Drovorub
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1014 | Rootkit |
Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.[1] |
|
| Enterprise | T1005 | 从本地系统获取数据 | ||
| Enterprise | T1090 | .001 | 代理: Internal Proxy |
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.[1] |
| Enterprise | T1140 | 反混淆/解码文件或信息 |
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.[1] |
|
| Enterprise | T1547 | .006 | 启动或登录自动启动执行: Kernel Modules and Extensions |
Drovorub can use kernel modules to establish persistence.[1] |
| Enterprise | T1059 | .004 | 命令与脚本解释器: Unix Shell |
Drovorub can execute arbitrary commands as root on a compromised system.[1] |
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols |
Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.[1] |
| Enterprise | T1027 | 混淆文件或信息 |
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.[1] |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Drovorub can delete specific files from a compromised host.[1] |
| Enterprise | T1105 | 输入工具传输 | ||
| Enterprise | T1041 | 通过C2信道渗出 | ||
| Enterprise | T1095 | 非应用层协议 |
Drovorub can use TCP to communicate between its agent and client modules.[1] |
|