A Sophisticated Linux Rootkit Targeting Critical Infrastructure

PumakitLinux RootkitKernel ExploitsPumakit Rootkit

Pumakit is a sophisticated Linux rootkit that employs advanced evasion techniques to remain nearly undetectable. Identified by Elastic Security Labs, this malware toolkit infiltrates systems at the kernel level, granting attackers covert access and control. Its functions include intercepting system calls, concealing malicious activities, and exfiltrating data while bypassing traditional security measures. Pumakit’s emergence highlights the growing complexity of cyber threats targeting Linux environments.

Indicators of Compromise

Domains (2)

rhel.opsecurity1.artsec.opsecurity1.art

Hashes (17)

8ef63f9333104ab293eef5f34701669322f1c07c0e44973d688be39c94986e27bc9193c2a8ee47801f5f44beae51ab37a652fda02cd32d01f8e88bb793172491cb070cc9223445113c3217f05ef85a930f626d3feaaea54d8585aaed3c2b3cfee0f3e48c7dd577153e4dd46dd13470715f68a5e6bbf0fd636195d51fb5f21596d406b92f9e3d05cd85f7cd663221d7d3da8af8041aab475fb8ad4a7f94a7aa2b17c769d6ae04b977d984c4e842a61fb12ea99f58810f4b422b9c0a6718e9461de3a2eddae7fbe9808ad422f5f3d0409747ab1ac6a0919b1fa8d83c3da43564a685ae4044d0a0ea034375998ea157a8a21e1ead13052bad8ab5793af33aa19112ee45d56c51f268f7a7735259ba8c051d3905dac98c930e26e29e5b5b7abb3842992bbc07c6d7ba59773d111ba1b39944e9f0dca7acf31da96413f7f758b11272dede001b1c3aed205c243ac0de86d12f30b26707d5fb407ef39ebee37ded7edeea2890fb5ec1ebfa09a3b3edfc80db1f934955f0411538eebb24694982f546907f3c6df8534d6019b7ff165c4d10413671cc6a6547b5afda1844792ace7d5437d7e8d6db1ba995e1b2fb760699693f24

IPv4 (1)

89.23.113.204

Notes

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">CONCLUSION<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">The Pumakit campaign serves as a stark reminder of the ever-evolving sophistication of cyber threats targeting critical infrastructure. Its advanced kernel-level evasion tactics underscore the need for robust, proactive defenses. SOCRadar’s <a href="https://socradar.io/products/extended-threat-intelligence/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Extended Threat Intelligence </a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">platform provides a comprehensive solution for monitoring and mitigating such advanced threats. By leveraging modules like <a href="https://socradar.io/products/dark-web-monitoring/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Advanced Dark Web Monitoring</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">,<a href="https://socradar.io/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"> Cyber  Intelligence</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, and <a href="https://socradar.io/products/attack-surface-management/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;">Attack Surface Management</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">, organizations can gain actionable insights into emerging<a href="https://socradar.io/labs/campaigns/"><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(17, 85, 204); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; text-decoration-line: underline; vertical-align: baseline;"> campaigns</a><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> like Pumakit. These tools enable early detection, continuous threat monitoring, and the deployment of effective countermeasures to safeguard critical assets against stealthy malware like Pumakit.<div><span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>

Mitigation

<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">MITIGATION<span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Adversaries may use new payloads to execute this technique. Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.</td></tr><tr style="height:68.5pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1028</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Operating System Configuration</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries. Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.<a href="https://developer.apple.com/documentation/security/hardened_runtime"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[21]</a><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1055 Process Injection <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1040</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1040"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Behavior Prevention on Endpoint</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process. For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection. <a href="https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"><span style="font-size: 7pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">[86]</a></td></tr><tr style="height:68.5pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1026</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1026"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Privileged Account Management</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: rgb(255, 255, 255); font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only. Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1140 - Deobfuscate/Decode Files or Information<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features. <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1548.001: Setuid and Setgid <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1028</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1028"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Operating System Configuration</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1562.001 - Disable or Modify Tools <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:68.5pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use application control where appropriate, especially regarding the execution of tools outside of the organization's security policies (such as rootkit removal tools) that have been abused to impair system defenses. Ensure that only approved security applications are used and running on enterprise systems.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1024</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1024"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict Registry Permissions</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1018</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1018"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">User Account Management</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1036.005 - Match Legitimate Name or Location <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><tbody><tr style="height:37.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">ID</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Mitigation</td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:bottom;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 12pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Description</td></tr><tr style="height:42.25pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1045</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1045"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Code Signing</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Require signed binaries and images.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1038</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Execution Prevention</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.</td></tr><tr style="height:55.75pt;"><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">M1022</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1022"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(79, 124, 172); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Restrict File and Directory Permissions</a></td><td style="border-left:solid #dfdfdf 0.8333325pt;border-right:solid #dfdfdf 0.8333325pt;border-bottom:solid #dfdfdf 0.8333325pt;border-top:solid #dfdfdf 0.8333325pt;vertical-align:top;background-color:#f2f2f2;padding:5pt 5pt 5pt 5pt;overflow:hidden;overflow-wrap:break-word;"><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">Use file system access controls to protect folders such as C:\Windows\System32.</td></tr></tbody></table></div> <span style="font-size: 11pt; font-family: Arial, sans-serif; color: rgb(0, 0, 0); background-color: transparent; font-weight: 700; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">T1027 - Obfuscated Files or Information<span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;">This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.<div><span style="font-size: 10pt; font-family: Arial, sans-serif; color: rgb(33, 37, 41); background-color: transparent; font-variant-numeric: normal; font-variant-east-asian: normal; font-variant-alternates: normal; font-variant-position: normal; vertical-align: baseline;"> </div>