[Intel]: https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/

Area

Malware reports

Parent threat

Initial Access, Credential Access, Impact

Finding

https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/

Industry reference

attack:T1078:Valid Accounts
attack:T1100:Brute Force
attack:T1498:Network Denial of Service
attack:T1053.003:Cron
attack:T1105:Ingress Tool Transfer
attack:T1027:Obfuscated Files or Information
attack:T1014:Rootkit
attack:T1082:System Information Discovery
attack:T1003.007:Proc Filesystem
attack:T1562.001:Disable or Modify Tools
attack:T1037.004:RC Scripts
attack:T1070.004:File Deletion
attack:T1036.005:Match Legitimate Name or Location
uses:Non-persistentStorage
uses:ioctl
uses:PortHiding
https://github.com/timb-machine/linux-malware/issues/129
uses:ProcessTreeSpoofing

Malware reference

XorDDoS
Rooty

Actor reference

No response

Component

Linux

Scenario

No response