Malware

Naturally I was curious about what Prelude Research’s Operator actually does, after coming across their page on SubStack, and I had a play around with it on a Windows laptop. Simulating a Remote Access Toolkit Most users of Prelude Operator will probably already know what ‘agents’ and ‘beacons’ are, and how they’re relevant to Red Team operations, but I haven’t covered much security-related things on my SubStack posts yet. Essentially what Operator simulates is a scenario in which an attacker had exploited a security vulnerability in a target system that enables the installation of malware.

!!! info Original post on my WordPress site The Scenario The following is a summary of what’s presented in the case study. It begins with the discovery of the following in file inetd.conf on a workstation running Red Hat Linux: netstat stream tcp nowait root /usr/lib/netstat netstat A graphical CPU load monitor showed 100% load, the top command indicated only 90%, and there were apparently no running processes listed that accounted for the discrepancy.