Spawn elevated Pneuma and relocate agent binary

/static/assets/linux-logo.svg
We execute pneuma agent as root and move it's location to /bin/pneuma to prepare for persistence.
locked
View Command

To view this TTPs command, you must be logged in with a professional or enterprise license.

Login

Test this TTP

Download Operator (1.7.1)
Test this TTP using one of our Operator chains
GTsST Sandworm Team

2022-06-07

/static/assets/linux-logo.svg
Emulate Sandworm privileged persistence from a campaign targeting Centreon systems