timb-machine / linux-malware Public

Notifications You must be signed in to change notification settings
Fork 92
Star 1.1k

Code
Issues 780
Pull requests 1
Actions
Projects 1
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security
Insights

Issues: timb-machine/linux-malware

[Intel]: Example Intel

#16 opened Apr 19, 2022 by timb-machine

Open

Labels 175 Milestones 0

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clear current search query, filters, and sorts

32 Open 0 Closed

Author

Filter by author

Label

Filter by label

Use alt + click/return to exclude labels

or ⇧ + click/return for logical OR

Projects

Filter by project

Milestones

Filter by milestone

Assignee

Filter by who’s assigned

Assigned to nobody

Sort

Sort by

Newest Oldest Most commented Least commented Recently updated Least recently updated Best match

Most reactions

Issues list

[Intel]: https://github.com/grisuno/LazyOwn missing:submodule missing:tag:JavaScript missing:tag:Non-persistentStorage missing:tag:RedirectionToNull missing:tag:T1001 missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1021.002 missing:tag:T1021.004 missing:tag:T1027.002 missing:tag:T1037 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1059.006 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1071.002 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1222 missing:tag:T1491 missing:tag:T1518 missing:tag:T1543.002 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1548.003 missing:tag:T1552.003 missing:tag:T1552.004 missing:tag:T1560 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.007 missing:tag:T1590 missing:tag:T1602.001 missing:tag:wltm new

#812 opened Dec 6, 2024 by timb-machine

[Intel]: https://www.mandiant.com/sites/default/files/2022-03/wp-linux-endpoint-hardening.pdf missing:tag:Auditd missing:tag:Non-persistentStorage missing:tag:RedirectionToNull missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1021.002 missing:tag:T1021.004 missing:tag:T1037 missing:tag:T1037.004 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1069 missing:tag:T1070.002 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1215 missing:tag:T1222 missing:tag:T1491 missing:tag:T1518 missing:tag:T1543.002 missing:tag:T1548.001 missing:tag:T1548.003 missing:tag:T1552.003 missing:tag:T1556.003 missing:tag:T1562.001 missing:tag:T1562.004 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 new

#675 opened May 21, 2023 by timb-machine

[Intel]: https://github.com/sqall01/LSMS missing:tag:Non-persistentStorage missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1098.004 missing:tag:T1543.002 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.006 missing:tag:T1620

#610 opened Jan 22, 2023 by timb-machine

[Intel]: https://www.stormshield.com/news/orbit-analysis-of-a-linux-dedicated-malware/ missing:tag:Non-persistentStorage missing:tag:ProcessTreeSpoofing missing:tag:ProcessTreeSpoofingForking missing:tag:RedirectionToNull missing:tag:T1001 missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.004 missing:tag:T1027.002 missing:tag:T1040 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1057 missing:tag:T1059.006 missing:tag:T1070.002 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1205 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1548.003 missing:tag:T1552.003 missing:tag:T1556.003 missing:tag:T1560 missing:tag:T1562.004 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.006 new

#601 opened Jan 21, 2023 by timb-machine

[Intel]: https://github.com/stealth/injectso missing:tag:Non-persistentStorage missing:tag:T1003.007 missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1027.002 missing:tag:T1057 missing:tag:T1069 missing:tag:T1070.002 missing:tag:T1078.003 missing:tag:T1083 new

#589 opened Nov 19, 2022 by timb-machine

[Intel]: https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html missing:tactics missing:tag:T1001 missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.002 missing:tag:T1027.002 missing:tag:T1048 missing:tag:T1057 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1567 missing:tag:T1573 missing:tag:wltm

#490 opened Aug 8, 2022 by timb-machine

[Intel]: https://www.fortinet.com/blog/threat-research/rapperbot-malware-discovery missing:tag:RedirectionToNull missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.002 missing:tag:T1021.004 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1057 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1222 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1552.004 missing:tag:T1567 missing:tag:T1573 new

#488 opened Aug 5, 2022 by timb-machine

[Intel]: https://github.com/CiscoCXSecurity/presentations/raw/master/Auditd%20for%20the%20newly%20threatened.pdf ignore:submodule missing:tag:Auditd missing:tag:Non-persistentStorage missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1021.002 missing:tag:T1021.004 missing:tag:T1027.002 missing:tag:T1027.004 missing:tag:T1048 missing:tag:T1053.006 missing:tag:T1055.008 missing:tag:T1055.012 missing:tag:T1057 missing:tag:T1069 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1205 missing:tag:T1222 missing:tag:T1491 missing:tag:T1543.002 missing:tag:T1548.001 missing:tag:T1548.003 missing:tag:T1552.004 missing:tag:T1558 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 missing:tag:T1620 missing:tag:T1622

#449 opened Jun 6, 2022 by timb-machine

[Intel]: https://github.com/CiscoCXSecurity/presentations/raw/master/The%20UNIX%20malware%20landscape%20-%20Reviewing%20the%20goods%20at%20MALWAREbazaar%20v5.pdf ignore:submodule missing:tactics missing:tag:Auditd missing:tag:Non-persistentStorage missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.002 missing:tag:T1027.002 missing:tag:T1027.004 missing:tag:T1048 missing:tag:T1057 missing:tag:T1071.001 missing:tag:T1071.002 missing:tag:T1078.003 missing:tag:T1222 missing:tag:T1491 missing:tag:T1548.001 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 new

#448 opened Jun 6, 2022 by timb-machine

[Intel]: https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1048 missing:tag:T1057 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1567 missing:tag:T1573

#446 opened Jun 3, 2022 by timb-machine

[Intel]: https://github.com/alex-cart/LEAF missing:tactics missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1078.003 missing:tag:T1518 missing:tag:T1548.003

#445 opened May 30, 2022 by timb-machine

[Intel]: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf missing:tag:eBPF missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1543.002 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 new

#423 opened May 8, 2022 by timb-machine

[Intel]: https://www.trendmicro.com/en_us/research/16/i/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems.html missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1006 missing:tag:T1021.002 missing:tag:T1037 missing:tag:T1040 missing:tag:T1046 missing:tag:T1048 missing:tag:T1055.008 missing:tag:T1057 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1070.006 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1222 missing:tag:T1491 missing:tag:T1518 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1552.003 missing:tag:T1556.003 missing:tag:T1561 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.006 missing:tag:T1622

#397 opened Apr 20, 2022 by timb-machine

[Intel]: http://www.thedarkside.nl/honeypot/microbul.html missing:tactics missing:tag:JavaScript missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1027.002 missing:tag:T1037 missing:tag:T1037.004 missing:tag:T1046 missing:tag:T1057 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1071.002 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1560 missing:tag:T1567 missing:tag:T1590 new

#388 opened Apr 20, 2022 by timb-machine

[Intel]: http://www.foo.be/cours/dess-20042005/report/bigwar.html#sc missing:tactics missing:tag:Non-persistentStorage missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.004 missing:tag:T1027.002 missing:tag:T1037 missing:tag:T1037.004 missing:tag:T1046 missing:tag:T1057 missing:tag:T1069 missing:tag:T1070.004 missing:tag:T1070.006 missing:tag:T1071.001 missing:tag:T1071.002 missing:tag:T1078.003 missing:tag:T1222 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1558 missing:tag:T1567 missing:tag:T1590 new

#386 opened Apr 20, 2022 by timb-machine

[Intel]: https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/ missing:tactics missing:tag:RedirectionToNull missing:tag:T1003.008 missing:tag:T1021.004 missing:tag:T1027.002 missing:tag:T1040 missing:tag:T1048 missing:tag:T1057 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1518 missing:tag:T1546.004 missing:tag:T1556.003 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.006 missing:tag:T1590 new

#371 opened Apr 20, 2022 by timb-machine

[Intel]: https://pastebin.com/raw/mEape37E missing:tactics missing:tag:Non-persistentStorage missing:tag:RedirectionToNull missing:tag:T1001 missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1021.004 missing:tag:T1037 missing:tag:T1046 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1070.006 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1222 missing:tag:T1518 missing:tag:T1543.002 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1552.003 missing:tag:T1552.004 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.007 new

#355 opened Apr 20, 2022 by timb-machine

[Intel]: https://igor-blue.github.io/2021/03/24/apt1.html ignore:tag:ProcessTreeSpoofingBindMountProc missing:tactics missing:tag:Auditd missing:tag:Non-persistentStorage missing:tag:ProcessTreeSpoofing missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1055.012 missing:tag:T1057 missing:tag:T1059.006 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1491 missing:tag:T1548.003 missing:tag:T1552.004 missing:tag:T1558 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 new

#302 opened Apr 20, 2022 by timb-machine

[Intel]: https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/ missing:tactics missing:tag:Auditd missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1037 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1070.006 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1098.004 missing:tag:T1491 missing:tag:T1518 missing:tag:T1543.002 missing:tag:T1546.004 missing:tag:T1548.003 missing:tag:T1552.004 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.007 missing:tag:T1590 new

#268 opened Apr 20, 2022 by timb-machine

[Intel]: https://github.com/timb-machine/obscure-forensics missing:tactics missing:tag:Non-persistentStorage missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1027.002 missing:tag:T1046 missing:tag:T1048 missing:tag:T1057 missing:tag:T1069 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1560 missing:tag:T1567 missing:tag:T1573 new

#267 opened Apr 20, 2022 by timb-machine

[Intel]: https://elastic.github.io/security-research/intelligence/2022/03/03.dirty-pipe/article/ missing:tactics missing:tag:Auditd missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1037 missing:tag:T1048 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1491 missing:tag:T1543.002 missing:tag:T1548.003 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1590 new

#265 opened Apr 20, 2022 by timb-machine

[Intel]: http://www.ouah.org/LKM_HACKING.html missing:tag:IRC missing:tag:Non-persistentStorage missing:tag:ProcessTreeSpoofing missing:tag:ProcessTreeSpoofingForking missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.002 missing:tag:T1027.004 missing:tag:T1048 missing:tag:T1055.008 missing:tag:T1055.012 missing:tag:T1057 missing:tag:T1070.002 missing:tag:T1070.004 missing:tag:T1070.006 missing:tag:T1071.001 missing:tag:T1071.002 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1215 missing:tag:T1222 missing:tag:T1491 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1567 missing:tag:T1574.006 missing:tag:T1574.007 missing:tag:T1590 missing:tag:T1622

#257 opened Apr 20, 2022 by timb-machine

[Intel]: https://medium.com/verint-cyber-engineering/linux-threat-hunting-primer-part-ii-69484f58ac92 missing:tactics missing:tag:Auditd missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1007 missing:tag:T1027.002 missing:tag:T1037 missing:tag:T1048 missing:tag:T1053.003 missing:tag:T1053.006 missing:tag:T1057 missing:tag:T1070.003 missing:tag:T1070.004 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1222 missing:tag:T1491 missing:tag:T1543.002 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1548.003 missing:tag:T1552.003 missing:tag:T1562.001 missing:tag:T1567 missing:tag:T1573 missing:tag:T1574.006 missing:tag:T1574.007 missing:tag:T1590 new

#247 opened Apr 20, 2022 by timb-machine

[Intel]: http://www.foo.be/cours/mssi-20072008/davidoff-clearmem-linux.pdf missing:tactics missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1021.004 missing:tag:T1057 missing:tag:T1070.003 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1083 missing:tag:T1552.003 missing:tag:T1567 missing:tag:T1590 new

#246 opened Apr 20, 2022 by timb-machine

[Intel]: http://shell-storm.org/api/?s=arm missing:tactics missing:tag:T1003.008 missing:tag:T1005 missing:tag:T1037 missing:tag:T1037.004 missing:tag:T1048 missing:tag:T1071.001 missing:tag:T1078.003 missing:tag:T1205 missing:tag:T1222 missing:tag:T1546.004 missing:tag:T1548.001 missing:tag:T1567 missing:tag:T1590 new

#243 opened Apr 20, 2022 by timb-machine

Previous 1 2 Next

Previous Next

ProTip! Mix and match filters to narrow down what you’re looking for.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly