File and Directory Permissions Modification

Adversaries may modify file or directory permissions to evade defenses.

Executes dropped EXE

Reads AppArmor ptrace settings

Discovery of allowed ptrace capabilities by AppArmor.

Enumerates running processes

Discovers information about currently running processes on the system

Reads hardware information

Accesses system info like serial numbers, manufacturer names etc.

Reads network interface configuration

Fetches information about one or more active network interfaces.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Removes the immutable protection flag from a file

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Creates Raw socket

Creates a socket that captures raw packets at the device level

Flushes firewall rules

Flushes/ disables firewall rules inside the Linux kernel.

Checks hardware identifiers (DMI)

Checks DMI information which indicate if the system is a virtual machine.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Enumerates running processes

Discovers information about currently running processes on the system

Reads hardware information

Accesses system info like serial numbers, manufacturer names etc.

Reads network interface configuration

Fetches information about one or more active network interfaces.

Outbound SSH connection to public host

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

Contacts third-party web service commonly abused for C2

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Creates a large amount of network flows

This may indicate a network scan to discover remotely running services.

Enumerates active TCP sockets

Gets active TCP sockets from /proc virtual filesystem.

Enumerates running processes

Discovers information about currently running processes on the system

Modifies systemd

Adds/ modifies systemd service files. Likely to achieve persistence.

Reads list of loaded kernel modules

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

Writes file to system bin folder

Executes dropped EXE

Renames itself

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Creates/modifies environment variables

Creating/modifying environment variables is a common persistence mechanism.

Enumerates running processes

Discovers information about currently running processes on the system

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Modifies systemd

Adds/ modifies systemd service files. Likely to achieve persistence.

Write file to user bin folder

Modifies Bash startup script

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

Creates Raw socket

Creates a socket that captures raw packets at the device level

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Enumerates running processes

Discovers information about currently running processes on the system

Reads network interface configuration

Fetches information about one or more active network interfaces.

Creates Raw socket

Creates a socket that captures raw packets at the device level

Flushes firewall rules

Flushes/ disables firewall rules inside the Linux kernel.

Checks hardware identifiers (DMI)

Checks DMI information which indicate if the system is a virtual machine.

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Enumerates running processes

Discovers information about currently running processes on the system

Reads hardware information

Accesses system info like serial numbers, manufacturer names etc.

Reads network interface configuration

Fetches information about one or more active network interfaces.

Renames itself

Creates/modifies Cron job

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Creates/modifies environment variables

Creating/modifying environment variables is a common persistence mechanism.

Enumerates running processes

Discovers information about currently running processes on the system

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Modifies Bash startup script