Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.1
- Talos Rocke August 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Rocke | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1014 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1496.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1037 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1014 | Rootkit | — |
| T1018 | Remote System Discovery | — |
| T1021.004 | SSH | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1027.004 | Compile After Delivery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1037 | Boot or Logon Initialization Scripts | — |
| T1046 | Network Service Discovery | — |
| T1053.003 | Cron | — |
| T1055.002 | Portable Executable Injection | — |
| T1057 | Process Discovery | — |
| T1059.004 | Unix Shell | — |
| T1059.006 | Python | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071 | Application Layer Protocol | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1102 | Web Service | — |
| T1102.001 | Dead Drop Resolver | — |
| T1105 | Ingress Tool Transfer | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1496.001 | Compute Hijacking | — |
| T1518.001 | Security Software Discovery | — |
| T1543.002 | Systemd Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1552.004 | Private Keys | — |
| T1564.001 | Hidden Files and Directories | — |
| T1571 | Non-Standard Port | — |
| T1574.006 | Dynamic Linker Hijacking | — |
| T1685 | Disable or Modify Tools | — |
| T1685.006 | Clear Linux or Mac System Logs | — |
| T1686 | Disable or Modify System Firewall | — |
别名
Rocke
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。