File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

Flushes firewall rules

Flushes/ disables firewall rules inside the Linux kernel.

Loads a kernel module

Loads a Linux kernel module, potentially to achieve persistence

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Deletes log files

Deletes log files on the system.

Enumerates active TCP sockets

Gets active TCP sockets from /proc virtual filesystem.

Enumerates running processes

Discovers information about currently running processes on the system

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Modifies systemd

Adds/ modifies systemd service files. Likely to achieve persistence.

Write file to user bin folder

Writes file to system bin folder

Reads process memory

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.