Sunturai
Threat report

www.elastic.co/security-labs/sequel-on-persistence-mechanisms

https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1546Event Triggered Execution
  • T1574Hijack Execution Flow
  • T1543Create or Modify System Process
  • T1037Boot or Logon Initialization Scripts
  • T1037.004RC Scripts
  • T1059Command and Scripting Interpreter
  • T1059.004Unix Shell
  • T1546.016Installer Packages
  • +30 more
Open the original

22 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Potential Sudo HijackingMedium
Yum Package Manager Plugin File CreationMedium
Systemd-udevd Rule File CreationLow
rc.local/rc.common File CreationHigh
Potential Execution of rc.local ScriptMedium
Suspicious rc.local Error MessageMedium
Executable Bit Set for Potential Persistence ScriptMedium
Message-of-the-Day (MOTD) File CreationMedium
System V Init Script CreatedLow
Git Hook Child ProcessLow
Git Hook Egress Network ConnectionMedium
Git Hook Created or ModifiedLow
Git Hook Command ExecutionLow
DNF Package Manager Plugin File CreationLow
Suspicious APT Package Manager Network ConnectionMedium
APT Package Manager Configuration File CreationLow
Suspicious APT Package Manager ExecutionLow
Yum/DNF Plugin Status DiscoveryLow
System Binary Moved or CopiedMedium
Potential Persistence via File ModificationLow
Deprecated - Suspicious File Creation in /etc for PersistenceMedium
Deprecated - Linux Restricted Shell Breakout via Linux Binary(s)Medium

Showing 22 of 22

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice