CARBONATO Persistence via docker-network-monitor Watchdog and chattr +i

Arnold Chan@slaz

•updated 11 days ago•1•0•1

Detects various persistence mechanisms used by the CARBONATO botnet on Linux systems, including registration of cron jobs, systemd services/timers, and the usage of 'chattr +i' to make persistence files immutable.