Threat video1:00
Prometei Linux/Prometei.B Miner Botnet: Detection & IOCs
CUJO AI first documented the Linux Prometei miner in 2021. Its 9 detection rules, 38 IOCs and a free Splunk SPL rule cover the Monero-mining botnet.
Read the full threat intel for Prometei Linux/Prometei.B Miner Botnet: Detection & IOCs →
Chapters
- 0:00The hookPrometei botnet resurgence: 13 attack techniques.
- 0:04The storyReproduced in a lab: Prometei malware.
- 0:11Attack pathReproduced: brute-force credentials, fetch ELF.
- 0:27AttributionNo threat actor: this was defensive research.
- 0:32Indicators of compromise35 indicators to hunt: 5 IPs, 3 domains and 2 URLs, and more.
- 0:39MITRE ATT&CK techniques13 ATT&CK techniques, from initial access to impact.
- 0:43Remediation11 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Prometei botnet resurgence: 13 attack techniques.
0:05Reproduced in a lab: Prometei malware.
0:07Monero miner and credential stealer.
0:11Reproduced: brute-force credentials, fetch ELF.
0:14Packed ELF, installed via systemd.
0:17Collects host data, reports to C2.
0:20Mines Monero with proxy and TOR relayed.
0:23Spreads to child hosts.
0:28No threat actor: this was defensive research.
0:3235 indicators to hunt: 5 IPs, 3 domains and 2 URLs, and more.
0:3913 ATT&CK techniques, from initial access to impact.
0:4411 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.