File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Abuse sudo or cached sudo credentials to execute code.

Reads AppArmor ptrace settings

Discovery of allowed ptrace capabilities by AppArmor.

Adds a user to the system

Creates/modifies environment variables

Creating/modifying environment variables is a common persistence mechanism.

Deletes log files

Deletes log files on the system.

Enumerates running processes

Discovers information about currently running processes on the system

Reads hardware information

Accesses system info like serial numbers, manufacturer names etc.

Reads network interface configuration

Fetches information about one or more active network interfaces.

Uses Polkit to run commands

Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.

Modifies Bash startup script