Malware: SYNful Knock

Description

[SYNful Knock](https://attack.mitre.org/software/S0519) is a stealthy modification of the operating system of network devices that can be used to maintain persistence within a victim's network and provide new capabilities to the adversary.(Citation: Mandiant - Synful Knock)(Citation: Cisco Synful Knock Evolution)

External References

• mitre-attack
• Mandiant - Synful Knock
• Cisco Synful Knock Evolution

Techniques Used by This Malware

• T1205 — Traffic Signaling
• T1556.004 — Network Device Authentication
• T1601.001 — Patch System Image