Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Rocke has deleted files on infected machines.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

Rocke has changed file permissions of files so they could not be modified.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Rocke has changed the time stamp of certain files.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1037|Boot or Logon Initialization Scripts|

Rocke has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux|T1543.002|Systemd Service|

Rocke has installed a systemd service script to maintain persistence.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|