for modification	/tmp/fileutl.message.oBgXzx	apt-get
File opened for modification	/tmp/fileutl.message.wLxqcd	apt-get
File opened for modification	/tmp/fileutl.message.51x3lA	apt-get
File opened for modification	/tmp/apt.sig.w5LBsi	gpgv
File opened for modification	/tmp/fileutl.message.6nixnr	apt
File opened for modification	/tmp/fileutl.message.SWprFK	apt
File opened for modification	/tmp/fileutl.message.FwMPmH	apt
File opened for modification	/tmp/apt.conf.ejC1tD	gpgv
File opened for modification	/tmp/apt.conf.QwKrsc	gpgv
File opened for modification	/tmp/apt.data.csdxWe	gpgv
File opened for modification	/tmp/apt-key-gpghome.zxl8LJzSiG/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.conf.NY4x9Z	gpgv
File opened for modification	/tmp/fileutl.message.XhNvZ1	apt-get
File opened for modification	/tmp/apt-key-gpghome.qLTM5mVHz1/pubring.orig.gpg	cp
File opened for modification	/tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg	touch
File opened for modification	/tmp/apt.conf.gtExGe	gpgv
File opened for modification	/tmp/fileutl.message.IrZsW4	apt-get
File opened for modification	/tmp/fileutl.message.0sP1G2	apt-get
File opened for modification	/tmp/fileutl.message.t6soLb	apt
File opened for modification	/tmp/fileutl.message.zQN5Dr	apt
File opened for modification	/tmp/fileutl.message.8m4M0H	apt
File opened for modification	/tmp/fileutl.message.TjMNyd	apt-cache
File opened for modification	/tmp/fileutl.message.7UJj6Q	apt-get
File opened for modification	/tmp/apt-key-gpghome.zJmDcEK0eN/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg	apt-key
File opened for modification	/tmp/apt.conf.kTF4Hu	gpgv
File opened for modification	/tmp/fileutl.message.AsGerl	apt
File opened for modification	/tmp/fileutl.message.ja8ruz	apt-cache
File opened for modification	/tmp/fileutl.message.kCmZlT	apt-get
File opened for modification	/tmp/apt-key-gpghome.RRg5d6XUnt/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.xxctw1vS2N/gpg.1.sh	apt-key
File opened for modification	/tmp/fileutl.message.dSl1lU	apt-get
File opened for modification	/tmp/fileutl.message.jzC3Wd	apt-get
File opened for modification	/tmp/apt-key-gpghome.bq7EpSfbHR/gpg.1.sh	apt-key
File opened for modification	/tmp/apt.sig.sHLXHd	gpgv
File opened for modification	/tmp/apt-key-gpghome.e3XmDnRMiS/pubring.orig.gpg	cp
File opened for modification	/tmp/fileutl.message.a3styU	apt-get
File opened for modification	/tmp/apt-key-gpghome.qLTM5mVHz1/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg	apt-key

Software Deployment Tools 1 TTPs 4 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1015	apt-get
1037	dpkg-split
1046	dpkg
1070	apt-get

/tmp/install_cloud.sh
/tmp/install_cloud.sh
1⤵
- Modifies sudoers policy
PID:701
- /usr/bin/tee
  tee -a /var/log/px-install.log
  2⤵
  PID:707
- /bin/date
  date
  2⤵
  PID:706
- /bin/uname
  uname -m
  2⤵
  PID:711
- /bin/sed
  sed "s/x86_64/amd64/;s/aarch64/arm64/"
  2⤵
  PID:712
- /usr/bin/awk
  awk "{print \$7}"
  2⤵
  - Reads runtime system information
  PID:720
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:721
- /sbin/ip
  ip route get 1.2.3.4
  2⤵
  - System Network Configuration Discovery
  PID:719
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:726
- /usr/bin/awk
  awk "{print \$3}"
  2⤵
  PID:732
- /usr/bin/id
  id -u
  2⤵
  PID:735
- /usr/bin/id
  id px_user
  2⤵
  PID:739
- /usr/sbin/useradd
  useradd -m -s /bin/bash px_user
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Creates/modifies environment variables
  - Modifies Bash startup script
  - Reads runtime system information
  PID:740
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:743
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:744
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:745
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:746
- /usr/bin/id
  id -nG px_user
  2⤵
  PID:748
- /bin/grep
  grep -qw systemd-journal
  2⤵
  PID:749
- /usr/sbin/usermod
  usermod -aG systemd-journal px_user
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  PID:751
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:753
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:754
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:755
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:756
- /usr/bin/sudo
  sudo loginctl enable-linger px_user
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:757
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:761
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty7z0-0000CH-8D
      4⤵
      Reads CPU attributes
      PID:771
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:764
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty7z0-0000CK-8M
      4⤵
      Reads CPU attributes
      PID:770
- - /bin/loginctl
    loginctl enable-linger px_user
    3⤵
    - Enumerates kernel/hardware configuration
    PID:766
- /usr/bin/apt
  apt -y update
  2⤵
  - Writes file to tmp directory
  PID:772
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:773
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:774
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:775
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:776
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:777
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    PID:779
- - /usr/lib/apt/methods/gpgv
    /usr/lib/apt/methods/gpgv
    3⤵
    - Writes file to tmp directory
    PID:780
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.gItymN /tmp/apt.data.vekYQ6
      4⤵
      Writes file to tmp directory
      PID:782
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:784
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:785
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:786
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:787
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        Reads runtime system information
        
        PID:788
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:789
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:790
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:791
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:792
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:793
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:794
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:795
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:797
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:798
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:799
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.zxl8LJzSiG
        5⤵
        
        PID:800
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.zxl8LJzSiG
        5⤵
        
        PID:802
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg
        5⤵
        
        PID:804
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:805
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:806
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:809
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:810
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:812
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:816
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:818
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:821
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:823
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:826
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:828
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:830
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:833
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:835
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:838
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg /tmp/apt-key-gpghome.zxl8LJzSiG/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:839
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:842
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:846
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.zxl8LJzSiG --keyring /tmp/apt-key-gpghome.zxl8LJzSiG/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.gItymN /tmp/apt.data.vekYQ6
        5⤵
        
        PID:848
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        
        PID:851
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        Reads runtime system information
        
        PID:852
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.zxl8LJzSiG
        5⤵
        
        PID:854
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
      4⤵
      Writes file to tmp directory
      PID:857
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:861
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:864
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        Reads runtime system information
        
        PID:866
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:868
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:870
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:872
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        
        PID:874
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:876
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        5⤵
        
        PID:878
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:881
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        5⤵
        
        PID:883
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:884
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        Reads runtime system information
        
        PID:887
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:891
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:892
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.RRg5d6XUnt
        5⤵
        
        PID:893
    - - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.RRg5d6XUnt
        5⤵
        
        PID:895
    - - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg
        5⤵
        
        PID:896
    - - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg
        5⤵
        Writes file to tmp directory
        
        PID:898
    - - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        5⤵
        
        PID:899
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:904
    - - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        5⤵
        
        PID:905
    - - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        5⤵
        
        PID:906
    - - /usr/bin/sort
        
        sort
        5⤵
        
        PID:911
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        5⤵
        
        PID:913
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        5⤵
        
        PID:915
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        5⤵
        
        PID:918
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        5⤵
        
        PID:920
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        5⤵
        
        PID:923
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        5⤵
        
        PID:926
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        5⤵
        
        PID:928
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        5⤵
        
        PID:930
    - - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        5⤵
        
        PID:932
    - - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg /tmp/apt-key-gpghome.RRg5d6XUnt/pubring.orig.gpg
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:934
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:937
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        Reads runtime system information
        
        PID:940
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.RRg5d6XUnt --keyring /tmp/apt-key-gpghome.RRg5d6XUnt/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Reads runtime system information
        
        PID:941
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:943
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:944
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.RRg5d6XUnt
        5⤵
        
        PID:945
  - - /usr/bin/apt-key
      /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.CvnO9S /tmp/apt.data.3jbV8L
      4⤵
      Writes file to tmp directory
      PID:947
    - - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        5⤵
        
        PID:949
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        Reads runtime system information
        
        PID:953
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        5⤵
        
        PID:954
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:955
    - - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        5⤵
        
        PID:956
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:957
    - - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        5⤵
        Reads runtime system information
        
        PID:958
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:959
    - - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        5⤵
        
        PID:961
      - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        6⤵
        
        PID:962
    - - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        5⤵
        
        PID:963
    - - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.zJmDcEK0eN
        5⤵
        
        PID:964
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:968
    - - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        5⤵
        
        PID:971
    - - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.zJmDcEK0eN --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.CvnO9S /tmp/apt.data.3jbV8L
        5⤵
        
        PID:973
    - - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        5⤵
        Reads runtime system information
        
        PID:974
      - /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        6⤵
        
        PID:975
    - - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.zJmDcEK0eN
        5⤵
        
        PID:976
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:977
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1008
- /usr/bin/apt
  apt install -y curl
  2⤵
  - Writes file to tmp directory
  PID:1009
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1010
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1011
- /usr/bin/apt
  apt install -y fuse-overlayfs
  2⤵
  - Writes file to tmp directory
  PID:1012
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1013
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1014
- /usr/bin/apt-get
  apt-get install -y uidmap
  2⤵
  - Deletes log files
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1015
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1016
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1017
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1018
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1019
- - /bin/sh
    /bin/sh -c "/usr/sbin/dpkg-preconfigure --apt || true"
    3⤵
    PID:1020
  - - /usr/sbin/dpkg-preconfigure
      /usr/sbin/dpkg-preconfigure --apt
      4⤵
      OS Credential Dumping
      PID:1021
    - - /usr/local/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1022
    - - /usr/local/bin/locale
        
        locale charmap
        5⤵
        
        PID:1022
    - - /usr/sbin/locale
        
        locale charmap
        5⤵
        
        PID:1022
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:1022
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1023
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1024
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1025
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1026
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1027
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1028
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1029
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1030
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1031
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1032
    - - /bin/sh
        
        sh -c "stty -a 2>/dev/null"
        5⤵
        
        PID:1033
      - /bin/stty
        
        stty -a
        6⤵
        
        PID:1034
- - /usr/bin/dpkg
    /usr/bin/dpkg --assert-multi-arch
    3⤵
    PID:1035
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --no-triggers --unpack --auto-deconfigure "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1036
  - - /usr/local/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      System Network Configuration Discovery
      PID:1037
  - - /usr/local/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      System Network Configuration Discovery
      PID:1037
  - - /usr/sbin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      System Network Configuration Discovery
      PID:1037
  - - /usr/bin/dpkg-split
      dpkg-split -Qao /var/lib/dpkg/reassemble.deb "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      System Network Configuration Discovery
      Software Deployment Tools
      PID:1037
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1038
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1038
  - - /usr/sbin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1038
  - - /usr/bin/dpkg-deb
      dpkg-deb --control "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb" /var/lib/dpkg/tmp.ci
      4⤵
      PID:1038
    - - /usr/local/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
    - - /usr/local/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
    - - /usr/sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
    - - /usr/bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
    - - /sbin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
    - - /bin/tar
        
        tar -x -f - "--warning=no-timestamp"
        5⤵
        
        PID:1041
  - - /usr/local/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      PID:1042
  - - /usr/local/bin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      PID:1042
  - - /usr/sbin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      PID:1042
  - - /usr/bin/dpkg-deb
      dpkg-deb --fsys-tarfile "/var/cache/apt/archives/uidmap_1%3a4.4-4.1_mips.deb"
      4⤵
      PID:1042
  - - /usr/local/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
  - - /usr/local/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
  - - /usr/sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
  - - /usr/bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
  - - /sbin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
  - - /bin/rm
      rm -rf -- /var/lib/dpkg/tmp.ci
      4⤵
      PID:1045
- - /usr/bin/dpkg
    /usr/bin/dpkg --status-fd 14 --configure --pending
    3⤵
    - Reads runtime system information
    - Software Deployment Tools
    PID:1046
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1047
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1048
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1049
- /usr/bin/apt-cache
  apt-cache search podman
  2⤵
  - Writes file to tmp directory
  PID:1050
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:1052
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1053
- /bin/grep
  grep podman
  2⤵
  PID:1051
- /usr/bin/sudo
  sudo sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1054
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:1057
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80s-0000H3-8g
      4⤵
      Reads CPU attributes
      PID:1071
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1060
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80s-0000H6-8q
      4⤵
      Reads CPU attributes
      PID:1072
- - /bin/sh
    sh -c "echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
    3⤵
    PID:1061
- /usr/bin/sudo
  sudo apt-get update
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1063
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1067
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80t-0000HD-8u
      4⤵
      Reads CPU attributes
      PID:1074
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1069
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty80t-0000HF-BZ
      4⤵
      Reads CPU attributes
      PID:1075
- - /usr/bin/apt-get
    apt-get update
    3⤵
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:1070
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1073
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1076
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1079
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1082
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1083
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1084
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      PID:1086
  - - /usr/lib/apt/methods/gpgv
      /usr/lib/apt/methods/gpgv
      4⤵
      Writes file to tmp directory
      PID:1087
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.iu56w6 /tmp/apt.data.QKX1yz
        5⤵
        Writes file to tmp directory
        
        PID:1089
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1091
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1092
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1093
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1094
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1095
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1096
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1097
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1098
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:1099
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1100
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        
        PID:1101
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1102
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:1104
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1105
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1106
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.qLTM5mVHz1
        6⤵
        
        PID:1107
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.qLTM5mVHz1
        6⤵
        
        PID:1108
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.qLTM5mVHz1/pubring.gpg
        6⤵
        
        PID:1109
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.qLTM5mVHz1/pubring.gpg
        6⤵
        
        PID:1110
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:1111
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1112
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1113
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:1114
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1117
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1119
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1121
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1123
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1125
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1127
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1129
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1131
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1133
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1135
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.qLTM5mVHz1/pubring.gpg /tmp/apt-key-gpghome.qLTM5mVHz1/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1136
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1139
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:1142
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.qLTM5mVHz1 --keyring /tmp/apt-key-gpghome.qLTM5mVHz1/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.iu56w6 /tmp/apt.data.QKX1yz
        6⤵
        
        PID:1143
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        
        PID:1144
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:1145
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.qLTM5mVHz1
        6⤵
        
        PID:1146
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        5⤵
        Writes file to tmp directory
        
        PID:1148
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1150
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1151
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1152
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1153
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1154
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1155
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        Reads runtime system information
        
        PID:1156
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1157
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:1158
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1159
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:1160
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1161
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:1163
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1164
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1165
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.bq7EpSfbHR
        6⤵
        
        PID:1166
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.bq7EpSfbHR
        6⤵
        
        PID:1167
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg
        6⤵
        
        PID:1168
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1169
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        
        PID:1170
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1171
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1172
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        
        PID:1173
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1176
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1178
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1180
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1182
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1184
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1186
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1188
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1190
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1192
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1194
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg /tmp/apt-key-gpghome.bq7EpSfbHR/pubring.orig.gpg
        6⤵
        
        PID:1195
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1198
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1201
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.bq7EpSfbHR --keyring /tmp/apt-key-gpghome.bq7EpSfbHR/pubring.gpg --ignore-time-conflict --status-fd 3 /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release.gpg /var/lib/apt/lists/archive.debian.org_debian_dists_stretch_Release
        6⤵
        Reads runtime system information
        
        PID:1202
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:1203
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1204
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.bq7EpSfbHR
        6⤵
        
        PID:1205
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly verify --status-fd 3 /tmp/apt.sig.sHLXHd /tmp/apt.data.csdxWe
        5⤵
        Writes file to tmp directory
        
        PID:1207
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1209
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1210
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1211
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1212
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1213
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1214
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1215
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1216
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
        6⤵
        
        PID:1217
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1218
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
        6⤵
        Reads runtime system information
        
        PID:1219
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1220
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        Reads runtime system information
        
        PID:1222
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1223
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1224
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.e3XmDnRMiS
        6⤵
        
        PID:1225
      - /bin/readlink
        
        readlink -f /tmp/apt-key-gpghome.e3XmDnRMiS
        6⤵
        
        PID:1226
      - /bin/rm
        
        rm -f /tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg
        6⤵
        
        PID:1227
      - /usr/bin/touch
        
        touch /tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1228
      - /usr/bin/apt-config
        
        apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
        6⤵
        Reads runtime system information
        
        PID:1229
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1230
      - /bin/readlink
        
        readlink -f /etc/apt/trusted.gpg.d/
        6⤵
        
        PID:1231
      - /usr/bin/find
        
        find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
        6⤵
        Reads runtime system information
        
        PID:1232
      - /usr/bin/sort
        
        sort
        6⤵
        
        PID:1235
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
        6⤵
        
        PID:1237
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
        6⤵
        
        PID:1239
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
        6⤵
        
        PID:1241
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg
        6⤵
        
        PID:1243
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg
        6⤵
        
        PID:1245
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg
        6⤵
        
        PID:1247
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
        6⤵
        
        PID:1249
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
        6⤵
        
        PID:1251
      - /bin/cat
        
        cat /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
        6⤵
        
        PID:1253
      - /bin/cp
        
        cp -a /tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg /tmp/apt-key-gpghome.e3XmDnRMiS/pubring.orig.gpg
        6⤵
        Writes file to tmp directory
        
        PID:1254
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1257
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        Reads runtime system information
        
        PID:1260
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.e3XmDnRMiS --keyring /tmp/apt-key-gpghome.e3XmDnRMiS/pubring.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.sHLXHd /tmp/apt.data.csdxWe
        6⤵
        Reads runtime system information
        
        PID:1261
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:1262
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        Reads runtime system information
        
        PID:1263
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.e3XmDnRMiS
        6⤵
        
        PID:1264
    - - /usr/bin/apt-key
        
        /usr/bin/apt-key --quiet --readonly --keyring /etc/apt/keyrings/nodesource.gpg verify --status-fd 3 /tmp/apt.sig.w5LBsi /tmp/apt.data.ANzGdm
        5⤵
        Writes file to tmp directory
        
        PID:1266
      - /usr/bin/apt-config
        
        apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
        6⤵
        
        PID:1268
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1271
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
        6⤵
        
        PID:1272
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1273
      - /usr/bin/apt-config
        
        apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
        6⤵
        
        PID:1274
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        Reads runtime system information
        
        PID:1275
      - /usr/bin/apt-config
        
        apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
        6⤵
        
        PID:1276
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1277
      - /usr/bin/apt-config
        
        apt-config shell GPGV Apt::Key::gpgvcommand
        6⤵
        
        PID:1279
        
        /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        7⤵
        
        PID:1280
      - /bin/mktemp
        
        mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
        6⤵
        
        PID:1281
      - /bin/chmod
        
        chmod 700 /tmp/apt-key-gpghome.xxctw1vS2N
        6⤵
        
        PID:1282
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1286
      - /bin/sed
        
        sed -e "s#'#'\"'\"'#g"
        6⤵
        
        PID:1289
      - /usr/bin/gpgv
        
        gpgv --homedir /tmp/apt-key-gpghome.xxctw1vS2N --keyring /etc/apt/keyrings/nodesource.gpg --ignore-time-conflict --status-fd 3 /tmp/apt.sig.w5LBsi /tmp/apt.data.ANzGdm
        6⤵
        
        PID:1291
      - /usr/bin/gpgconf
        
        gpgconf --kill gpg-agent
        6⤵
        Reads runtime system information
        
        PID:1292
        
        /usr/bin/gpg-connect-agent
        
        gpg-connect-agent --no-autostart KILLAGENT
        7⤵
        
        PID:1293
      - /bin/rm
        
        rm -rf /tmp/apt-key-gpghome.xxctw1vS2N
        6⤵
        
        PID:1294
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:1269
  - - /usr/lib/apt/methods/store
      /usr/lib/apt/methods/store
      4⤵
      PID:1270
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1295
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:1296
- /usr/bin/awk
  awk "{print }"
  2⤵
  - Reads runtime system information
  PID:1299
- /usr/bin/head
  head -n 1
  2⤵
  PID:1302
- /bin/grep
  grep -oP "(?<=NO_PUBKEY\\s)[A-F0-9]{16}"
  2⤵
  PID:1301
- /usr/bin/sudo
  sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1303
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    - Reads runtime system information
    PID:1306
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty81J-0000L4-AX
      4⤵
      Reads CPU attributes
      PID:1315
- - /usr/sbin/sendmail
    sendmail -t
    3⤵
    PID:1309
  - - /usr/sbin/exim4
      /usr/sbin/exim4 -Mc 1ty81J-0000L7-9P
      4⤵
      Reads CPU attributes
      PID:1316
- - /usr/bin/apt-key
    apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4D64390375060AA4
    3⤵
    PID:1310
  - - /usr/bin/apt-config
      apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
      4⤵
      PID:1312
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1313
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
      4⤵
      Reads runtime system information
      PID:1314
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        
        PID:1317
  - - /usr/bin/apt-config
      apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
      4⤵
      PID:1318
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1319
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
      4⤵
      Reads runtime system information
      PID:1320
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1323
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
      4⤵
      PID:1324
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1325
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
      4⤵
      Reads runtime system information
      PID:1326
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1327

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Modify Authentication Process

T1556

Pluggable Authentication Modules

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules