File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

Modifies sudoers policy

Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

OS Credential Dumping

Adversaries may attempt to dump credentials to use it in password cracking.

Checks system information (zLinux)

Check system information on IBM zSystems which indicate if the system is a virtual machine.

Removes the immutable protection flag from a file

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Writes file to system bin folder