Cyberattack, Detection, Adversary Engagement, Threat Intelligence, Threat Informed Defense.
BRICKSTORM was found in VMs in the /mnt/cpt directory named tmpd and in the /bin directory named httpd (/mnt/cpt/tmpd and /bin/httpd). Both versions were given local persistence mechanisms. /mnt/cpt/tmpd was given both /etc/rc.local and /etc/init.d/urandom_seed while /bin/httpd was given