← Back to Actors
Rocke
Rocke
[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)
39
Techniques
39
Covered
0
Gaps
100%
Coverage
Coverage39/39
COVERED (39)
T1014Rootkit31 det.T1018Remote System Discovery52 det.T1021.004SSH38 det.T1027Obfuscated Files or Information707 det.T1027.002Software Packing2 det.T1027.004Compile After Delivery10 det.T1036.005Match Legitimate Resource Name or Location49 det.T1037Boot or Logon Initialization Scripts27 det.T1046Network Service Discovery53 det.T1053.003Cron29 det.T1055.002Portable Executable Injection6 det.T1057Process Discovery24 det.T1059.004Unix Shell177 det.T1059.006Python55 det.T1070.002Clear Linux or Mac System Logs9 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1071Application Layer Protocol120 det.T1071.001Web Protocols83 det.T1082System Information Discovery91 det.T1102Web Service36 det.T1102.001Dead Drop Resolver9 det.T1105Ingress Tool Transfer199 det.T1140Deobfuscate/Decode Files or Information59 det.T1190Exploit Public-Facing Application240 det.T1222.002Linux and Mac Permissions19 det.T1496.001Compute Hijacking2 det.T1518.001Security Software Discovery11 det.T1543.002Systemd Service13 det.T1547.001Registry Run Keys / Startup Folder53 det.T1552.004Private Keys23 det.T1562.001Disable or Modify Tools332 det.T1562.004Disable or Modify System Firewall50 det.T1564.001Hidden Files and Directories26 det.T1571Non-Standard Port17 det.T1574.006Dynamic Linker Hijacking24 det.T1685Disable or Modify Tools281 det.T1685.006Clear Linux or Mac System Logs4 det.T1686Disable or Modify System Firewall19 det.