Hide Navigation Hide TOC

SYNful Knock - S0519 (84c1ecc6-e5a2-4e8a-bf4b-651a618e0053)

SYNful Knock is a stealthy modification of the operating system of network devices that can be used to maintain persistence within a victim's network and provide new capabilities to the adversary.(Citation: Mandiant - Synful Knock)(Citation: Cisco Synful Knock Evolution)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Patch System Image - T1601.001 (d245808a-7086-4310-984a-a84aaaa43f8f)	Attack Pattern	SYNful Knock - S0519 (84c1ecc6-e5a2-4e8a-bf4b-651a618e0053)	Malware	1
SYNful Knock - S0519 (84c1ecc6-e5a2-4e8a-bf4b-651a618e0053)	Malware	Network Device Authentication - T1556.004 (fa44a152-ac48-441e-a524-dd7b04b8adcd)	Attack Pattern	1
SYNful Knock - S0519 (84c1ecc6-e5a2-4e8a-bf4b-651a618e0053)	Malware	Traffic Signaling - T1205 (451a9977-d255-43c9-b431-66de80130c8c)	Attack Pattern	1
Modify System Image - T1601 (ae7f3575-0a5e-427e-991b-fe03ad44c754)	Attack Pattern	Patch System Image - T1601.001 (d245808a-7086-4310-984a-a84aaaa43f8f)	Attack Pattern	2
Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84)	Attack Pattern	Network Device Authentication - T1556.004 (fa44a152-ac48-441e-a524-dd7b04b8adcd)	Attack Pattern	2