Sunturai
Threat report

www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit

https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit
Published on
www.elastic.co

ATT&CK techniques those detections carry

  • T1134Access Token Manipulation
  • T1134.004Parent PID Spoofing
  • T1036Masquerading
  • T1036.009Break Process Trees
  • T1055Process Injection
  • T1055.012Process Hollowing
  • T1059Command and Scripting Interpreter
  • T1059.001PowerShell
Open the original

3 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
DetectionSeverity
Unusual Parent-Child RelationshipMedium
Suspicious PowerShell Engine ImageLoadMedium
Parent Process PID SpoofingHigh

Showing 3 of 3

Filter in the catalogue

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice