PANIXMalware
According to its author, PANIX is a powerful, modular, and highly customizable Linux persistence framework designed for security researchers, detection engineers, penetration testers, CTF enthusiasts, and more. Built with versatility in mind, PANIX emphasizes functionality, making it an essential tool for understanding and implementing a wide range of persistence techniques.From MISP Galaxy
Last reported 19 months ago, by Elastic Security Labs5 reports
ATT&CK techniques
6 of 40 · each with the sentence it comes from- T1053Scheduled Task/Job
“T1053 - scheduled task/job”
- T1546Event Triggered Execution
“T1546 - event triggered execution: udev”
- T1014Rootkit
“The /opt/bds_elf is a rootkit, leveraging rc.local as a persistence method.”
- T1543.002Systemd Service
“Similarly to Systemd services, SysV scripts must also be enabled.”
- T1098Account Manipulation
“T1098/T1136 - account manipulation/creation”
- T1098.004SSH Authorized Keys
“T1098.004 - account manipulation: SSH”
What the reports say
5 reports, newest first · the exact sentence from each-
Linux Detection Engineering - The Grand Finale on Linux Persistence“To make the process even more engaging, we will be leveraging PANIX, a custom-built Linux persistence tool designed by Ruben Groenewoud of Elastic Security.”
-
Linux Detection Engineering - Approaching the Summit on Persistence Mechanisms“To make the process even more engaging, we will be leveraging PANIX, a custom-built Linux persistence tool designed by Ruben Groenewoud of Elastic Security.”
-
Linux Detection Engineering - A Continuation on Persistence Mechanisms“To make the process even more engaging, we will be leveraging PANIX, a custom-built Linux persistence tool designed by Ruben Groenewoud of Elastic Security.”
-
Linux Detection Engineering - A Sequel on Persistence Mechanisms“To aid in this process, we’re sharing PANIX, a Linux persistence tool that Ruben Groenewoud of Elastic Security developed.”
-
Linux Detection Engineering - A primer on persistence mechanisms“To aid in this process, we’re sharing PANIX, a Linux persistence tool developed by Ruben Groenewoud of Elastic Security.”
Indicators in its reports
named in the reports above- action[.]idin 1 report
- multi-user[.]targetin 1 report
- system[.]mapin 1 report
- breachlabs[.]ioin 1 report
- hxxp://www.freedesktop[.]org/standards/dbus/1.0/busconfig.dtdin 1 report
- hxxps://github[.]com/Aegrah/PANIXin 1 report
- 9543f7ce4c6a8def…5a2d3f43383bin 1 report
- hxxp://192.168.1[.]100:8080/cmd.php?cmd=whoamiin 1 report
- hxxp://192.168.1[.]100:8080/cgi-bin/reverse.pyin 1 report
- timers[.]targetin 1 report
- default[.]targetin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.