OP 05 December, 2022 - 12:31 AM
This document provides recommendations to protect Linux endpoints against adversary
techniques such as lateral movement, privilege escalation, and deploying rootkits or modified
kernel modules that possess either a malicious or destructive capability. Drovorub (https://
media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_
MALWARE_AUG_2020.PDF) is an example of a Linux malware toolset that includes a kernel
module rootkit that can be leveraged for command and control (C2) communications, file
download and upload capabilities, and the execution of arbitrary commands.
Similar to Windows-based architectures, security protections need to be aligned for Linux
endpoints to harden credentials, access methods, protect the kernel, and bolster auditing and
visibility of activities.
techniques such as lateral movement, privilege escalation, and deploying rootkits or modified
kernel modules that possess either a malicious or destructive capability. Drovorub (https://
media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_
MALWARE_AUG_2020.PDF) is an example of a Linux malware toolset that includes a kernel
module rootkit that can be leveraged for command and control (C2) communications, file
download and upload capabilities, and the execution of arbitrary commands.
Similar to Windows-based architectures, security protections need to be aligned for Linux
endpoints to harden credentials, access methods, protect the kernel, and bolster auditing and
visibility of activities.
.
