Edge Appliance Rogue Package Install or NAT/Proxy Rule Addition (QTRouter)
Detects unauthorized changes to network appliance configurations, specifically the installation of new software packages using opkg or the modification of network address translation (NAT) rules via iptables or nftables. These actions can be used to maintain persistent access or establish covert command and control infrastructure.
Sigma
