corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087be-871a-716d-9022-ed2c7247bb81

Hunting for Persistence in Linux (Part 2): Account Creation and Manipulation

pberba.github.io · published 23 November 2021

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at pberba.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
13
Words captured
4,736

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells) Read at the source ↗
pberba.github.io
https://attack.mitre.org/techniques/T1136/001/
attack.mitre.org
https://attack.mitre.org/techniques/T1078/003/
attack.mitre.org
https://attack.mitre.org/techniques/T1098/004/
attack.mitre.org
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1136.001_CreateLocalAccount_Commands.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/discovery/T1087.001_LocalAccount_Commands.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1543.002_CreateModSystemProcess_Systemd.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
github.com
https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1037_BootLogonInitScripts_CommonDirectories.xml
github.com
https://unsplash.com/@cbarbalis
unsplash.com
Unsplash Read at the source ↗
unsplash.com
https://attack.mitre.org/techniques/T1098/
attack.mitre.org
https://attack.mitre.org/techniques/T1078/
attack.mitre.org