Rocke

Known techniques

• T1014Rootkit
• T1018Remote System Discovery
• T1021.004SSH
• T1027Obfuscated Files or Information
• T1027.002Software Packing
• T1027.004Compile After Delivery
• T1036.005Match Legitimate Resource Name or Location
• T1037Boot or Logon Initialization Scripts
• T1046Network Service Discovery
• T1053.003Cron
• T1055.002Portable Executable Injection
• T1057Process Discovery
• T1059.004Unix Shell
• T1059.006Python
• T1070.004File Deletion
• T1070.006Timestomp
• T1071Application Layer Protocol
• T1071.001Web Protocols
• T1082System Information Discovery
• T1102Web Service
• T1102.001Dead Drop Resolver
• T1105Ingress Tool Transfer
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1222.002Linux and Mac Permissions
• T1496.001Compute Hijacking
• T1518.001Security Software Discovery
• T1543.002Systemd Service
• T1547.001Registry Run Keys / Startup Folder
• T1552.004Private Keys
• T1564.001Hidden Files and Directories
• T1571Non-Standard Port
• T1574.006Dynamic Linker Hijacking
• T1685Disable or Modify Tools
• T1685.006Clear Linux or Mac System Logs
• T1686Disable or Modify System Firewall