SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Cryptographic, hardware and side-channel attacks

Crypto private key theft

Wallet keys or seed phrases stolen via malware or social engineering

categoryCryptographic, hardware and side-channel attacksseverityVery Highdetectability (measured in our lab)Lowlabpartially detected

Example: Bybit $1.5B (2025)

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1552.004 · Copy Private SSH Keys with CP · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.004 --tool atomic --run-id <run-id> -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.004 -TestGuids 7c247dc7-5128-4643-907b-73a76d9135c3 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'
ATT&CK T1552.004 · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.004 --tool atomic --run-id run-2026-10-20-005 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.004 -TestGuids 7c247dc7-5128-4643-907b-73a76d9135c3 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'
ATT&CK T1552.004 · Atomic Red Team
sudo /opt/lab/detonate.sh --technique T1552.004 --tool atomic --run-id run-2026-10-27-031 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1552.004 -TestGuids 7c247dc7-5128-4643-907b-73a76d9135c3 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'

What our lab measured

partially detected linux · 2026-10-27

Plus 3 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~189 incidental alerts/hour — tune against this.

partially detected linux · 2026-10-20

Plus 3 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~189 incidental alerts/hour — tune against this.

Classification

35 values: 3 reviewed, 2 lab-measured, 18 imported, 1 derived, 11 machine-classified. What do these mean?

Exploitability

Attack vectorCredential attacks
Reach (CVSS)Network
Attack complexityLow
Privileges requiredNone
User interactionActive
Attacker skill requiredMedium
Resources requiredMedium
Likelihood / prevalenceHigh
MaturityEstablished

Impact & scope

SeverityVery High
ImpactAvailability
PlatformLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
EnvironmentCloudMobileOn-premises
Target asset classHumanIdentity
Kill-chain phase (tactic)Credential AccessImpact

Detection & telemetry

Detectability (measured in our lab)Low
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Application Log ContentCommand ExecutionFile AccessFile CreationFile ModificationLogon Session CreationNetwork Share AccessProcess Creation

Detection & response

Mitigated by 15

  • M1017 attack-mitigation
  • M1018 attack-mitigation
  • M1022 attack-mitigation
  • M1027 attack-mitigation
  • M1041 attack-mitigation
  • M1047 attack-mitigation
  • D3-ANCI d3fend
  • D3-CCSA d3fend
  • D3-CH d3fend
  • D3-CR d3fend
  • D3-CRO d3fend
  • D3-CTS d3fend
  • D3-DUC d3fend
  • D3-MFA d3fend
  • D3-RIC d3fend

Detected by 9

  • DET0495 attack-detection-strategy
  • DET0549 attack-detection-strategy
  • 1f978c6a-4415-47fb-aca5-736a44d7ca3d sigma
  • 213d6a77-3d55-4ce8-ba74-fcfef741974e sigma
  • 7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
  • 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb sigma
  • aa7a3fce-bef5-4311-9cc1-5f04bb8c308c sigma
  • b2815d0d-7481-4bf0-9b6c-a4c48a94b349 sigma
  • dca1b3e8-e043-4ec8-85d7-867f334b5724 sigma

Tested by 17

  • 12e4a260-a7fd-4ed8-bf18-1a28c1395775 atomic
  • 290df60e-4b5d-4a5e-b0c7-dc5348ea0c86 atomic
  • 2a5a0601-f5fb-4e2e-aa09-73282ae6afca atomic
  • 336b25bf-4514-4684-8924-474974f28137 atomic
  • 42c55554-3dcb-4df6-8fbb-c8ccacc478d4 atomic
  • 46959285-906d-40fa-9437-5a439accd878 atomic
  • 520ce462-7ca7-441e-b5a5-f8347f632696 atomic
  • 5e417277-0ae7-4ad5-a3e8-0fa27c122b29 atomic
  • 7617f689-bbd8-44bc-adcd-6f8968897848 atomic
  • 78b274f8-acb0-428b-b1f7-7b0d0e73330a atomic
  • 78e95057-d429-4e66-8f82-0f060c1ac96f atomic
  • 7c247dc7-5128-4643-907b-73a76d9135c3 atomic
  • 864bb0b2-6bb5-489a-b43b-a77b3a16d68a atomic
  • 922b1080-0b95-42b0-9585-b9a5ea0af044 atomic
  • b05ac39b-515f-48e9-88e9-2f141b5bcad0 atomic
  • cab413d8-9e4a-4b8d-9b84-c985bd73a442 atomic
  • e7568442-1b7d-4380-a933-b269d1326b6c atomic

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-20-005partially-detectedatomiclinux2026-10-20
run-2026-10-27-031partially-detectedatomiclinux2026-10-27
  • run-2026-10-20-005 — Backlog detectability-baseline probe (priority 5, 4 corpus attack(s); atomic_tests=17). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
  • run-2026-10-27-031 — Backlog detectability-baseline probe (priority 7, 4 corpus attack(s); atomic_tests=17). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1552.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cryptographic, hardware and side-channel attacks' table, line 563 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1552.004, attack:T1657 as the nearest framework entries; ids verified to exist in the cached catalogues.
  • ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 23 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 26 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-005 (partially-detected) for T1552.004: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-031 (partially-detected) for T1552.004: no alert matched the expected technique