Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)   |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Rocke has used Python-based malware to install and spread their coinminer.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Rocke has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Rocke has spread its coinminer via SSH.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1552.004|Private Keys|

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Rocke has used uname -m to collect the name and information about the infected system's kernel.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1070.002|Clear Linux or Mac System Logs|

Rocke has cleared log files within the /var/log/ folder.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|