AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Rocke
Aliases: Rocke
[Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1014 Rootkit simulation — Exact active technique ID
- T1014 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.004 Compile After Delivery simulation — Exact active technique ID
- T1027.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1037 Boot or Logon Initialization Scripts simulation — Exact active technique ID
- T1037 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.003 Cron simulation — Exact active technique ID
- T1053.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.002 Portable Executable Injection simulation — Exact active technique ID
- T1055.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.004 Unix Shell simulation — Exact active technique ID
- T1059.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.006 Timestomp simulation — Exact active technique ID
- T1070.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071 Application Layer Protocol simulation — Exact active technique ID
- T1071 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102 Web Service simulation — Exact active technique ID
- T1102 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.001 Dead Drop Resolver simulation — Exact active technique ID
- T1102.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1222.002 Linux and Mac Permissions simulation — Exact active technique ID
- T1222.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1496.001 Compute Hijacking simulation — Exact active technique ID
- T1496.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.002 Systemd Service simulation — Exact active technique ID
- T1543.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.004 Private Keys simulation — Exact active technique ID
- T1552.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.001 Hidden Files and Directories simulation — Exact active technique ID
- T1564.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.006 Dynamic Linker Hijacking simulation — Exact active technique ID
- T1574.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.006 Clear Linux or Mac System Logs simulation — Exact active technique ID
- T1685.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1686 Disable or Modify System Firewall simulation — Exact active technique ID
- T1686 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModel and dependency supply-chain security
AI Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameWeakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-matchData classification, storage, cryptography, keys, backup, and deletion
Cloud Security · topic-matchCloud logging, detection engineering, ATT CK, and response automation
Cloud Security · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchModule 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-matchResearch governance, authorization, and safety
Vulnerability Research & Exploit Development · topic-matchContainer image, registry, runtime, and host security
Cloud Security · topic-matchPublic code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · topic-match
Vulnerability Research & Exploit Development · explicit-idModel and dependency supply-chain security
AI Security · explicit-nameModule 4 — Web applications and APIs
Red Team & Offensive Security · explicit-nameWeakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-matchData classification, storage, cryptography, keys, backup, and deletion
Cloud Security · topic-matchCloud logging, detection engineering, ATT CK, and response automation
Cloud Security · topic-matchPrompt injection, instruction hierarchy, and secure output handling
AI Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchModule 13 — AI-assisted defense, RAG, agents, and MCP
Blue Team & Defensive Security · topic-matchResearch governance, authorization, and safety
Vulnerability Research & Exploit Development · topic-matchContainer image, registry, runtime, and host security
Cloud Security · topic-matchPublic code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · topic-match