BRICKSTORMS9015 ↗
Has copied itself to the usr/sbin/ folder.1
- Tactic
- Stealth
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 2.0
- Created
- 31 May 2024
- Last modified
- 12 May 2026
- Contributors
- Gregory Frey; Matt Anderson, @nosecurething, Huntress
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with File Deletion to cleanup older artifacts.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Relocate Malware MITRE reference T1070.010
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1070.010
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Relocate Malware detection strategy DET0439
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Malware Relocation via Suspicious File Movement
4 platforms
AN1216 · Windows
Detects the relocation of malicious executables via copy/move actions across suspicious folders (e.g., from Downloads to System32), followed by deletion of the original source or renaming to blend into legitimate binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File DeletionDC0040 | WinEventLog:Sysmon | EventCode=23 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SuspiciousTargetPathRegex | Patterns like \Windows\*, \System32\*, or temp+execution directories |
| TimeWindow | Correlate copy+rename+delete chains within 5-minute window |
| FileExtensionFilter | Limit to .exe, .dll, .js, .bat unless context suggests otherwise |
AN1217 · Linux
Detects binary movement or copying between untrusted and trusted paths (e.g., /tmp/ → /usr/bin/ or /etc/init.d/) that may indicate persistence attempts or cleanup of origin traces.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | auditd:SYSCALL | PATH |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RelocationPathPatterns | Match movement into known persistence or exclusion directories |
| BinaryEntropyThreshold | Apply threshold to detect high-entropy relocations (e.g., packed malware) |
AN1218 · macOS
Detects movement of binaries to ~/Library/, /System/, or app bundle locations, especially after initial execution or download from Safari or Mail.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | macos:osquery | file_events |
| Command ExecutionDC0064 | macos:unifiedlog | log stream |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetBundlePathPattern | Monitor relocation to .app/Contents/MacOS/ or ~/Library/Launch* |
| QuarantineFlagCheck | Check for disappearance of com.apple.quarantine attribute post-move |
AN1219 · Network Devices
Detects firmware or script relocation attempts (e.g., CLI-based copy, move, or rename) between temporary partitions and config startup folders on routers or switches.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | networkdevice:syslog | command audit |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StartupConfigPath | Targeted config folders like flash:/startup-config or nvram: |
| CommandPatternMatch | e.g., copy tftp flash, rename, move flash:/old.bin flash:/new.bin |