Sunturai
Threat report

www.elastic.co/security-labs/primer-on-persistence-mechanisms

https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
Published on
www.elastic.co
Sources in this catalogue
2

ATT&CK techniques those detections carry

  • T1548Abuse Elevation Control Mechanism
  • T1098Account Manipulation
  • T1136Create Account
  • T1136.001Local Account
  • T1053Scheduled Task/Job
  • T1543Create or Modify System Process
  • T1543.002Systemd Service
  • T1053.003Cron
  • +37 more
Open the original

27 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Network Connections Initiated Through XDG Autostart EntryMedium
KDE AutoStart Script or Desktop File CreationMedium
Linux User Account CreationLow
Potential Privilege Escalation via SUID/SGID Proxy ExecutionMedium
Privilege Escalation via SUID/SGIDMedium
User or Group Creation/ModificationLow
Systemd Service Started by Unusual Parent ProcessLow
Systemd Service CreatedMedium
Systemd Timer CreatedLow
Systemd Generator CreatedMedium
SSH Key Generated via ssh-keygenLow
Shell Configuration CreationMedium
Shadow File Modification by Unusual ProcessLow
Linux User Added to Privileged GroupLow
Linux Group CreationLow
Potential Linux Backdoor User Account CreationHigh
Cron Job Created or ModifiedMedium
At Job Created or ModifiedMedium
Potential Reverse Shell via UDPMedium
Potential Meterpreter Reverse ShellHigh
SUID/SGUID Enumeration DetectedMedium
Potential Persistence via File ModificationLow
Sudoers File ActivityMedium
SUID/SGID Bit SetLow
Potential Privilege Escalation via Sudoers File ModificationHigh

Showing 25 of 27

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice