attack.t1053.003

Persistence Via Sudoers Files

Nov 2, 2023 · attack.persistence attack.t1053.003 ·

Detects creation of sudoers file or files in "sudoers.d" directory which can be used a potential method to persiste privileges for a specific user.

Triple Cross eBPF Rootkit Default Persistence

Nov 2, 2023 · attack.persistence attack.defense_evasion attack.t1053.003 ·

Share on:

Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method

Azure Kubernetes CronJob

Oct 18, 2023 · attack.persistence attack.t1053.003 attack.privilege_escalation attack.execution ·

Share on:

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Modifying Crontab

Oct 17, 2023 · attack.persistence attack.t1053.003 ·

Share on:

Detects suspicious modification of crontab file.

Persistence Via Cron Files

Dec 31, 2022 · attack.persistence attack.t1053.003 ·

Share on:

Detects creation of cron file or files in Cron directories which could indicates potential persistence.

Scheduled Cron Task/Job - Linux

Nov 28, 2022 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.

Scheduled Cron Task/Job - MacOs

Nov 28, 2022 · attack.execution attack.persistence attack.privilege_escalation attack.t1053.003 ·

Share on:

Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.