cd00r is an open-source backdoor for UNIX and UNIX-variant operating systems that was orginally released in 2000. cd00r source code is primarily based on a packet-capturing program as it utilizes a sniffer to listen for specific sequences of network traffic or "secret knock" before executing the attacker's code.[1][2]
4
TechniquesBottom 17%
5
Tactics41st pct
0
Threat groupsNone recorded
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
cd00r can monitor for a single TCP-SYN packet to be sent in series to a configurable set of ports (200, 80, 22, 53 and 3 in the original code) before opening a port for communication.78
Persistence · Stealth · Command and Controlno detection rules
Standing S1204
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques4Bottom 17%
17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.
Tactics541st pct
41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique8medBottom 12%
12th percentile · 88% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique7.5med
cd00r detections S1204
41 distinct rules cover the 4 techniques recorded for this malware. 26 Sigma · 15 Splunk.
3 covered by at least one rule1 with no coverage41 distinct rules in total
Showing 1-41 of 41 rules
Drag headers to reorder | Drag edges to resize
Select
Title
Description
Category
Status
Event
OS
Product
MITRE ATT&CK
CVEs
Severity
Author
Created
Updated
ID
Refs
Splunk
This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...)
This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)
The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
2023-02-09
2024-08-01
43311e65-84d8-42a5-b3d4-c94d9b67038f
Splunk
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)
The following analytic detects the execution of common network sniffing tools on Windows systems, including Wireshark, WinPcap, tcpdump, and similar utilities. (...)
The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)
The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. (...)