cd00r
- ID
- S1204
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
cd00r is an open-source backdoor for UNIX and UNIX-variant operating systems that was orginally released in 2000. cd00r source code is primarily based on a packet-capturing program as it utilizes a sniffer to listen for specific sequences of network traffic or "secret knock" before executing the attacker's code.[1][2]
Techniques used (4)
- T1016 System Network Configuration Discovery
- T1040 Network Sniffing
- T1095 Non-Application Layer Protocol
- T1205.001 Port Knocking