John Wunder
53 lines
3.0 KiB
JSON
53 lines
3.0 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--20091e21-71bd-479c-825e-53747bf888a7",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--18d4ab39-12ed-4a16-9fdb-ae311bba4a0f",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"created": "2017-12-14T16:46:06.044Z",
|
|
"modified": "2018-01-17T12:56:55.080Z",
|
|
"name": "Rc.common",
|
|
"description": "During the boot process, macOS and Linux both execute <code>source /etc/rc.common</code>, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.\n\nAdversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user (Citation: Methods of Mac Malware Persistence).\n\nDetection: The <code>/etc/rc.common</code> file can be monitored to detect changes from the company policy. Monitor process execution resulting from the rc.common script for unusual or unknown applications or behavior.\n\nPlatforms: Linux, macOS\n\nData Sources: File monitoring, Process Monitoring\n\nPermissions Required: root",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persistence"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/wiki/Technique/T1163",
|
|
"external_id": "T1163"
|
|
},
|
|
{
|
|
"source_name": "Startup Items",
|
|
"description": "Apple. (2016, September 13). Startup Items. Retrieved July 11, 2017.",
|
|
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"
|
|
},
|
|
{
|
|
"source_name": "Methods of Mac Malware Persistence",
|
|
"description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.",
|
|
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_data_sources": [
|
|
"File monitoring",
|
|
"Process Monitoring"
|
|
],
|
|
"x_mitre_permissions_required": [
|
|
"root"
|
|
],
|
|
"x_mitre_platforms": [
|
|
"Linux",
|
|
"macOS"
|
|
]
|
|
}
|
|
]
|
|
} |