[Intel]: https://github.com/R3tr074/brokepkg

[timb-machine]

Area

Malware PoCs

Parent threat

Persistence, Privilege Escalation, Defense Evasion, Command and Control

Finding

https://github.com/R3tr074/brokepkg

Industry reference

uses:ProcessTreeSpoofing
uses:AbnormalSignal
uses:TamperCredStruct
uses:PortHiding
attack:T1547.006:Kernel Modules and Extensions
attack:T1564.001:Hidden Files and Directories
attack:T1573:Encrypted Channel
attack:T1205:Traffic Signaling

Malware reference

BrokePkg

Actor reference

No response

Component

Linux

Scenario

No response