Persistence

Potential Shell via Web Server

May 5, 2023 · Elastic Host Linux Threat Detection Persistence Investigation Guide Elastic Endgame ·

Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.

Google Workspace User Group Access Modified to Allow External Access

Mar 2, 2023 · Elastic Cloud Google Workspace Continuous Monitoring SecOps Identity and Access Persistence ·

User groups in Google Workspace are created to help manage users permissions and access to various resources and applications. The security label is only applied to a group when users within that group are expected to access sensitive data and/or resources so administrators add this label to easily manage security groups better. Adversaries with administrator access may modify a security group to allow external access from members outside the organization. This detection does not capture all modifications to security groups, but only those that could increase the risk associated with them.

Persistence via Kernel Module Modification

Apr 21, 2021 · Elastic Host Linux Threat Detection Persistence ·

Share on:

Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.

Potential Persistence via Cron Job

Apr 21, 2021 · Elastic Host Linux macOS Threat Detection Persistence ·

Share on:

Identifies the creation or execution of a cron job. Adversaries may abuse cron jobs to perform task scheduling for initial or recurring execution of malicious code.