[Intel]: https://gist.github.com/EvergreenCartoons/6c223e8f43e2fa4dc11c1c0a6118cbac

[timb-machine]

Area

Defensive tools

Parent threat

Persistence, Defense Evasion, Command and Control

Finding

https://gist.github.com/EvergreenCartoons/6c223e8f43e2fa4dc11c1c0a6118cbac

Industry reference

#568
attack:T1205.002:Socket Filters
attack:T1036:Masquerading
attack:T1070:Indicator Removal on Host
attack:T1205:Traffic Signaling

Malware reference

#420
#418
BPFDoor
Tricephalic Hellkeeper
Unix.Backdoor.RedMenshen
JustForFun

Actor reference

DecisiveArchitect

Component

Linux

Scenario

No response