Alert Details - DeFender X

Alert Information High

Alert ID: ind:b4aeee57c4b841bc95cb853f0aca95e1:1766333883748286204-30106-173072
Composite ID: 84393bf974fd44bda943a25a6a7bc27f:ind:b4aeee57c4b841bc95cb853f0aca95e1:1766333883748286204-30106-173072
설명: The activity appears to be related to an adversary establishing persistence. The host may already be compromised and the activity should be investigated further to find the source.
호스트: localhost.localdomain
상태: new
생성 시간: 2025-12-22 01:19:06
업데이트 시간: 2025-12-22 02:18:06

MITRE ATT&CK

Tactic: Persistence
Technique: External Remote Services

Command Line

bash -c cat > /tmp/e.c << "E"
#include <stdlib.h>
void __attribute__((constructor)) i() { system("id"); }
E
gcc -shared -fPIC -o /tmp/e.so /tmp/e.c 2>/dev/null
LD_PRELOAD=/tmp/e.so ls 2>/dev/null
rm -f /tmp/e.c /tmp/e.so

Raw JSON Data

{"id":"ind:b4aeee57c4b841bc95cb853f0aca95e1:1766333883748286204-30106-173072","composite_id":"84393bf974fd44bda943a25a6a7bc27f:ind:b4aeee57c4b841bc95cb853f0aca95e1:1766333883748286204-30106-173072","agent_id":"b4aeee57c4b841bc95cb853f0aca95e1","cid":"84393bf974fd44bda943a25a6a7bc27f","description":"The activity appears to be related to an adversary establishing persistence. The host may already be compromised and the activity should be investigated further to find the source.","severity":70,"severity_name":"High","confidence":80,"tactic":"Persistence","tactic_id":"TA0003","technique":"External Remote Services","technique_id":"T1133","cmdline":"bash -c cat \u003E /tmp/e.c \u003C\u003C \u0022E\u0022\n#include \u003Cstdlib.h\u003E\nvoid __attribute__((constructor)) i() { system(\u0022id\u0022); }\nE\ngcc -shared -fPIC -o /tmp/e.so /tmp/e.c 2\u003E/dev/null\nLD_PRELOAD=/tmp/e.so ls 2\u003E/dev/null\nrm -f /tmp/e.c /tmp/e.so","filename":"bash","filepath":"/usr/bin/bash","sha256":"ec6d007d48ef11bc47ad3f372b4b20ff2f0d4e63867e7e4cc0f1b17b19fa88b2","status":"new","type":"ldt","created_timestamp":"2025-12-21T16:19:06.183874199Z","updated_timestamp":"2025-12-21T17:18:06.023488179Z","device":{"device_id":"b4aeee57c4b841bc95cb853f0aca95e1","cid":"84393bf974fd44bda943a25a6a7bc27f","agent_version":"7.31.18410.0","hostname":"localhost.localdomain","local_ip":"10.24.11.62","external_ip":"211.198.135.5","mac_address":"00-0c-29-89-f8-0a","platform_name":"Linux","os_version":"Rocky Linux 9.6"},"aggregate_id":"aggind:b4aeee57c4b841bc95cb853f0aca95e1:8596831573","CreatedAt":"2025-12-22T01:19:06.1838742+09:00","UpdatedAt":"2025-12-22T02:18:06.0234882+09:00"}