malware

MEDUSA S1220

Type: malware
Platform: Linux
Created: 9 June 2025
Last modified: 9 June 2025

MEDUSA is an open-source rootkit that is capable of dynamic linker hijacking, command execution, and logging credentials.[1]

TechniquesBottom 17%

TacticsBottom 21%

Threat groupunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MEDUSA MITRE reference S1220

Rootkit T1014 ↗

MEDUSA is a rootkit with command execution and credential logging capabilities.2

Stealth6 detection rules

Encrypted/Encoded File T1027.013 ↗

MEDUSA can XOR encrypt configuration strings.3

Stealth1 detection rules

SSH Hijacking T1563.001 ↗

MEDUSA can be configured to capture SSH credentials via SSH hijacking.4

Lateral Movementno detection rules

Dynamic Linker Hijacking T1574.006 ↗

MEDUSA can execute code through dynamic linker hijacking of the LD_PRELOAD library.5

Execution · Stealth7 detection rules

Standing S1220

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique3.5medBottom 3%

3rd percentile · 97% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique3.5med

MEDUSA detections S1220

14 distinct rules cover the 4 techniques recorded for this malware. 11 Splunk · 3 Sigma.

3 covered by at least one rule1 with no coverage14 distinct rules in total

Showing 1-14 of 14 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the ld.so preload persistence file. (...)	Generic	test	-	linux	-	Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking	-	high	Christian Burkard (Nextron Systems)	2021-05-05	2022-10-09	7e3c4651-c347-40c4-b1d4-d48590fdf684
Splunk	The following analytic hunts for any creations or modifications to GitHub Actions workflow YAML files across the organization's Linux or Windows endpoints. (...)	Hunting	stable	file_event	linux · windows	Sysmon	Persistence Compromise Host Software Binary Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking Initial Access Supply Chain Compromise	-	medium	Michael Haag, Splunk	2025-11-25	2026-05-13	2a9f3a2e-2c07-4c5f-9e42-8f8f0b6b6a12
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. (...)	Generic	stable	process_creation	linux	Linux Auditd	Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	35c50572-a70b-452f-afa9-bebdf3c3ce36
Splunk	The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes. (...)	Generic	stable	file_event	linux	Linux Auditd	Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking	-	medium	Teoderick Contreras, Splunk	2022-01-12	2026-05-13	c1b7abca-55cb-4a39-bdfb-e28c1c12745f
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
Splunk	This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. (...)	Generic	stable	file_event	linux	Sysmon	Reconnaissance Gather Victim Identity Information Credentials Stealth Rootkit	-	medium	Raven Tait, Splunk	2022-04-26	2026-05-13	7add8520-71d5-43aa-b262-ee082b1f0238
Splunk	The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. (...)	Generic	stable	process_creation	linux	Sysmon	Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking	-	medium	Teoderick Contreras, Splunk	2022-01-05	2026-05-13	cbe2ca30-631e-11ec-8670-acde48001122
	Identifies modification of ld.so.preload for shared object injection. (...)	Generic	test	file_event	linux	Linux Auditd	Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	2019-10-24	2021-11-27	4b3cb710-5e83-4715-8c45-8b2b5b3e5751
Splunk	Detects creation or deletion of malicious GitHub Actions workflow files associated with Shai-Hulud w (...)	Generic	stable	file_event	linux · windows	Sysmon	Persistence Compromise Host Software Binary Execution, Stealth Hijack Execution Flow Dynamic Linker Hijacking Initial Access Supply Chain Compromise	-	medium	Michael Haag, Splunk	2025-11-25	2026-05-13	6b4a0a7f-10d1-4d72-9c4c-5c6a3d9f9d6a
	Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script	Generic	test	process_creation	linux	Sysmon	Stealth Rootkit	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-05	—	22236d75-d5a0-4287-bf06-c93b1770860f
Splunk	The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. (...)	Generic	stable	service	windows	WinEventLog System	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-05-16	2026-05-13	9216ef3d-066a-4958-8f27-c84589465e62
Splunk	The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). (...)	Hunting	stable	driver_load	windows	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-04-04	2026-05-13	d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68
Splunk	The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. (...)	Anomaly	stable	file_event	windows	Sysmon	Stealth Obfuscated Files or Information Encrypted/Encoded File	-	medium	Teoderick Contreras, Splunk	2021-08-03	2026-06-08	4ab6862b-ce88-4223-96c0-f6da2cffb898

Standing S1220

Title

Description