Curl Download and Bash Execution |
Ingress Tool Transfer |
TTP |
Linux Add Files In Known Crontab Directories |
Cron, Scheduled Task/Job |
Anomaly |
Linux Adding Crontab Using List Parameter |
Cron, Scheduled Task/Job |
Hunting |
Linux apt-get Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux APT Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux At Allow Config File Creation |
Cron, Scheduled Task/Job |
Anomaly |
Linux At Application Execution |
At, Scheduled Task/Job |
Anomaly |
Linux Auditd Add User Account Type |
Create Account, Local Account |
Anomaly |
Linux Auditd At Application Execution |
At, Scheduled Task/Job |
Anomaly |
Linux Auditd Auditd Service Stop |
Service Stop |
Anomaly |
Linux Auditd Base64 Decode Files |
Deobfuscate/Decode Files or Information |
Anomaly |
Linux Auditd Change File Owner To Root |
Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification |
TTP |
Linux Auditd Clipboard Data Copy |
Clipboard Data |
Anomaly |
Linux Auditd Data Transfer Size Limits Via Split |
Data Transfer Size Limits |
Anomaly |
Linux Auditd Data Transfer Size Limits Via Split Syscall |
Data Transfer Size Limits |
Anomaly |
Linux Auditd Database File And Directory Discovery |
File and Directory Discovery |
Anomaly |
Linux Auditd Disable Or Modify System Firewall |
Disable or Modify System Firewall, Impair Defenses |
Anomaly |
Linux Auditd Edit Cron Table Parameter |
Cron, Scheduled Task/Job |
TTP |
Linux Auditd File And Directory Discovery |
File and Directory Discovery |
Anomaly |
Linux Auditd File Permission Modification Via Chmod |
Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification |
Anomaly |
Linux Auditd File Permissions Modification Via Chattr |
Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification |
TTP |
Linux Auditd Find Credentials From Password Managers |
Password Managers, Credentials from Password Stores |
TTP |
Linux Auditd Find Credentials From Password Stores |
Password Managers, Credentials from Password Stores |
TTP |
Linux Auditd Find Private Keys |
Private Keys, Unsecured Credentials |
TTP |
Linux Auditd Find Ssh Private Keys |
Private Keys, Unsecured Credentials |
Anomaly |
Linux Auditd Hidden Files And Directories Creation |
File and Directory Discovery |
TTP |
Linux Auditd Kernel Module Using Rmmod Utility |
Kernel Modules and Extensions, Boot or Logon Autostart Execution |
TTP |
Linux Auditd Osquery Service Stop |
Service Stop |
TTP |
Linux Auditd Possible Access Or Modification Of Sshd Config File |
SSH Authorized Keys, Account Manipulation |
Anomaly |
Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File |
Cron, Scheduled Task/Job |
Hunting |
Linux Auditd Preload Hijack Via Preload File |
Dynamic Linker Hijacking, Hijack Execution Flow |
TTP |
Linux Auditd Service Restarted |
Systemd Timers, Scheduled Task/Job |
Anomaly |
Linux Auditd Service Started |
Service Execution, System Services |
TTP |
Linux Auditd Setuid Using Chmod Utility |
Setuid and Setgid, Abuse Elevation Control Mechanism |
Anomaly |
Linux Auditd Sysmon Service Stop |
Service Stop |
TTP |
Linux Auditd System Network Configuration Discovery |
System Network Configuration Discovery |
Anomaly |
Linux Auditd Unix Shell Configuration Modification |
Unix Shell Configuration Modification, Event Triggered Execution |
TTP |
Linux Auditd Unload Module Via Modprobe |
Kernel Modules and Extensions, Boot or Logon Autostart Execution |
TTP |
Linux Auditd Virtual Disk File And Directory Discovery |
File and Directory Discovery |
Anomaly |
Linux Auditd Whoami User Discovery |
System Owner/User Discovery |
Anomaly |
Linux AWK Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Busybox Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux c89 Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux c99 Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Change File Owner To Root |
Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification |
Anomaly |
Linux Clipboard Data Copy |
Clipboard Data |
Anomaly |
Linux Common Process For Elevation Control |
Setuid and Setgid, Abuse Elevation Control Mechanism |
Hunting |
Linux Composer Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Cpulimit Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Csvtool Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Curl Upload File |
Ingress Tool Transfer |
TTP |
Linux Decode Base64 to Shell |
Obfuscated Files or Information, Unix Shell |
TTP |
Linux Docker Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Edit Cron Table Parameter |
Cron, Scheduled Task/Job |
Hunting |
Linux Emacs Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Find Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux GDB Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Gem Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux GNU Awk Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Ingress Tool Transfer Hunting |
Ingress Tool Transfer |
Hunting |
Linux Ingress Tool Transfer with Curl |
Ingress Tool Transfer |
Anomaly |
Linux Make Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux MySQL Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Node Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Obfuscated Files or Information Base64 Decode |
Obfuscated Files or Information |
Anomaly |
Linux Octave Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux OpenVPN Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux PHP Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux pkexec Privilege Escalation |
Exploitation for Privilege Escalation |
TTP |
Linux Possible Access Or Modification Of sshd Config File |
SSH Authorized Keys, Account Manipulation |
Anomaly |
Linux Possible Append Cronjob Entry on Existing Cronjob File |
Cron, Scheduled Task/Job |
Hunting |
Linux Possible Cronjob Modification With Editor |
Cron, Scheduled Task/Job |
Hunting |
Linux Possible Ssh Key File Creation |
SSH Authorized Keys, Account Manipulation |
Anomaly |
Linux Proxy Socks Curl |
Proxy, Non-Application Layer Protocol |
TTP |
Linux Puppet Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux RPM Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Ruby Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux Service File Created In Systemd Directory |
Systemd Timers, Scheduled Task/Job |
Anomaly |
Linux Service Restarted |
Systemd Timers, Scheduled Task/Job |
Anomaly |
Linux Service Started Or Enabled |
Systemd Timers, Scheduled Task/Job |
Anomaly |
Linux Setuid Using Chmod Utility |
Setuid and Setgid, Abuse Elevation Control Mechanism |
Anomaly |
Linux Sqlite3 Privilege Escalation |
Sudo and Sudo Caching, Abuse Elevation Control Mechanism |
Anomaly |
Linux SSH Authorized Keys Modification |
SSH Authorized Keys |
Anomaly |
Linux SSH Remote Services Script Execute |
SSH |
TTP |
Suspicious Curl Network Connection |
Ingress Tool Transfer |
TTP |