title: Diicot/Opera Linux Loader Anti-Competition Cleanup
id: a28ee454-6b2c-43c2-a16b-a27b8efe668c
status: experimental
description: |
    Detects shell pipelines characteristic of the Diicot/Opera Linux loader,
    including crontab removal, chattr reset on authorized_keys, /dev/shm
    cleanup, removal of competitor artifact paths, and high-CPU process killing
    excluding sshd.
references:
    - https://research.ohiiho.com/part-3-adjacent-campaigns-defender-playbook
    - https://www.wiz.io/blog/diicot-threat-group-malware-campaign
author: OHIIHO Research
date: 2026-05-01
logsource:
    product: linux
    category: process_creation
detection:
    base:
        CommandLine|contains|all:
            - 'crontab -r'
            - 'chattr'
            - '/dev/shm'
    competitor_paths:
        CommandLine|contains:
            - '/tmp/.diicot'
            - '/tmp/kuak'
            - '/dev/shm/rete'
            - '/dev/shm/.x'
    high_cpu_kill:
        CommandLine|contains|all:
            - 'ps aux'
            - 'kill -9'
            - 'sshd'
    condition: base and (competitor_paths or high_cpu_kill)
falsepositives:
    - System administrators running ad-hoc cleanup pipelines are
      unlikely to combine all three patterns.
level: high
tags:
    - attack.execution
    - attack.t1059.004
    - attack.defense_evasion
