Upgrade implant to stage 2 (PneumaEX)
Tactic: Command-and-control
This TTP untars the payload containing PneumaEX and a shell script. The shell script checks for deep learning python
frameworks then upgrades the agent to PneumaEX. If it doesn't detect deep learning frameworks it will delete all elevation
artifacts.
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsPerform discovery techniques to determine if an agent has access to a ML/DL environment.
B1-66ER (Discovery)
2021-10-12
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github