ATT&CK Changes Between v11.3 and v12.0
Key
- New objects: ATT&CK objects which are only present in the new release.
- Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
- Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
- Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
- Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
- Object revocations: ATT&CK objects which are revoked by a different object.
- Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
- Object deletions: ATT&CK objects which are no longer found in the STIX data.
| Colors for description field |
|---|
| Added |
| Changed |
| Deleted |
|
Additional formats
These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
This JSON file contains the machine readble output used to create this page: changelog.json
Techniques
enterprise-attack
New Techniques
[T1070.008] Indicator Removal: Clear Mailbox Data
Current version: 1.0
Description: Adversaries may modify mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate email mailbox data to remove logs and artifacts, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page)
[T1070.007] Indicator Removal: Clear Network Connection History and Configurations
Current version: 1.0
Description: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.
Network connection history may be stored in various locations on a system. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
* HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers
Windows may also store information about recent RDP connections in files such as C:\Users\\%username%\Documents\Default.rdp and `C:\Users\%username%\AppData\Local\Microsoft\Terminal
Server Client\Cache\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)
Malicious network connections may also require changes to network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.
[T1070.009] Indicator Removal: Clear Persistence
Current version: 1.0
Description: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm)
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
[T1586.003] Compromise Accounts: Cloud Accounts
Current version: 1.0
Description: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
A variety of methods exist for compromising cloud accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, conducting [Password Spraying](https://attack.mitre.org/techniques/T1110/003) attacks, or attempting to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: MSTIC Nobelium Oct 2021) Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) between service providers and their customers.(Citation: MSTIC Nobelium Oct 2021)
[T1585.003] Establish Accounts: Cloud Accounts
Current version: 1.0
Description: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
Creating [Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) may also require adversaries to establish [Email Accounts](https://attack.mitre.org/techniques/T1585/002) to register with the cloud provider.
[T1593.003] Search Open Websites/Domains: Code Repositories
Current version: 1.0
Description: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Adversaries may search various public code repositories for various information about a victim. Public code repositories can often be a source of various general information about victims, such as commonly used programming languages and libraries as well as the names of employees. Adversaries may also identify more sensitive data, including accidentally leaked credentials or API keys.(Citation: GitHub Cloud Service Credentials) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Valid Accounts](https://attack.mitre.org/techniques/T1078) or [Phishing](https://attack.mitre.org/techniques/T1566)).
**Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1213/003), which focuses on [Collection](https://attack.mitre.org/tactics/TA0009) from private and internally hosted code repositories.
[T1027.007] Obfuscated Files or Information: Dynamic API Resolution
Current version: 1.0
Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.
API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing)
To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime.
Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)
[T1027.009] Obfuscated Files or Information: Embedded Payloads
Current version: 1.0
Description: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)
Adversaries may embed payloads in various file formats to hide payloads.(Citation: Microsoft Learn) This is similar to [Steganography](https://attack.mitre.org/techniques/T1027/003), though does not involve weaving malicious content into specific bytes and patterns related to legitimate digital media formats.(Citation: GitHub PSImage)
For example, adversaries have been observed embedding payloads within or as an overlay of an otherwise benign binary.(Citation: Securelist Dtrack2) Adversaries have also been observed nesting payloads (such as executables and run-only scripts) inside a file of the same format.(Citation: SentinelLabs reversing run-only applescripts 2021)
Embedded content may also be used as [Process Injection](https://attack.mitre.org/techniques/T1055) payloads used to infect benign system processes.(Citation: Trend Micro) These embedded then injected payloads may be used as part of the modules of malware designed to provide specific features such as encrypting C2 communications in support of an orchestrator module. For example, an embedded module may be injected into default browsers, allowing adversaries to then communicate via the network.(Citation: Malware Analysis Report ComRAT)
[T1556.007] Modify Authentication Process: Hybrid Identity
Current version: 1.0
Description: Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.
Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Azure AD includes three options for synchronizing identities between Active Directory and Azure AD(Citation: Azure AD Hybrid Identity):
* Password Hash Synchronization (PHS), in which a privileged on-premises account synchronizes user password hashes between Active Directory and Azure AD, allowing authentication to Azure AD to take place entirely in the cloud
* Pass Through Authentication (PTA), in which Azure AD authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory
* Active Directory Federation Services (AD FS), in which a trust relationship is established between Active Directory and Azure AD
AD FS can also be used with other SaaS and cloud platforms such as AWS and GCP, which will hand off the authentication process to AD FS and receive a token containing the hybrid users’ identity and privileges.
By modifying authentication processes tied to hybrid identities, an adversary may be able to establish persistent privileged access to cloud resources. For example, adversaries who compromise an on-premises server running a PTA agent may inject a malicious DLL into the `AzureADConnectAuthenticationAgentService` process that authorizes all attempts to authenticate to Azure AD, as well as records user credentials.(Citation: Azure AD Connect for Read Teamers)(Citation: AADInternals Azure AD On-Prem to Cloud) In environments using AD FS, an adversary may edit the `Microsoft.IdentityServer.Servicehost` configuration file to load a malicious DLL that generates authentication tokens for any user with any set of claims, thereby bypassing multi-factor authentication and defined AD FS policies.(Citation: MagicWeb)
In some cases, adversaries may be able to modify the hybrid identity authentication process from the cloud. For example, adversaries who compromise a Global Administrator account in an Azure AD tenant may be able to register a new PTA agent via the web console, similarly allowing them to harvest credentials and log into the Azure AD environment as any user.(Citation: Mandiant Azure AD Backdoors)
[T1546.016] Event Triggered Execution: Installer Packages
Current version: 1.0
Description: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)
Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)
Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed.
For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. Adversaries have leveraged `Prebuild` and `Postbuild` events to run commands before or after a build when installing .msi files.(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts)
[T1556.006] Modify Authentication Process: Multi-Factor Authentication
Current version: 1.0
Description: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions)
For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. (Citation: Russians Exploit Default MFA Protocol - CISA March 2022)
Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022)
[T1608.006] Stage Capabilities: SEO Poisoning
Current version: 1.0
Description: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)
To help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).(Citation: ZScaler SEO)(Citation: Atlas SEO)
Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.(Citation: MalwareBytes SEO)(Citation: DFIR Report Gootloader)
SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Citation: Sophos Gootloader)
[T1584.007] Compromise Infrastructure: Serverless
Current version: 1.0
Description: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers.(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
[T1583.007] Acquire Infrastructure: Serverless
Current version: 1.0
Description: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers.(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
[T1648] Serverless Execution
Current version: 1.0
Description: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)
Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)
[T1205.002] Traffic Signaling: Socket Filters
Current version: 1.0
Description: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.
To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing) Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. Communication with these socket filters may also be used in conjunction with [Protocol Tunneling](https://attack.mitre.org/techniques/T1572).(Citation: exatrack bpf filters passive backdoors)(Citation: Leonardo Turla Penquin May 2020)
Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.
[T1649] Steal or Forge Authentication Certificates
Current version: 1.0
Description: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Azure AD device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)), or directly from the Windows certificate store via various crypto APIs.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub CertStealer)(Citation: GitHub GhostPack Certificates) With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.(Citation: Medium Certified Pre Owned)
Abusing certificates for authentication credentials may enable other behaviors such as [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certificate-related misconfigurations may also enable opportunities for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable [Persistence](https://attack.mitre.org/tactics/TA0003) via stealing or forging certificates that can be used as [Valid Accounts](https://attack.mitre.org/techniques/T1078) for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish [Persistence](https://attack.mitre.org/tactics/TA0003) by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).(Citation: Medium Certified Pre Owned) Adversaries may also target certificates and related services in order to access other forms of credentials, such as [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) ticket-granting tickets (TGT) or NTLM plaintext.(Citation: Medium Certified Pre Owned)
[T1027.008] Obfuscated Files or Information: Stripped Payloads
Current version: 1.0
Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)
Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Major Version Changes
[T1530] Data from Cloud Storage
Current version: 2.0
Version changed from: 1.1 → 2.0
|
|
|---|
| t | Adversaries may access data objects from improperly secured | t | Adversaries may access data from improperly secured cloud st |
| cloud storage. Many cloud service providers offer solutions | | orage. Many cloud service providers offer solutions for onl |
| for online data storage such as Amazon S3, Azure Storage, a | | ine data object storage such as Amazon S3, Azure Storage, an |
| nd Google Cloud Storage. These solutions differ from other s | | d Google Cloud Storage. These solutions differ from other st |
| torage solutions (such as SQL or Elasticsearch) in that ther | | orage solutions (such as SQL or Elasticsearch) in that there |
| e is no overarching application. Data from these solutions c | | is no overarching application. Data from these solutions ca |
| an be retrieved directly using the cloud provider's APIs. So | | n be retrieved directly using the cloud provider's APIs. I |
| lution providers typically offer security guides to help end | | n other cases, SaaS application providers such as Slack, Con |
| users configure systems.(Citation: Amazon S3 Security, 2019 | | fluence, and Salesforce also provide cloud storage solutions |
| )(Citation: Microsoft Azure Storage Security, 2019)(Citation | | as a peripheral use case of their platform. These cloud obj |
| : Google Cloud Storage Best Practices, 2019) Misconfigurati | | ects can be extracted directly from their associated applica |
| on by end users is a common problem. There have been numerou | | tion.(Citation: EA Hacked via Slack - June 2021)(Citation: S |
| s incidents where cloud storage has been improperly secured | | ecureWorld - How Secure Is Your Slack Channel - Dec 2021)(Ci |
| (typically by unintentionally allowing public access by unau | | tation: HackerNews - 3 SaaS App Cyber Attacks - April 2022)( |
| thenticated users or overly-broad access by all users), allo | | Citation: Dark Clouds_Usenix_Mulazzani_08_2011) Adversaries |
| wing open access to credit cards, personally identifiable in | | may collect sensitive data from these cloud storage solutio |
| formation, medical records, and other sensitive information. | | ns. Providers typically offer security guides to help end us |
| (Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired | | ers configure systems, though misconfigurations are a common |
| Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breac | | problem.(Citation: Amazon S3 Security, 2019)(Citation: Micr |
| h, 2017) Adversaries may also obtain leaked credentials in s | | osoft Azure Storage Security, 2019)(Citation: Google Cloud S |
| ource repositories, logs, or other means as a way to gain ac | | torage Best Practices, 2019) There have been numerous incide |
| cess to cloud storage objects that have access permission co | | nts where cloud storage has been improperly secured, typical |
| ntrols. | | ly by unintentionally allowing public access to unauthentica |
| | | ted users, overly-broad access by all users, or even access |
| | | for any anonymous person outside the control of the Identity |
| | | Access Management system without even needing basic user pe |
| | | rmissions. This open access may expose various types of sen |
| | | sitive data, such as credit cards, personally identifiable i |
| | | nformation, or medical records.(Citation: Trend Micro S3 Exp |
| | | osed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(C |
| | | itation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-meg |
| | | a-extortion_05_2021) Adversaries may also obtain then abuse |
| | | leaked credentials from source repositories, logs, or other |
| | | means as a way to gain access to cloud storage objects. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:01.374000+00:00 | 2022-10-18 19:10:42.621000+00:00 |
| name | Data from Cloud Storage Object | Data from Cloud Storage |
| description | Adversaries may access data objects from improperly secured cloud storage.
Many cloud service providers offer solutions for online data storage such as Amazon S3, Azure Storage, and Google Cloud Storage. These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application. Data from these solutions can be retrieved directly using the cloud provider's APIs. Solution providers typically offer security guides to help end users configure systems.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019)
Misconfiguration by end users is a common problem. There have been numerous incidents where cloud storage has been improperly secured (typically by unintentionally allowing public access by unauthenticated users or overly-broad access by all users), allowing open access to credit cards, personally identifiable information, medical records, and other sensitive information.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017) Adversaries may also obtain leaked credentials in source repositories, logs, or other means as a way to gain access to cloud storage objects that have access permission controls. | Adversaries may access data from improperly secured cloud storage.
Many cloud service providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application. Data from these solutions can be retrieved directly using the cloud provider's APIs.
In other cases, SaaS application providers such as Slack, Confluence, and Salesforce also provide cloud storage solutions as a peripheral use case of their platform. These cloud objects can be extracted directly from their associated application.(Citation: EA Hacked via Slack - June 2021)(Citation: SecureWorld - How Secure Is Your Slack Channel - Dec 2021)(Citation: HackerNews - 3 SaaS App Cyber Attacks - April 2022)(Citation: Dark Clouds_Usenix_Mulazzani_08_2011)
Adversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.
This open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)
Adversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects. |
| external_references[1]['source_name'] | Amazon S3 Security, 2019 | SecureWorld - How Secure Is Your Slack Channel - Dec 2021 |
| external_references[1]['description'] | Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019. | Drew Todd. (2021, December 28). How Secure Is Your Slack Channel?. Retrieved May 31, 2022. |
| external_references[1]['url'] | https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/ | https://www.secureworld.io/industry-news/how-secure-is-your-slack-channel#:~:text=Electronic%20Arts%20hacked%20through%20Slack%20channel&text=In%20total%2C%20the%20hackers%20claim,credentials%20over%20a%20Slack%20channel. |
| external_references[2]['source_name'] | Microsoft Azure Storage Security, 2019 | Amazon S3 Security, 2019 |
| external_references[2]['description'] | Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20). Azure Storage security guide. Retrieved October 4, 2019. | Amazon. (2019, May 17). How can I secure the files in my Amazon S3 bucket?. Retrieved October 4, 2019. |
| external_references[2]['url'] | https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide | https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/ |
| external_references[3]['source_name'] | Google Cloud Storage Best Practices, 2019 | Microsoft Azure Storage Security, 2019 |
| external_references[3]['description'] | Google. (2019, September 16). Best practices for Cloud Storage. Retrieved October 4, 2019. | Amlekar, M., Brooks, C., Claman, L., et. al.. (2019, March 20). Azure Storage security guide. Retrieved October 4, 2019. |
| external_references[3]['url'] | https://cloud.google.com/storage/docs/best-practices | https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide |
| external_references[4]['source_name'] | Trend Micro S3 Exposed PII, 2017 | EA Hacked via Slack - June 2021 |
| external_references[4]['description'] | Trend Micro. (2017, November 6). A Misconfigured Amazon S3 Exposed Almost 50 Thousand PII in Australia. Retrieved October 4, 2019. | Anthony Spadafora. (2021, June 11). EA hack reportedly used stolen cookies and Slack to target gaming giant. Retrieved May 31, 2022. |
| external_references[4]['url'] | https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia | https://www.techradar.com/news/ea-hack-reportedly-used-stolen-cookies-and-slack-to-hack-gaming-giant |
| external_references[6]['source_name'] | HIPAA Journal S3 Breach, 2017 | Google Cloud Storage Best Practices, 2019 |
| external_references[6]['description'] | HIPAA Journal. (2017, October 11). 47GB of Medical Records and Test Results Found in Unsecured Amazon S3 Bucket. Retrieved October 4, 2019. | Google. (2019, September 16). Best practices for Cloud Storage. Retrieved October 4, 2019. |
| external_references[6]['url'] | https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/ | https://cloud.google.com/storage/docs/best-practices |
| x_mitre_version | 1.1 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'HackerNews - 3 SaaS App Cyber Attacks - April 2022', 'description': 'Hananel Livneh. (2022, April 7). Into the Breach: Breaking Down 3 SaaS App Cyber Attacks in 2022. Retrieved May 31, 2022.', 'url': 'https://thehackernews.com/2022/04/into-breach-breaking-down-3-saas-app.html'} |
| external_references | | {'source_name': 'HIPAA Journal S3 Breach, 2017', 'description': 'HIPAA Journal. (2017, October 11). 47GB of Medical Records and Test Results Found in Unsecured Amazon S3 Bucket. Retrieved October 4, 2019.', 'url': 'https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/'} |
| external_references | | {'source_name': 'Rclone-mega-extortion_05_2021', 'description': 'Justin Schoenfeld, Aaron Didier. (2021, May 4). Transferring leverage in a ransomware attack. Retrieved July 14, 2022.', 'url': 'https://redcanary.com/blog/rclone-mega-extortion/'} |
| external_references | | {'source_name': 'Dark Clouds_Usenix_Mulazzani_08_2011', 'description': 'Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber, and Edgar Weippl. (2011, August). Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space. Retrieved July 14, 2022.', 'url': 'https://www.usenix.org/conference/usenix-security-11/dark-clouds-horizon-using-cloud-storage-attack-vector-and-online-slack'} |
| external_references | | {'source_name': 'Trend Micro S3 Exposed PII, 2017', 'description': 'Trend Micro. (2017, November 6). A Misconfigured Amazon S3 Exposed Almost 50 Thousand PII in Australia. Retrieved October 4, 2019.', 'url': 'https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia'} |
| x_mitre_contributors | | AppOmni |
| x_mitre_platforms | | SaaS |
[T1070] Indicator Removal
Current version: 2.0
Version changed from: 1.3 → 2.0
|
|
|---|
| t | Adversaries may delete or modify artifacts generated on a ho | t | Adversaries may delete or modify artifacts generated within |
| st system to remove evidence of their presence or hinder def | | systems to remove evidence of their presence or hinder defen |
| enses. Various artifacts may be created by an adversary or s | | ses. Various artifacts may be created by an adversary or som |
| omething that can be attributed to an adversary’s actions. T | | ething that can be attributed to an adversary’s actions. Typ |
| ypically these artifacts are used as defensive indicators re | | ically these artifacts are used as defensive indicators rela |
| lated to monitored events, such as strings from downloaded f | | ted to monitored events, such as strings from downloaded fil |
| iles, logs that are generated from user actions, and other d | | es, logs that are generated from user actions, and other dat |
| ata analyzed by defenders. Location, format, and type of art | | a analyzed by defenders. Location, format, and type of artif |
| ifact (such as command or login history) are often specific | | act (such as command or login history) are often specific to |
| to each platform. Removal of these indicators may interfere | | each platform. Removal of these indicators may interfere w |
| with event collection, reporting, or other processes used t | | ith event collection, reporting, or other processes used to |
| o detect intrusion activity. This may compromise the integri | | detect intrusion activity. This may compromise the integrity |
| ty of security solutions by causing notable events to go unr | | of security solutions by causing notable events to go unrep |
| eported. This activity may also impede forensic analysis and | | orted. This activity may also impede forensic analysis and i |
| incident response, due to lack of sufficient data to determ | | ncident response, due to lack of sufficient data to determin |
| ine what occurred. | | e what occurred. |
New Detections:
- DS0003: Scheduled Job (Scheduled Job Modification)
- DS0018: Firewall (Firewall Rule Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 20:24:14.332000+00:00 | 2022-10-21 16:12:54.457000+00:00 |
| name | Indicator Removal on Host | Indicator Removal |
| description | Adversaries may delete or modify artifacts generated on a host system to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. | Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Content | Process: Process Creation |
| x_mitre_data_sources[1] | Process: OS API Execution | Scheduled Job: Scheduled Job Modification |
| x_mitre_data_sources[2] | Windows Registry: Windows Registry Key Deletion | User Account: User Account Authentication |
| x_mitre_data_sources[3] | File: File Modification | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[4] | Command: Command Execution | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[5] | File: File Metadata | Process: OS API Execution |
| x_mitre_data_sources[6] | Process: Process Creation | File: File Metadata |
| x_mitre_data_sources[7] | File: File Deletion | Firewall: Firewall Rule Modification |
| x_mitre_data_sources[8] | Windows Registry: Windows Registry Key Modification | Command: Command Execution |
| x_mitre_data_sources[9] | User Account: User Account Authentication | Windows Registry: Windows Registry Key Modification |
| x_mitre_version | 1.3 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Blake Strom, Microsoft 365 Defender |
| x_mitre_data_sources | | File: File Deletion |
| x_mitre_data_sources | | File: File Modification |
| x_mitre_platforms | | Office 365 |
| x_mitre_platforms | | Google Workspace |
Minor Version Changes
[T1098] Account Manipulation
Current version: 2.4
Version changed from: 2.3 → 2.4
New Mitigations:
- M1018: User Account Management
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-18 14:17:07.164000+00:00 | 2022-10-18 15:50:24.811000+00:00 |
| x_mitre_data_sources[0] | Command: Command Execution | File: File Modification |
| x_mitre_data_sources[1] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[2] | User Account: User Account Modification | Active Directory: Active Directory Object Modification |
| x_mitre_data_sources[3] | File: File Modification | Group: Group Modification |
| x_mitre_data_sources[4] | Group: Group Modification | User Account: User Account Modification |
| x_mitre_data_sources[5] | Active Directory: Active Directory Object Modification | Process: Process Creation |
| x_mitre_version | 2.3 | 2.4 |
[T1098.001] Account Manipulation: Additional Cloud Credentials
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may add adversary-controlled credentials to a cl | t | Adversaries may add adversary-controlled credentials to a cl |
| oud account to maintain persistent access to victim accounts | | oud account to maintain persistent access to victim accounts |
| and instances within the environment. Adversaries may add | | and instances within the environment. For example, adversa |
| credentials for Service Principals and Applications in addit | | ries may add credentials for Service Principals and Applicat |
| ion to existing legitimate credentials in Azure AD.(Citation | | ions in addition to existing legitimate credentials in Azure |
| : Microsoft SolarWinds Customer Guidance)(Citation: Blue Clo | | AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat |
| ud of Death)(Citation: Blue Cloud of Death Video) These cred | | ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide |
| entials include both x509 keys and passwords.(Citation: Micr | | o) These credentials include both x509 keys and passwords.(C |
| osoft SolarWinds Customer Guidance) With sufficient permissi | | itation: Microsoft SolarWinds Customer Guidance) With suffic |
| ons, there are a variety of ways to add credentials includin | | ient permissions, there are a variety of ways to add credent |
| g the Azure Portal, Azure command line interface, and Azure | | ials including the Azure Portal, Azure command line interfac |
| or Az PowerShell modules.(Citation: Demystifying Azure AD Se | | e, and Azure or Az PowerShell modules.(Citation: Demystifyin |
| rvice Principals) In infrastructure-as-a-service (IaaS) env | | g Azure AD Service Principals) In infrastructure-as-a-servi |
| ironments, after gaining access through [Cloud Accounts](htt | | ce (IaaS) environments, after gaining access through [Cloud |
| ps://attack.mitre.org/techniques/T1078/004), adversaries may | | Accounts](https://attack.mitre.org/techniques/T1078/004), ad |
| generate or import their own SSH keys using either the <cod | | versaries may generate or import their own SSH keys using ei |
| e>CreateKeyPair</code> or <code>ImportKeyPair</code> API in | | ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ |
| AWS or the <code>gcloud compute os-login ssh-keys add</code> | | code> API in AWS or the <code>gcloud compute os-login ssh-ke |
| command in GCP.(Citation: GCP SSH Key Add) This allows pers | | ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi |
| istent access to instances within the cloud environment with | | s allows persistent access to instances within the cloud env |
| out further usage of the compromised cloud accounts.(Citatio | | ironment without further usage of the compromised cloud acco |
| n: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) | | unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind |
| | | the Scenes) Adversaries may also use the <code>CreateAcces |
| | | sKey</code> API in AWS or the <code>gcloud iam service-accou |
| | | nts keys create</code> command in GCP to add access keys to |
| | | an account. If the target account has different permissions |
| | | from the requesting account, the adversary may also be able |
| | | to escalate their privileges in the environment (i.e. [Cloud |
| | | Accounts](https://attack.mitre.org/techniques/T1078/004)).( |
| | | Citation: Rhino Security Labs AWS Privilege Escalation) |
New Mitigations:
- M1018: User Account Management
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-19 14:16:53.885000+00:00 | 2022-10-24 15:20:47.020000+00:00 |
| description | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
Adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation) |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Rhino Security Labs AWS Privilege Escalation', 'description': 'Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.', 'url': 'https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/'} |
| x_mitre_contributors | | Alex Soler, AttackIQ |
[T1098.003] Account Manipulation: Additional Cloud Roles
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | An adversary may add additional roles or permissions to an a | t | An adversary may add additional roles or permissions to an a |
| dversary-controlled cloud account to maintain persistent acc | | dversary-controlled cloud account to maintain persistent acc |
| ess to a tenant. For example, they may update IAM policies i | | ess to a tenant. For example, adversaries may update IAM pol |
| n cloud-based environments or add a new global administrator | | icies in cloud-based environments or add a new global admini |
| in Office 365 environments.(Citation: AWS IAM Policies and | | strator in Office 365 environments.(Citation: AWS IAM Polici |
| Permissions)(Citation: Google Cloud IAM Policies)(Citation: | | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit |
| Microsoft Support O365 Add Another Admin, October 2019)(Cita | | ation: Microsoft Support O365 Add Another Admin, October 201 |
| tion: Microsoft O365 Admin Roles) With sufficient permission | | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per |
| s, a compromised account can gain almost unlimited access to | | missions, a compromised account can gain almost unlimited ac |
| data and settings (including the ability to reset the passw | | cess to data and settings (including the ability to reset th |
| ords of other admins).(Citation: Expel AWS Attacker) (Citati | | e passwords of other admins).(Citation: Expel AWS Attacker) |
| on: Microsoft O365 Admin Roles) This account modification | | (Citation: Microsoft O365 Admin Roles) This account modifi |
| may immediately follow [Create Account](https://attack.mitre | | cation may immediately follow [Create Account](https://attac |
| .org/techniques/T1136) or other malicious account activity. | | k.mitre.org/techniques/T1136) or other malicious account act |
| Adversaries may also modify an existing [Valid Accounts](htt | | ivity. Adversaries may also modify existing [Valid Accounts] |
| ps://attack.mitre.org/techniques/T1078) that they have compr | | (https://attack.mitre.org/techniques/T1078) that they have c |
| omised. This could lead to privilege escalation, particularl | | ompromised. This could lead to privilege escalation, particu |
| y if the roles added allow for lateral movement to additiona | | larly if the roles added allow for lateral movement to addit |
| l accounts. For example, in Azure AD environments, an advers | | ional accounts. For example, in Azure AD environments, an a |
| ary with the Application Administrator role can add [Additio | | dversary with the Application Administrator role can add [Ad |
| nal Cloud Credentials](https://attack.mitre.org/techniques/T | | ditional Cloud Credentials](https://attack.mitre.org/techniq |
| 1098/001) to their application's service principal. In doing | | ues/T1098/001) to their application's service principal. In |
| so the adversary would be able to gain the service principa | | doing so the adversary would be able to gain the service pri |
| l’s roles and permissions, which may be different from those | | ncipal’s roles and permissions, which may be different from |
| of the Application Administrator.(Citation: SpecterOps Azur | | those of the Application Administrator.(Citation: SpecterOps |
| e Privilege Escalation) | | Azure Privilege Escalation) Similarly, in AWS environments, |
| | | an adversary with appropriate permissions may be able to us |
| | | e the <code>CreatePolicyVersion</code> API to define a new v |
| | | ersion of an IAM policy or the <code>AttachUserPolicy</code> |
| | | API to attach an IAM policy with additional or distinct per |
| | | missions to a compromised user account.(Citation: Rhino Secu |
| | | rity Labs AWS Privilege Escalation) Similarly, an adversary |
| | | with the Azure AD Global Administrator role can toggle the |
| | | “Access management for Azure resources” option to gain the a |
| | | bility to assign privileged access to Azure subscriptions an |
| | | d virtual machines to Azure AD users, including themselves.( |
| | | Citation: Azure AD to AD) |
New Mitigations:
- M1018: User Account Management
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:29:25.547000+00:00 | 2022-10-24 15:21:19.955000+00:00 |
| description | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, they may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify an existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts. For example, in Azure AD environments, an adversary with the Application Administrator role can add [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to their application's service principal. In doing so the adversary would be able to gain the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
For example, in Azure AD environments, an adversary with the Application Administrator role can add [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to their application's service principal. In doing so the adversary would be able to gain the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) Similarly, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)
Similarly, an adversary with the Azure AD Global Administrator role can toggle the “Access management for Azure resources” option to gain the ability to assign privileged access to Azure subscriptions and virtual machines to Azure AD users, including themselves.(Citation: Azure AD to AD) |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Azure AD to AD', 'description': 'Sean Metcalf. (2020, May 27). From Azure AD to Active Directory (via Azure) – An Unanticipated Attack Path. Retrieved September 28, 2022.', 'url': 'https://adsecurity.org/?p=4277'} |
| external_references | | {'source_name': 'Rhino Security Labs AWS Privilege Escalation', 'description': 'Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.', 'url': 'https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/'} |
| x_mitre_contributors | | Praetorian |
| x_mitre_contributors | | Alex Soler, AttackIQ |
[T1557] Adversary-in-the-Middle
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may attempt to position themselves between two o | t | Adversaries may attempt to position themselves between two o |
| r more networked devices using an adversary-in-the-middle (A | | r more networked devices using an adversary-in-the-middle (A |
| iTM) technique to support follow-on behaviors such as [Netwo | | iTM) technique to support follow-on behaviors such as [Netwo |
| rk Sniffing](https://attack.mitre.org/techniques/T1040) or [ | | rk Sniffing](https://attack.mitre.org/techniques/T1040) or [ |
| Transmitted Data Manipulation](https://attack.mitre.org/tech | | Transmitted Data Manipulation](https://attack.mitre.org/tech |
| niques/T1565/002). By abusing features of common networking | | niques/T1565/002). By abusing features of common networking |
| protocols that can determine the flow of network traffic (e. | | protocols that can determine the flow of network traffic (e. |
| g. ARP, DNS, LLMNR, etc.), adversaries may force a device to | | g. ARP, DNS, LLMNR, etc.), adversaries may force a device to |
| communicate through an adversary controlled system so they | | communicate through an adversary controlled system so they |
| can collect information or perform additional actions.(Citat | | can collect information or perform additional actions.(Citat |
| ion: Rapid7 MiTM Basics) For example, adversaries may manip | | ion: Rapid7 MiTM Basics) For example, adversaries may manip |
| ulate victim DNS settings to enable other malicious activiti | | ulate victim DNS settings to enable other malicious activiti |
| es such as preventing/redirecting users from accessing legit | | es such as preventing/redirecting users from accessing legit |
| imate sites and/or pushing additional malware.(Citation: tti | | imate sites and/or pushing additional malware.(Citation: tti |
| nt_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_ | | nt_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_ |
| with_miner) [Downgrade Attack](https://attack.mitre.org/tech | | with_miner) Adversaries may also manipulate DNS and leverage |
| niques/T1562/010)s can also be used to establish an AiTM pos | | their position in order to intercept user credentials and s |
| ition, such as by negotiating a less secure, deprecated, or | | ession cookies.(Citation: volexity_0day_sophos_FW) [Downgrad |
| weaker version of communication protocol (SSL/TLS) or encryp | | e Attack](https://attack.mitre.org/techniques/T1562/010)s ca |
| tion algorithm.(Citation: mitm_tls_downgrade_att)(Citation: | | n also be used to establish an AiTM position, such as by neg |
| taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_at | | otiating a less secure, deprecated, or weaker version of com |
| t) Adversaries may also leverage the AiTM position to attem | | munication protocol (SSL/TLS) or encryption algorithm.(Citat |
| pt to monitor and/or modify traffic, such as in [Transmitted | | ion: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_at |
| Data Manipulation](https://attack.mitre.org/techniques/T156 | | t_tls)(Citation: tlseminar_downgrade_att) Adversaries may a |
| 5/002). Adversaries can setup a position similar to AiTM to | | lso leverage the AiTM position to attempt to monitor and/or |
| prevent traffic from flowing to the appropriate destination, | | modify traffic, such as in [Transmitted Data Manipulation](h |
| potentially to [Impair Defenses](https://attack.mitre.org/t | | ttps://attack.mitre.org/techniques/T1565/002). Adversaries c |
| echniques/T1562) and/or in support of a [Network Denial of S | | an setup a position similar to AiTM to prevent traffic from |
| ervice](https://attack.mitre.org/techniques/T1498). | | flowing to the appropriate destination, potentially to [Impa |
| | | ir Defenses](https://attack.mitre.org/techniques/T1562) and/ |
| | | or in support of a [Network Denial of Service](https://attac |
| | | k.mitre.org/techniques/T1498). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | Tu, L. Ma, Y. Ye, G. (2020, October 1). Ttint: An IoT Remote Access Trojan spread through 2 0-day vulnerabilities. Retrieved October 28, 2021. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-94 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 18:22:28.290000+00:00 | 2022-10-19 19:51:41.858000+00:00 |
| description | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)
For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)
Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)
For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)
Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). |
| external_references[2]['source_name'] | taxonomy_downgrade_att_tls | volexity_0day_sophos_FW |
| external_references[2]['description'] | Alashwali, E. S., Rasmussen, K. (2019, January 26). What's in a Downgrade? A Taxonomy of Downgrade Attacks in the TLS Protocol and Application Protocols Using TLS. Retrieved December 7, 2021. | Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022. |
| external_references[2]['url'] | https://arxiv.org/abs/1809.05681 | https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ |
| external_references[3]['source_name'] | ad_blocker_with_miner | taxonomy_downgrade_att_tls |
| external_references[3]['description'] | Kuzmenko, A.. (2021, March 10). Ad blocker with miner included. Retrieved October 28, 2021. | Alashwali, E. S., Rasmussen, K. (2019, January 26). What's in a Downgrade? A Taxonomy of Downgrade Attacks in the TLS Protocol and Application Protocols Using TLS. Retrieved December 7, 2021. |
| external_references[3]['url'] | https://securelist.com/ad-blocker-with-miner-included/101105/ | https://arxiv.org/abs/1809.05681 |
| external_references[4]['source_name'] | mitm_tls_downgrade_att | ad_blocker_with_miner |
| external_references[4]['description'] | praetorian Editorial Team. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved December 8, 2021. | Kuzmenko, A.. (2021, March 10). Ad blocker with miner included. Retrieved October 28, 2021. |
| external_references[4]['url'] | https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/ | https://securelist.com/ad-blocker-with-miner-included/101105/ |
| external_references[5]['source_name'] | Rapid7 MiTM Basics | mitm_tls_downgrade_att |
| external_references[5]['description'] | Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March 2, 2020. | praetorian Editorial Team. (2014, August 19). Man-in-the-Middle TLS Protocol Downgrade Attack. Retrieved December 8, 2021. |
| external_references[5]['url'] | https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/ | https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/ |
| external_references[6]['source_name'] | tlseminar_downgrade_att | Rapid7 MiTM Basics |
| external_references[6]['description'] | Team Cinnamon. (2017, February 3). Downgrade Attacks. Retrieved December 9, 2021. | Rapid7. (n.d.). Man-in-the-Middle (MITM) Attacks. Retrieved March 2, 2020. |
| external_references[6]['url'] | https://tlseminar.github.io/downgrade-attacks/ | https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/ |
| external_references[7]['source_name'] | ttint_rat | tlseminar_downgrade_att |
| external_references[7]['description'] | Tu, L. Ma, Y. Ye, G. (2020, October 1). Ttint: An IoT Remote Access Trojan spread through 2 0-day vulnerabilities. Retrieved October 28, 2021. | Team Cinnamon. (2017, February 3). Downgrade Attacks. Retrieved December 9, 2021. |
| external_references[7]['url'] | https://blog.netlab.360.com/ttint-an-iot-remote-control-trojan-spread-through-2-0-day-vulnerabilities/ | https://tlseminar.github.io/downgrade-attacks/ |
| external_references[8]['source_name'] | capec | ttint_rat |
| external_references[8]['url'] | https://capec.mitre.org/data/definitions/94.html | https://blog.netlab.360.com/ttint-an-iot-remote-control-trojan-spread-through-2-0-day-vulnerabilities/ |
| x_mitre_data_sources[0] | Service: Service Creation | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[1] | Windows Registry: Windows Registry Key Modification | Application Log: Application Log Content |
| x_mitre_data_sources[3] | Network Traffic: Network Traffic Content | Service: Service Creation |
| x_mitre_data_sources[4] | Application Log: Application Log Content | Network Traffic: Network Traffic Content |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/94.html', 'external_id': 'CAPEC-94'} |
| x_mitre_platforms | | Network |
[T1550.001] Use Alternate Authentication Material: Application Access Token
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:40:20.069000+00:00 | 2022-10-21 17:01:05.286000+00:00 |
| x_mitre_data_sources[0] | Application Log: Application Log Content | Web Credential: Web Credential Usage |
| x_mitre_data_sources[1] | Web Credential: Web Credential Usage | Application Log: Application Log Content |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Ian Davila, Tidal Cyber |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Azure AD |
[T1197] BITS Jobs
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may abuse BITS jobs to persistently execute or c | t | Adversaries may abuse BITS jobs to persistently execute code |
| lean up after malicious payloads. Windows Background Intelli | | and perform various background tasks. Windows Background In |
| gent Transfer Service (BITS) is a low-bandwidth, asynchronou | | telligent Transfer Service (BITS) is a low-bandwidth, asynch |
| s file transfer mechanism exposed through [Component Object | | ronous file transfer mechanism exposed through [Component Ob |
| Model](https://attack.mitre.org/techniques/T1559/001) (COM). | | ject Model](https://attack.mitre.org/techniques/T1559/001) ( |
| (Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is | | COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BIT |
| commonly used by updaters, messengers, and other application | | S is commonly used by updaters, messengers, and other applic |
| s preferred to operate in the background (using available id | | ations preferred to operate in the background (using availab |
| le bandwidth) without interrupting other networked applicati | | le idle bandwidth) without interrupting other networked appl |
| ons. File transfer tasks are implemented as BITS jobs, which | | ications. File transfer tasks are implemented as BITS jobs, |
| contain a queue of one or more file operations. The interf | | which contain a queue of one or more file operations. The i |
| ace to create and manage BITS jobs is accessible through [Po | | nterface to create and manage BITS jobs is accessible throug |
| werShell](https://attack.mitre.org/techniques/T1059/001) and | | h [PowerShell](https://attack.mitre.org/techniques/T1059/001 |
| the [BITSAdmin](https://attack.mitre.org/software/S0190) to | | ) and the [BITSAdmin](https://attack.mitre.org/software/S019 |
| ol.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin) | | 0) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSA |
| Adversaries may abuse BITS to download, execute, and even | | dmin) Adversaries may abuse BITS to download (e.g. [Ingress |
| clean up after running malicious code. BITS tasks are self-c | | Tool Transfer](https://attack.mitre.org/techniques/T1105)), |
| ontained in the BITS job database, without new files or regi | | execute, and even clean up after running malicious code (e. |
| stry modifications, and often permitted by host firewalls.(C | | g. [Indicator Removal](https://attack.mitre.org/techniques/T |
| itation: CTU BITS Malware June 2016)(Citation: Mondok Window | | 1070)). BITS tasks are self-contained in the BITS job databa |
| s PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) | | se, without new files or registry modifications, and often p |
| BITS enabled execution may also enable persistence by creat | | ermitted by host firewalls.(Citation: CTU BITS Malware June |
| ing long-standing jobs (the default maximum lifetime is 90 d | | 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Cita |
| ays and extendable) or invoking an arbitrary program when a | | tion: Symantec BITS May 2007) BITS enabled execution may als |
| job completes or errors (including after system reboots).(Ci | | o enable persistence by creating long-standing jobs (the def |
| tation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malwa | | ault maximum lifetime is 90 days and extendable) or invoking |
| re June 2016) BITS upload functionalities can also be used | | an arbitrary program when a job completes or errors (includ |
| to perform [Exfiltration Over Alternative Protocol](https:// | | ing after system reboots).(Citation: PaloAlto UBoatRAT Nov 2 |
| attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malwa | | 017)(Citation: CTU BITS Malware June 2016) BITS upload func |
| re June 2016) | | tionalities can also be used to perform [Exfiltration Over A |
| | | lternative Protocol](https://attack.mitre.org/techniques/T10 |
| | | 48).(Citation: CTU BITS Malware June 2016) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-13 21:36:04.956000+00:00 | 2022-09-14 19:21:26.447000+00:00 |
| description | Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016) | Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download (e.g. [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)), execute, and even clean up after running malicious code (e.g. [Indicator Removal](https://attack.mitre.org/techniques/T1070)). BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016) |
| external_references[1]['source_name'] | Microsoft COM | CTU BITS Malware June 2016 |
| external_references[1]['description'] | Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017. | Counter Threat Unit Research Team. (2016, June 6). Malware Lingers with BITS. Retrieved January 12, 2018. |
| external_references[1]['url'] | https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx | https://www.secureworks.com/blog/malware-lingers-with-bits |
| external_references[2]['source_name'] | Microsoft BITS | Symantec BITS May 2007 |
| external_references[2]['description'] | Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved January 12, 2018. | Florio, E. (2007, May 9). Malware Update with Windows Update. Retrieved January 12, 2018. |
| external_references[2]['url'] | https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx | https://www.symantec.com/connect/blogs/malware-update-windows-update |
| external_references[3]['source_name'] | Microsoft BITSAdmin | Elastic - Hunting for Persistence Part 1 |
| external_references[3]['description'] | Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018. | French, D., Murphy, B. (2020, March 24). Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1). Retrieved December 21, 2020. |
| external_references[3]['url'] | https://msdn.microsoft.com/library/aa362813.aspx | https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1 |
| external_references[4]['source_name'] | CTU BITS Malware June 2016 | PaloAlto UBoatRAT Nov 2017 |
| external_references[4]['description'] | Counter Threat Unit Research Team. (2016, June 6). Malware Lingers with BITS. Retrieved January 12, 2018. | Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018. |
| external_references[4]['url'] | https://www.secureworks.com/blog/malware-lingers-with-bits | https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ |
| external_references[5]['source_name'] | Mondok Windows PiggyBack BITS May 2007 | Microsoft Issues with BITS July 2011 |
| external_references[5]['description'] | Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background Intelligent Transfer Service. Retrieved January 12, 2018. | Microsoft. (2011, July 19). Issues with BITS. Retrieved January 12, 2018. |
| external_references[5]['url'] | https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/ | https://technet.microsoft.com/library/dd939934.aspx |
| external_references[6]['source_name'] | Symantec BITS May 2007 | Microsoft BITS |
| external_references[6]['description'] | Florio, E. (2007, May 9). Malware Update with Windows Update. Retrieved January 12, 2018. | Microsoft. (n.d.). Background Intelligent Transfer Service. Retrieved January 12, 2018. |
| external_references[6]['url'] | https://www.symantec.com/connect/blogs/malware-update-windows-update | https://msdn.microsoft.com/library/windows/desktop/bb968799.aspx |
| external_references[7]['source_name'] | PaloAlto UBoatRAT Nov 2017 | Microsoft BITSAdmin |
| external_references[7]['description'] | Hayashi, K. (2017, November 28). UBoatRAT Navigates East Asia. Retrieved January 12, 2018. | Microsoft. (n.d.). BITSAdmin Tool. Retrieved January 12, 2018. |
| external_references[7]['url'] | https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/ | https://msdn.microsoft.com/library/aa362813.aspx |
| external_references[8]['source_name'] | Microsoft Issues with BITS July 2011 | Microsoft COM |
| external_references[8]['description'] | Microsoft. (2011, July 19). Issues with BITS. Retrieved January 12, 2018. | Microsoft. (n.d.). Component Object Model (COM). Retrieved November 22, 2017. |
| external_references[8]['url'] | https://technet.microsoft.com/library/dd939934.aspx | https://msdn.microsoft.com/library/windows/desktop/ms680573.aspx |
| external_references[9]['source_name'] | Elastic - Hunting for Persistence Part 1 | Mondok Windows PiggyBack BITS May 2007 |
| external_references[9]['description'] | French, D., Murphy, B. (2020, March 24). Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1). Retrieved December 21, 2020. | Mondok, M. (2007, May 11). Malware piggybacks on Windows’ Background Intelligent Transfer Service. Retrieved January 12, 2018. |
| external_references[9]['url'] | https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1 | https://arstechnica.com/information-technology/2007/05/malware-piggybacks-on-windows-background-intelligent-transfer-service/ |
| x_mitre_data_sources[0] | Process: Process Creation | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[1] | Network Traffic: Network Connection Creation | Service: Service Metadata |
| x_mitre_data_sources[3] | Service: Service Metadata | Process: Process Creation |
| x_mitre_version | 1.2 | 1.3 |
[T1070.003] Indicator Removal: Clear Command History
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | In addition to clearing system logs, an adversary may clear | t | In addition to clearing system logs, an adversary may clear |
| the command history of a compromised account to conceal the | | the command history of a compromised account to conceal the |
| actions undertaken during an intrusion. Various command inte | | actions undertaken during an intrusion. Various command inte |
| rpreters keep track of the commands users type in their term | | rpreters keep track of the commands users type in their term |
| inal so that users can retrace what they've done. On Linux | | inal so that users can retrace what they've done. On Linux |
| and macOS, these command histories can be accessed in a few | | and macOS, these command histories can be accessed in a few |
| different ways. While logged in, this command history is tra | | different ways. While logged in, this command history is tra |
| cked in a file pointed to by the environment variable <code> | | cked in a file pointed to by the environment variable <code> |
| HISTFILE</code>. When a user logs off a system, this informa | | HISTFILE</code>. When a user logs off a system, this informa |
| tion is flushed to a file in the user's home directory calle | | tion is flushed to a file in the user's home directory calle |
| d <code>~/.bash_history</code>. The benefit of this is that | | d <code>~/.bash_history</code>. The benefit of this is that |
| it allows users to go back to commands they've used before i | | it allows users to go back to commands they've used before i |
| n different sessions. Adversaries may delete their commands | | n different sessions. Adversaries may delete their commands |
| from these logs by manually clearing the history (<code>his | | from these logs by manually clearing the history (<code>his |
| tory -c</code>) or deleting the bash history file <code>rm ~ | | tory -c</code>) or deleting the bash history file <code>rm ~ |
| /.bash_history</code>. Adversaries may also leverage a [N | | /.bash_history</code>. Adversaries may also leverage a [N |
| etwork Device CLI](https://attack.mitre.org/techniques/T1059 | | etwork Device CLI](https://attack.mitre.org/techniques/T1059 |
| /008) on network devices to clear command history data.(Cita | | /008) on network devices to clear command history data (<cod |
| tion: US-CERT-TA18-106A) On Windows hosts, PowerShell has t | | e>clear logging</code> and/or <code>clear history</code>).(C |
| wo different command history providers: the built-in history | | itation: US-CERT-TA18-106A) On Windows hosts, PowerShell ha |
| and the command history managed by the <code>PSReadLine</co | | s two different command history providers: the built-in hist |
| de> module. The built-in history only tracks the commands us | | ory and the command history managed by the <code>PSReadLine< |
| ed in the current session. This command history is not avail | | /code> module. The built-in history only tracks the commands |
| able to other sessions and is deleted when the session ends. | | used in the current session. This command history is not av |
| The <code>PSReadLine</code> command history tracks the com | | ailable to other sessions and is deleted when the session en |
| mands used in all PowerShell sessions and writes them to a f | | ds. The <code>PSReadLine</code> command history tracks the |
| ile (<code>$env:APPDATA\Microsoft\Windows\PowerShell\PSReadL | | commands used in all PowerShell sessions and writes them to |
| ine\ConsoleHost_history.txt</code> by default). This history | | a file (<code>$env:APPDATA\Microsoft\Windows\PowerShell\PSRe |
| file is available to all sessions and contains all past his | | adLine\ConsoleHost_history.txt</code> by default). This hist |
| tory since the file is not deleted when the session ends.(Ci | | ory file is available to all sessions and contains all past |
| tation: Microsoft PowerShell Command History) Adversaries m | | history since the file is not deleted when the session ends. |
| ay run the PowerShell command <code>Clear-History</code> to | | (Citation: Microsoft PowerShell Command History) Adversarie |
| flush the entire command history from a current PowerShell s | | s may run the PowerShell command <code>Clear-History</code> |
| ession. This, however, will not delete/flush the <code>Conso | | to flush the entire command history from a current PowerShel |
| leHost_history.txt</code> file. Adversaries may also delete | | l session. This, however, will not delete/flush the <code>Co |
| the <code>ConsoleHost_history.txt</code> file or edit its co | | nsoleHost_history.txt</code> file. Adversaries may also dele |
| ntents to hide PowerShell commands they have run.(Citation: | | te the <code>ConsoleHost_history.txt</code> file or edit its |
| Sophos PowerShell command audit)(Citation: Sophos PowerShell | | contents to hide PowerShell commands they have run.(Citatio |
| Command History Forensics) | | n: Sophos PowerShell command audit)(Citation: Sophos PowerSh |
| | | ell Command History Forensics) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:11:16.889000+00:00 | 2022-09-01 21:58:56.496000+00:00 |
| description | In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.
Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data.(Citation: US-CERT-TA18-106A)
On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.
The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)
Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) | In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
On Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.
Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A)
On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.
The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)
Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics) |
| x_mitre_data_sources[0] | Command: Command Execution | User Account: User Account Authentication |
| x_mitre_data_sources[2] | File: File Modification | Command: Command Execution |
| x_mitre_data_sources[3] | User Account: User Account Authentication | User Account: User Account Metadata |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | File: File Modification |
[T1213.003] Data from Information Repositories: Code Repositories
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may leverage code repositories to collect valuab | t | Adversaries may leverage code repositories to collect valuab |
| le information. Code repositories are tools/services that st | | le information. Code repositories are tools/services that st |
| ore source code and automate software builds. They may be ho | | ore source code and automate software builds. They may be ho |
| sted internally or privately on third party sites such as Gi | | sted internally or privately on third party sites such as Gi |
| thub, GitLab, SourceForge, and BitBucket. Users typically in | | thub, GitLab, SourceForge, and BitBucket. Users typically in |
| teract with code repositories through a web application or c | | teract with code repositories through a web application or c |
| ommand-line utilities such as git. Once adversaries gain a | | ommand-line utilities such as git. Once adversaries gain ac |
| ccess to a victim network or a private code repository, they | | cess to a victim network or a private code repository, they |
| may collect sensitive information such as proprietary sourc | | may collect sensitive information such as proprietary source |
| e code or credentials contained within software's source cod | | code or credentials contained within software's source code |
| e. Having access to software's source code may allow advers | | . Having access to software's source code may allow adversa |
| aries to develop [Exploits](https://attack.mitre.org/techniq | | ries to develop [Exploits](https://attack.mitre.org/techniqu |
| ues/T1587/004), while credentials may provide access to addi | | es/T1587/004), while credentials may provide access to addit |
| tional resources using [Valid Accounts](https://attack.mitre | | ional resources using [Valid Accounts](https://attack.mitre. |
| .org/techniques/T1078).(Citation: Wired Uber Breach)(Citatio | | org/techniques/T1078).(Citation: Wired Uber Breach)(Citation |
| n: Krebs Adobe) | | : Krebs Adobe) **Note:** This is distinct from [Code Reposi |
| | | tories](https://attack.mitre.org/techniques/T1593/003), whic |
| | | h focuses on conducting [Reconnaissance](https://attack.mitr |
| | | e.org/tactics/TA0043) via public code repositories. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 01:35:43.483000+00:00 | 2022-10-18 22:44:01.723000+00:00 |
| description | Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe) | Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)
**Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories. |
| x_mitre_version | 1.0 | 1.1 |
[T1553.002] Subvert Trust Controls: Code Signing
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may create, acquire, or steal code signing mater | t | Adversaries may create, acquire, or steal code signing mater |
| ials to sign their malware or tools. Code signing provides a | | ials to sign their malware or tools. Code signing provides a |
| level of authenticity on a binary from the developer and a | | level of authenticity on a binary from the developer and a |
| guarantee that the binary has not been tampered with. (Citat | | guarantee that the binary has not been tampered with. (Citat |
| ion: Wikipedia Code Signing) The certificates used during an | | ion: Wikipedia Code Signing) The certificates used during an |
| operation may be created, acquired, or stolen by the advers | | operation may be created, acquired, or stolen by the advers |
| ary. (Citation: Securelist Digital Certificates) (Citation: | | ary. (Citation: Securelist Digital Certificates) (Citation: |
| Symantec Digital Certificates) Unlike [Invalid Code Signatur | | Symantec Digital Certificates) Unlike [Invalid Code Signatur |
| e](https://attack.mitre.org/techniques/T1036/001), this acti | | e](https://attack.mitre.org/techniques/T1036/001), this acti |
| vity will result in a valid signature. Code signing to veri | | vity will result in a valid signature. Code signing to veri |
| fy software on first run can be used on modern Windows and m | | fy software on first run can be used on modern Windows and m |
| acOS/OS X systems. It is not used on Linux due to the decent | | acOS systems. It is not used on Linux due to the decentraliz |
| ralized nature of the platform. (Citation: Wikipedia Code Si | | ed nature of the platform. (Citation: Wikipedia Code Signing |
| gning) Code signing certificates may be used to bypass sec | | )(Citation: EclecticLightChecksonEXECodeSigning) Code signi |
| urity policies that require signed code to execute on a syst | | ng certificates may be used to bypass security policies that |
| em. | | require signed code to execute on a system. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-02-10 19:51:01.601000+00:00 | 2022-09-22 19:13:52.548000+00:00 |
| description | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.
Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)
Code signing certificates may be used to bypass security policies that require signed code to execute on a system. | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.
Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning)
Code signing certificates may be used to bypass security policies that require signed code to execute on a system. |
| external_references[1]['source_name'] | Wikipedia Code Signing | EclecticLightChecksonEXECodeSigning |
| external_references[1]['description'] | Wikipedia. (2015, November 10). Code Signing. Retrieved March 31, 2016. | Howard Oakley. (2020, November 16). Checks on executable code in Catalina and Big Sur: a first draft. Retrieved September 21, 2022. |
| external_references[1]['url'] | https://en.wikipedia.org/wiki/Code_signing | https://eclecticlight.co/2020/11/16/checks-on-executable-code-in-catalina-and-big-sur-a-first-draft/ |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Wikipedia Code Signing', 'description': 'Wikipedia. (2015, November 10). Code Signing. Retrieved March 31, 2016.', 'url': 'https://en.wikipedia.org/wiki/Code_signing'} |
[T1557.003] Adversary-in-the-Middle: DHCP Spoofing
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may redirect network traffic to adversary-owned | t | Adversaries may redirect network traffic to adversary-owned |
| systems by spoofing Dynamic Host Configuration Protocol (DHC | | systems by spoofing Dynamic Host Configuration Protocol (DHC |
| P) traffic and acting as a malicious DHCP server on the vict | | P) traffic and acting as a malicious DHCP server on the vict |
| im network. By achieving the adversary-in-the-middle (AiTM) | | im network. By achieving the adversary-in-the-middle (AiTM) |
| position, adversaries may collect network communications, in | | position, adversaries may collect network communications, in |
| cluding passed credentials, especially those sent over insec | | cluding passed credentials, especially those sent over insec |
| ure, unencrypted protocols. This may also enable follow-on b | | ure, unencrypted protocols. This may also enable follow-on b |
| ehaviors such as [Network Sniffing](https://attack.mitre.org | | ehaviors such as [Network Sniffing](https://attack.mitre.org |
| /techniques/T1040) or [Transmitted Data Manipulation](https: | | /techniques/T1040) or [Transmitted Data Manipulation](https: |
| //attack.mitre.org/techniques/T1565/002). DHCP is based on | | //attack.mitre.org/techniques/T1565/002). DHCP is based on |
| a client-server model and has two functionalities: a protoco | | a client-server model and has two functionalities: a protoco |
| l for providing network configuration settings from a DHCP s | | l for providing network configuration settings from a DHCP s |
| erver to a client and a mechanism for allocating network add | | erver to a client and a mechanism for allocating network add |
| resses to clients.(Citation: rfc2131) The typical server-cli | | resses to clients.(Citation: rfc2131) The typical server-cli |
| ent interaction is as follows: 1. The client broadcasts a | | ent interaction is as follows: 1. The client broadcasts a |
| `DISCOVER` message. 2. The server responds with an `OFFER` | | `DISCOVER` message. 2. The server responds with an `OFFER` |
| message, which includes an available network address. 3. T | | message, which includes an available network address. 3. T |
| he client broadcasts a `REQUEST` message, which includes the | | he client broadcasts a `REQUEST` message, which includes the |
| network address offered. 4. The server acknowledges with | | network address offered. 4. The server acknowledges with |
| an `ACK` message and the client receives the network configu | | an `ACK` message and the client receives the network configu |
| ration parameters. Adversaries may spoof as a rogue DHCP se | | ration parameters. Adversaries may spoof as a rogue DHCP se |
| rver on the victim network, from which legitimate hosts may | | rver on the victim network, from which legitimate hosts may |
| receive malicious network configurations. For example, malwa | | receive malicious network configurations. For example, malwa |
| re can act as a DHCP server and provide adversary-owned DNS | | re can act as a DHCP server and provide adversary-owned DNS |
| servers to the victimized computers.(Citation: new_rogue_DHC | | servers to the victimized computers.(Citation: new_rogue_DHC |
| P_serv_malware)(Citation: w32.tidserv.g) Through the malicio | | P_serv_malware)(Citation: w32.tidserv.g) Through the malicio |
| us network configurations, an adversary may achieve the AiTM | | us network configurations, an adversary may achieve the AiTM |
| position, route client traffic through adversary-controlled | | position, route client traffic through adversary-controlled |
| systems, and collect information from the client network. | | systems, and collect information from the client network. |
| Rather than establishing an AiTM position, adversaries may a | | DHCPv6 clients can receive network configuration information |
| lso abuse DHCP spoofing to perform a DHCP exhaustion attack | | without being assigned an IP address by sending a <code>INF |
| (i.e. [Service Exhaustion Flood](https://attack.mitre.org/te | | ORMATION-REQUEST (code 11)</code> message to the <code>All_D |
| chniques/T1499/002)) by generating many broadcast DISCOVER m | | HCP_Relay_Agents_and_Servers</code> multicast address.(Citat |
| essages to exhaust a network’s DHCP allocation pool. | | ion: rfc3315) Adversaries may use their rogue DHCP server to |
| | | respond to this request message with malicious network conf |
| | | igurations. Rather than establishing an AiTM position, adve |
| | | rsaries may also abuse DHCP spoofing to perform a DHCP exhau |
| | | stion attack (i.e, [Service Exhaustion Flood](https://attack |
| | | .mitre.org/techniques/T1499/002)) by generating many broadca |
| | | st DISCOVER messages to exhaust a network’s DHCP allocation |
| | | pool. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-18 19:59:22.916000+00:00 | 2022-10-21 15:18:16.023000+00:00 |
| description | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:
1. The client broadcasts a `DISCOVER` message.
2. The server responds with an `OFFER` message, which includes an available network address.
3. The client broadcasts a `REQUEST` message, which includes the network address offered.
4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.
Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.
Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e. [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.(Citation: rfc2131) The typical server-client interaction is as follows:
1. The client broadcasts a `DISCOVER` message.
2. The server responds with an `OFFER` message, which includes an available network address.
3. The client broadcasts a `REQUEST` message, which includes the network address offered.
4. The server acknowledges with an `ACK` message and the client receives the network configuration parameters.
Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations. For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.(Citation: new_rogue_DHCP_serv_malware)(Citation: w32.tidserv.g) Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.
DHCPv6 clients can receive network configuration information without being assigned an IP address by sending a INFORMATION-REQUEST (code 11) message to the All_DHCP_Relay_Agents_and_Servers multicast address.(Citation: rfc3315) Adversaries may use their rogue DHCP server to respond to this request message with malicious network configurations.
Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack (i.e, [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002)) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool. |
| external_references[3]['source_name'] | dhcp_serv_op_events | rfc3315 |
| external_references[3]['description'] | Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022. | J. Bound, et al. (2003, July). Dynamic Host Configuration Protocol for IPv6 (DHCPv6). Retrieved June 27, 2022. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800668(v=ws.11) | https://datatracker.ietf.org/doc/html/rfc3315 |
| external_references[4]['source_name'] | solution_monitor_dhcp_scopes | dhcp_serv_op_events |
| external_references[4]['description'] | Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved March 7, 2022. | Microsoft. (2006, August 31). DHCP Server Operational Events. Retrieved March 7, 2022. |
| external_references[4]['url'] | https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/ | https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800668(v=ws.11) |
| external_references[5]['source_name'] | w32.tidserv.g | solution_monitor_dhcp_scopes |
| external_references[5]['description'] | Symantec. (2009, March 22). W32.Tidserv.G. Retrieved January 14, 2022. | Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved March 7, 2022. |
| external_references[5]['url'] | https://web.archive.org/web/20150923175837/http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2 | https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/ |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Flow | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[2] | Network Traffic: Network Traffic Content | Network Traffic: Network Traffic Flow |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'w32.tidserv.g', 'description': 'Symantec. (2009, March 22). W32.Tidserv.G. Retrieved January 14, 2022.', 'url': 'https://web.archive.org/web/20150923175837/http://www.symantec.com/security_response/writeup.jsp?docid=2009-032211-2952-99&tabid=2'} |
| x_mitre_contributors | | Andrew Allen, @whitehat_zero |
[T1590.002] Gather Victim Network Information: DNS
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may gather information about the victim's DNS th | t | Adversaries may gather information about the victim's DNS th |
| at can be used during targeting. DNS information may include | | at can be used during targeting. DNS information may include |
| a variety of details, including registered name servers as | | a variety of details, including registered name servers as |
| well as records that outline addressing for a target’s subdo | | well as records that outline addressing for a target’s subdo |
| mains, mail servers, and other hosts. Adversaries may gathe | | mains, mail servers, and other hosts. DNS, MX, TXT, and SPF |
| r this information in various ways, such as querying or othe | | records may also reveal the use of third party cloud and Saa |
| rwise collecting details via [DNS/Passive DNS](https://attac | | S providers, such as Office 365, G Suite, Salesforce, or Zen |
| k.mitre.org/techniques/T1596/001). DNS information may also | | desk.(Citation: Sean Metcalf Twitter DNS Records) Adversari |
| be exposed to adversaries via online or other accessible dat | | es may gather this information in various ways, such as quer |
| a sets (ex: [Search Open Technical Databases](https://attack | | ying or otherwise collecting details via [DNS/Passive DNS](h |
| .mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citat | | ttps://attack.mitre.org/techniques/T1596/001). DNS informati |
| ion: Circl Passive DNS) Gathering this information may revea | | on may also be exposed to adversaries via online or other ac |
| l opportunities for other forms of reconnaissance (ex: [Sear | | cessible data sets (ex: [Search Open Technical Databases](ht |
| ch Open Technical Databases](https://attack.mitre.org/techni | | tps://attack.mitre.org/techniques/T1596)).(Citation: DNS Dum |
| ques/T1596), [Search Open Websites/Domains](https://attack.m | | pster)(Citation: Circl Passive DNS) Gathering this informati |
| itre.org/techniques/T1593), or [Active Scanning](https://att | | on may reveal opportunities for other forms of reconnaissanc |
| ack.mitre.org/techniques/T1595)), establishing operational r | | e (ex: [Search Open Technical Databases](https://attack.mitr |
| esources (ex: [Acquire Infrastructure](https://attack.mitre. | | e.org/techniques/T1596), [Search Open Websites/Domains](http |
| org/techniques/T1583) or [Compromise Infrastructure](https:/ | | s://attack.mitre.org/techniques/T1593), or [Active Scanning] |
| /attack.mitre.org/techniques/T1584)), and/or initial access | | (https://attack.mitre.org/techniques/T1595)), establishing o |
| (ex: [External Remote Services](https://attack.mitre.org/tec | | perational resources (ex: [Acquire Infrastructure](https://a |
| hniques/T1133)). | | ttack.mitre.org/techniques/T1583) or [Compromise Infrastruct |
| | | ure](https://attack.mitre.org/techniques/T1584)), and/or ini |
| | | tial access (ex: [External Remote Services](https://attack.m |
| | | itre.org/techniques/T1133)). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:29:18.740000+00:00 | 2022-10-21 14:32:48.393000+00:00 |
| description | Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.
Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). | Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)
Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). |
| external_references[1]['source_name'] | DNS Dumpster | Circl Passive DNS |
| external_references[1]['description'] | Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020. | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. |
| external_references[1]['url'] | https://dnsdumpster.com/ | https://www.circl.lu/services/passive-dns/ |
| external_references[2]['source_name'] | Circl Passive DNS | DNS Dumpster |
| external_references[2]['description'] | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. | Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020. |
| external_references[2]['url'] | https://www.circl.lu/services/passive-dns/ | https://dnsdumpster.com/ |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Sean Metcalf Twitter DNS Records', 'description': 'Sean Metcalf. (2019, May 9). Sean Metcalf Twitter. Retrieved May 27, 2022.', 'url': 'https://twitter.com/PyroTek3/status/1126487227712921600/photo/1'} |
[T1071.004] Application Layer Protocol: DNS
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 16:26:34.196000+00:00 | 2022-06-17 13:52:03.232000+00:00 |
| external_references[1]['source_name'] | PAN DNS Tunneling | Medium DnsTunneling |
| external_references[1]['description'] | Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020. | Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020. |
| external_references[1]['url'] | https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling | https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000 |
| external_references[2]['source_name'] | Medium DnsTunneling | University of Birmingham C2 |
| external_references[2]['description'] | Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020. | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. |
| external_references[2]['url'] | https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000 | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf |
| external_references[3]['source_name'] | University of Birmingham C2 | PAN DNS Tunneling |
| external_references[3]['description'] | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. | Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020. |
| external_references[3]['url'] | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf | https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Content | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Flow | Network Traffic: Network Traffic Content |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Chris Heald |
[T1486] Data Encrypted for Impact
Current version: 1.4
Version changed from: 1.3 → 1.4
New Detections:
- DS0033: Network Share (Network Share Access)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 17:59:45.105000+00:00 | 2022-06-16 13:07:10.318000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_data_sources[3] | Cloud Storage: Cloud Storage Modification | File: File Creation |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ExtraHop |
| x_mitre_data_sources | | Cloud Storage: Cloud Storage Modification |
| x_mitre_data_sources | | Network Share: Network Share Access |
| x_mitre_data_sources | | Network Share: Network Share Access |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | File: File Creation | |
[T1005] Data from Local System
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:34:15.405000+00:00 | 2022-10-19 21:55:54.866000+00:00 |
| x_mitre_data_sources[0] | Process: Process Creation | File: File Access |
| x_mitre_data_sources[1] | Command: Command Execution | Script: Script Execution |
| x_mitre_data_sources[2] | Script: Script Execution | Command: Command Execution |
| x_mitre_data_sources[3] | File: File Access | Process: Process Creation |
| x_mitre_version | 1.4 | 1.5 |
[T1039] Data from Network Shared Drive
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0029: Network Traffic (Network Connection Creation)
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['David Tayouri'] |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-24 15:42:44.026000+00:00 | 2022-06-16 13:08:03.209000+00:00 |
| x_mitre_data_sources[0] | Network Share: Network Share Access | File: File Access |
| x_mitre_data_sources[1] | Command: Command Execution | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[2] | File: File Access | Command: Command Execution |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
| x_mitre_data_sources | | Network Share: Network Share Access |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
[T1562.001] Impair Defenses: Disable or Modify Tools
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may modify and/or disable security tools to avoi | t | Adversaries may modify and/or disable security tools to avoi |
| d possible detection of their malware/tools and activities. | | d possible detection of their malware/tools and activities. |
| This may take the many forms, such as killing security softw | | This may take many forms, such as killing security software |
| are processes or services, modifying / deleting Registry key | | processes or services, modifying / deleting Registry keys or |
| s or configuration files so that tools do not operate proper | | configuration files so that tools do not operate properly, |
| ly, or other methods to interfere with security tools scanni | | or other methods to interfere with security tools scanning o |
| ng or reporting information. Adversaries may also tamper wi | | r reporting information. Adversaries may also disable update |
| th artifacts deployed and utilized by security tools. Securi | | s to prevent the latest security patches from reaching tools |
| ty tools may make dynamic changes to system components in or | | on victim systems.(Citation: SCADAfence_ransomware) Advers |
| der to maintain visibility into specific events. For example | | aries may also tamper with artifacts deployed and utilized b |
| , security products may load their own modules and/or modify | | y security tools. Security tools may make dynamic changes to |
| those loaded by processes to facilitate data collection. Si | | system components in order to maintain visibility into spec |
| milar to [Indicator Blocking](https://attack.mitre.org/techn | | ific events. For example, security products may load their o |
| iques/T1562/006), adversaries may unhook or otherwise modify | | wn modules and/or modify those loaded by processes to facili |
| these features added by tools (especially those that exist | | tate data collection. Similar to [Indicator Blocking](https: |
| in userland or are otherwise potentially accessible to adver | | //attack.mitre.org/techniques/T1562/006), adversaries may un |
| saries) to avoid detection.(Citation: OutFlank System Calls) | | hook or otherwise modify these features added by tools (espe |
| (Citation: MDSec System Calls) | | cially those that exist in userland or are otherwise potenti |
| | | ally accessible to adversaries) to avoid detection.(Citation |
| | | : OutFlank System Calls)(Citation: MDSec System Calls) In c |
| | | loud environments, tools disabled by adversaries may include |
| | | cloud monitoring agents that report back to services such a |
| | | s AWS CloudWatch or Google Cloud Monitor. Furthermore, alth |
| | | ough defensive tools may have anti-tampering mechanisms, adv |
| | | ersaries may abuse tools such as legitimate rootkit removal |
| | | kits to impair and/or disable these tools.(Citation: chasing |
| | | _avaddon_ransomware)(Citation: dharma_ransomware)(Citation: |
| | | demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For e |
| | | xample, adversaries have used tools such as GMER to find and |
| | | shut down hidden processes and antivirus software on infect |
| | | ed systems.(Citation: demystifying_ryuk) Additionally, adve |
| | | rsaries may exploit legitimate drivers from anti-virus softw |
| | | are to gain access to kernel space (i.e. [Exploitation for P |
| | | rivilege Escalation](https://attack.mitre.org/techniques/T10 |
| | | 68)), which may lead to bypassing anti-tampering features.(C |
| | | itation: avoslocker_ransomware) |
New Mitigations:
- M1038: Execution Prevention
New Detections:
- DS0027: Driver (Driver Load)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator'] | |
| external_references | CAPEC-578 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-18 21:27:48.159000+00:00 | 2022-10-24 15:23:59.433000+00:00 |
| description | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)
In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.
Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)
Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware) |
| external_references[1]['source_name'] | capec | OutFlank System Calls |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/578.html | https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ |
| external_references[2]['source_name'] | OutFlank System Calls | chasing_avaddon_ransomware |
| external_references[2]['description'] | de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021. | Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022. |
| external_references[2]['url'] | https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/ | https://www.mandiant.com/resources/chasing-avaddon-ransomware |
| external_references[3]['source_name'] | MDSec System Calls | doppelpaymer_crowdstrike |
| external_references[3]['description'] | MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021. | Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022. |
| external_references[3]['url'] | https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/ | https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/ |
| x_mitre_data_sources[0] | Windows Registry: Windows Registry Key Modification | Process: Process Termination |
| x_mitre_data_sources[1] | Service: Service Metadata | Sensor Health: Host Status |
| x_mitre_data_sources[2] | Command: Command Execution | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[3] | Process: Process Termination | Driver: Driver Load |
| x_mitre_data_sources[4] | Sensor Health: Host Status | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[5] | Windows Registry: Windows Registry Key Deletion | Service: Service Metadata |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'avoslocker_ransomware', 'description': 'Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022.', 'url': 'https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html'} |
| external_references | | {'source_name': 'dharma_ransomware', 'description': 'Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022.', 'url': 'https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/'} |
| external_references | | {'source_name': 'MDSec System Calls', 'description': 'MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.', 'url': 'https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/'} |
| external_references | | {'source_name': 'SCADAfence_ransomware', 'description': 'Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.', 'url': 'https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf'} |
| external_references | | {'source_name': 'demystifying_ryuk', 'description': 'Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022.', 'url': 'https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947'} |
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/578.html', 'external_id': 'CAPEC-578'} |
| x_mitre_contributors | | Daniel Feichter, @VirtualAllocEx, Infosec Tirol |
| x_mitre_contributors | | Lucas Heiligenstein |
| x_mitre_contributors | | Cian Heasley |
| x_mitre_contributors | | Alex Soler, AttackIQ |
| x_mitre_contributors | | Sarathkumar Rajendran, Microsoft Defender365 |
| x_mitre_data_sources | | Command: Command Execution |
[T1087.002] Account Discovery: Domain Account
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
- DS0036: Group (Group Enumeration)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['ExtraHop', 'Miriam Wiesner, @miriamxyra, Microsoft Security'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-13 14:05:14.784000+00:00 | 2022-08-25 13:04:00.863000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_data_sources[2] | Process: OS API Execution | Group: Group Enumeration |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Group: Group Enumeration |
| x_mitre_data_sources | | Process: OS API Execution |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
[T1069.002] Permission Groups Discovery: Domain Groups
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0009: Process (OS API Execution)
- DS0036: Group (Group Enumeration)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Harshal Tupsamudre, Qualys', 'Miriam Wiesner, @miriamxyra, Microsoft Security'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-12 19:07:53.043000+00:00 | 2022-10-21 12:55:51.337000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Group: Group Enumeration |
| x_mitre_data_sources | | Process: OS API Execution |
[T1590.001] Gather Victim Network Information: Domain Properties
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may gather information about the victim's networ | t | Adversaries may gather information about the victim's networ |
| k domain(s) that can be used during targeting. Information a | | k domain(s) that can be used during targeting. Information a |
| bout domains and their properties may include a variety of d | | bout domains and their properties may include a variety of d |
| etails, including what domain(s) the victim owns as well as | | etails, including what domain(s) the victim owns as well as |
| administrative data (ex: name, registrar, etc.) and more dir | | administrative data (ex: name, registrar, etc.) and more dir |
| ectly actionable information such as contacts (email address | | ectly actionable information such as contacts (email address |
| es and phone numbers), business addresses, and name servers. | | es and phone numbers), business addresses, and name servers. |
| Adversaries may gather this information in various ways, s | | Adversaries may gather this information in various ways, s |
| uch as direct collection actions via [Active Scanning](https | | uch as direct collection actions via [Active Scanning](https |
| ://attack.mitre.org/techniques/T1595) or [Phishing for Infor | | ://attack.mitre.org/techniques/T1595) or [Phishing for Infor |
| mation](https://attack.mitre.org/techniques/T1598). Informat | | mation](https://attack.mitre.org/techniques/T1598). Informat |
| ion about victim domains and their properties may also be ex | | ion about victim domains and their properties may also be ex |
| posed to adversaries via online or other accessible data set | | posed to adversaries via online or other accessible data set |
| s (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002 | | s (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002 |
| )).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl | | )).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl |
| Passive DNS) Gathering this information may reveal opportun | | Passive DNS) Where third-party cloud providers are in use, |
| ities for other forms of reconnaissance (ex: [Search Open Te | | this information may also be exposed through publicly availa |
| chnical Databases](https://attack.mitre.org/techniques/T1596 | | ble API endpoints, such as GetUserRealm and autodiscover in |
| ), [Search Open Websites/Domains](https://attack.mitre.org/t | | Office 365 environments.(Citation: Azure Active Directory Re |
| echniques/T1593), or [Phishing for Information](https://atta | | connaisance)(Citation: Office 265 Azure Domain Availability) |
| ck.mitre.org/techniques/T1598)), establishing operational re | | Gathering this information may reveal opportunities for oth |
| sources (ex: [Acquire Infrastructure](https://attack.mitre.o | | er forms of reconnaissance (ex: [Search Open Technical Datab |
| rg/techniques/T1583) or [Compromise Infrastructure](https:// | | ases](https://attack.mitre.org/techniques/T1596), [Search Op |
| attack.mitre.org/techniques/T1584)), and/or initial access ( | | en Websites/Domains](https://attack.mitre.org/techniques/T15 |
| ex: [Phishing](https://attack.mitre.org/techniques/T1566)). | | 93), or [Phishing for Information](https://attack.mitre.org/ |
| | | techniques/T1598)), establishing operational resources (ex: |
| | | [Acquire Infrastructure](https://attack.mitre.org/techniques |
| | | /T1583) or [Compromise Infrastructure](https://attack.mitre. |
| | | org/techniques/T1584)), and/or initial access (ex: [Phishing |
| | | ](https://attack.mitre.org/techniques/T1566)). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:30:33.508000+00:00 | 2022-10-21 14:32:05.257000+00:00 |
| description | Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.
Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)). | Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.
Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: [WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Where third-party cloud providers are in use, this information may also be exposed through publicly available API endpoints, such as GetUserRealm and autodiscover in Office 365 environments.(Citation: Azure Active Directory Reconnaisance)(Citation: Office 265 Azure Domain Availability) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)). |
| external_references[1]['source_name'] | WHOIS | Circl Passive DNS |
| external_references[1]['description'] | NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020. | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. |
| external_references[1]['url'] | https://www.whois.net/ | https://www.circl.lu/services/passive-dns/ |
| external_references[2]['source_name'] | DNS Dumpster | Azure Active Directory Reconnaisance |
| external_references[2]['description'] | Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020. | Dr. Nestori Syynimaa. (2020, June 13). Just looking: Azure Active Directory reconnaissance as an outsider. Retrieved May 27, 2022. |
| external_references[2]['url'] | https://dnsdumpster.com/ | https://o365blog.com/post/just-looking/ |
| external_references[3]['source_name'] | Circl Passive DNS | DNS Dumpster |
| external_references[3]['description'] | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. | Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020. |
| external_references[3]['url'] | https://www.circl.lu/services/passive-dns/ | https://dnsdumpster.com/ |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Office 265 Azure Domain Availability', 'description': 'Microsoft. (2017, January 23). (Cloud) Tip of the Day: Advanced way to check domain availability for Office 365 and Azure. Retrieved May 27, 2022.', 'url': 'https://docs.microsoft.com/en-us/archive/blogs/tip_of_the_day/cloud-tip-of-the-day-advanced-way-to-check-domain-availability-for-office-365-and-azure'} |
| external_references | | {'source_name': 'WHOIS', 'description': 'NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020.', 'url': 'https://www.whois.net/'} |
[T1482] Domain Trust Discovery
Current version: 1.2
Version changed from: 1.1 → 1.2
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-05 19:58:03.031000+00:00 | 2022-06-16 19:18:22.305000+00:00 |
| x_mitre_data_sources[0] | Process: Process Creation | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Script: Script Execution | Process: OS API Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Script: Script Execution |
| x_mitre_data_sources[3] | Process: OS API Execution | Process: Process Creation |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ExtraHop |
| x_mitre_data_sources | | Command: Command Execution |
[T1484.002] Domain Policy Modification: Domain Trust Modification
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may add new domain trusts or modify the properti | t | Adversaries may add new domain trusts or modify the properti |
| es of existing domain trusts to evade defenses and/or elevat | | es of existing domain trusts to evade defenses and/or elevat |
| e privileges. Domain trust details, such as whether or not a | | e privileges. Domain trust details, such as whether or not a |
| domain is federated, allow authentication and authorization | | domain is federated, allow authentication and authorization |
| properties to apply between domains for the purpose of acce | | properties to apply between domains for the purpose of acce |
| ssing shared resources.(Citation: Microsoft - Azure AD Feder | | ssing shared resources.(Citation: Microsoft - Azure AD Feder |
| ation) These trust objects may include accounts, credentials | | ation) These trust objects may include accounts, credentials |
| , and other authentication material applied to servers, toke | | , and other authentication material applied to servers, toke |
| ns, and domains. Manipulating the domain trusts may allow a | | ns, and domains. Manipulating the domain trusts may allow a |
| n adversary to escalate privileges and/or evade defenses by | | n adversary to escalate privileges and/or evade defenses by |
| modifying settings to add objects which they control. For ex | | modifying settings to add objects which they control. For ex |
| ample, this may be used to forge [SAML Tokens](https://attac | | ample, this may be used to forge [SAML Tokens](https://attac |
| k.mitre.org/techniques/T1606/002), without the need to compr | | k.mitre.org/techniques/T1606/002), without the need to compr |
| omise the signing certificate to forge new credentials. Inst | | omise the signing certificate to forge new credentials. Inst |
| ead, an adversary can manipulate domain trusts to add their | | ead, an adversary can manipulate domain trusts to add their |
| own signing certificate. | | own signing certificate. An adversary may also convert a dom |
| | | ain to a federated domain, which may enable malicious trust |
| | | modifications such as altering the claim issuance rules to l |
| | | og in any valid set of credentials as a specified user.(Cita |
| | | tion: AADInternals zure AD Federated Domain) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-01-11 18:21:20.213000+00:00 | 2022-10-21 16:09:14.555000+00:00 |
| description | Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. | Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert a domain to a federated domain, which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain) |
| external_references[1]['source_name'] | Microsoft - Azure AD Federation | CISA SolarWinds Cloud Detection |
| external_references[1]['description'] | Microsoft. (2018, November 28). What is federation with Azure AD?. Retrieved December 30, 2020. | CISA. (2021, January 8). Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments. Retrieved January 8, 2021. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed | https://us-cert.cisa.gov/ncas/alerts/aa21-008a |
| external_references[2]['source_name'] | Microsoft - Azure Sentinel ADFSDomainTrustMods | AADInternals zure AD Federated Domain |
| external_references[2]['description'] | Microsoft. (2020, December). Azure Sentinel Detections. Retrieved December 30, 2020. | Dr. Nestori Syynimaa. (2017, November 16). Security vulnerability in Azure AD & Office 365 identity federation. Retrieved September 28, 2022. |
| external_references[2]['url'] | https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml | https://o365blog.com/post/federation-vulnerability/ |
| external_references[3]['source_name'] | Sygnia Golden SAML | Microsoft - Azure AD Federation |
| external_references[3]['description'] | Sygnia. (2020, December). Detection and Hunting of Golden SAML Attack. Retrieved January 6, 2021. | Microsoft. (2018, November 28). What is federation with Azure AD?. Retrieved December 30, 2020. |
| external_references[3]['url'] | https://www.sygnia.co/golden-saml-advisory | https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed |
| external_references[4]['source_name'] | CISA SolarWinds Cloud Detection | Microsoft - Azure Sentinel ADFSDomainTrustMods |
| external_references[4]['description'] | CISA. (2021, January 8). Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments. Retrieved January 8, 2021. | Microsoft. (2020, December). Azure Sentinel Detections. Retrieved December 30, 2020. |
| external_references[4]['url'] | https://us-cert.cisa.gov/ncas/alerts/aa21-008a | https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml |
| x_mitre_data_sources[0] | Active Directory: Active Directory Object Modification | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Active Directory: Active Directory Object Modification |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Sygnia Golden SAML', 'description': 'Sygnia. (2020, December). Detection and Hunting of Golden SAML Attack. Retrieved January 6, 2021.', 'url': 'https://www.sygnia.co/golden-saml-advisory'} |
| x_mitre_contributors | | Praetorian |
[T1583.001] Acquire Infrastructure: Domains
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may purchase domains that can be used during tar | t | Adversaries may acquire domains that can be used during targ |
| geting. Domain names are the human readable names used to re | | eting. Domain names are the human readable names used to rep |
| present one or more IP addresses. They can be purchased or, | | resent one or more IP addresses. They can be purchased or, i |
| in some cases, acquired for free. Adversaries can use purch | | n some cases, acquired for free. Adversaries may use acquir |
| ased domains for a variety of purposes, including for [Phish | | ed domains for a variety of purposes, including for [Phishin |
| ing](https://attack.mitre.org/techniques/T1566), [Drive-by C | | g](https://attack.mitre.org/techniques/T1566), [Drive-by Com |
| ompromise](https://attack.mitre.org/techniques/T1189), and C | | promise](https://attack.mitre.org/techniques/T1189), and Com |
| ommand and Control.(Citation: CISA MSS Sep 2020) Adversaries | | mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m |
| may choose domains that are similar to legitimate domains, | | ay choose domains that are similar to legitimate domains, in |
| including through use of homoglyphs or use of a different to | | cluding through use of homoglyphs or use of a different top- |
| p-level domain (TLD).(Citation: FireEye APT28)(Citation: Pay | | level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa |
| palScam) Typosquatting may be used to aid in delivery of pay | | lScam) Typosquatting may be used to aid in delivery of paylo |
| loads via [Drive-by Compromise](https://attack.mitre.org/tec | | ads via [Drive-by Compromise](https://attack.mitre.org/techn |
| hniques/T1189). Adversaries can also use internationalized d | | iques/T1189). Adversaries may also use internationalized dom |
| omain names (IDNs) to create visually similar lookalike doma | | ain names (IDNs) and different character sets (e.g. Cyrillic |
| ins for use in operations.(Citation: CISA IDN ST05-016) Dom | | , Greek, etc.) to execute "IDN homograph attacks," creating |
| ain registrars each maintain a publicly viewable database th | | visually similar lookalike domains used to deliver malware t |
| at displays contact information for every registered domain. | | o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt |
| Private WHOIS services display alternative information, suc | | _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht |
| h as their own company data, rather than the owner of the do | | track_unhcr)(Citation: lazgroup_idn_phishing) Adversaries m |
| main. Adversaries may use such private WHOIS services to obs | | ay also acquire and repurpose expired domains, which may be |
| cure information about who owns a purchased domain. Adversar | | potentially already allowlisted/trusted by defenders based o |
| ies may further interrupt efforts to track their infrastruct | | n an existing reputation/history.(Citation: Categorisation_n |
| ure by using varied registration information and purchasing | | ot_boundary)(Citation: Domain_Steal_CC)(Citation: Redirector |
| domains with different domain registrars.(Citation: Mandiant | | s_Domain_Fronting)(Citation: bypass_webproxy_filtering) Dom |
| APT1) | | ain registrars each maintain a publicly viewable database th |
| | | at displays contact information for every registered domain. |
| | | Private WHOIS services display alternative information, suc |
| | | h as their own company data, rather than the owner of the do |
| | | main. Adversaries may use such private WHOIS services to obs |
| | | cure information about who owns a purchased domain. Adversar |
| | | ies may further interrupt efforts to track their infrastruct |
| | | ure by using varied registration information and purchasing |
| | | domains with different domain registrars.(Citation: Mandiant |
| | | APT1) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | Bob Sullivan. (2000, July 24). PayPal alert! Beware the 'PaypaI' scam. Retrieved March 2, 2017. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-630 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 17:09:26.334000+00:00 | 2022-10-18 19:21:38.441000+00:00 |
| description | Adversaries may purchase domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries can use purchased domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries can also use internationalized domain names (IDNs) to create visually similar lookalike domains for use in operations.(Citation: CISA IDN ST05-016)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) | Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) |
| external_references[1]['source_name'] | capec | PaypalScam |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/630.html | https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/ |
| external_references[2]['source_name'] | CISA MSS Sep 2020 | CISA IDN ST05-016 |
| external_references[2]['description'] | CISA. (2020, September 14). Alert (AA20-258A): Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity. Retrieved October 1, 2020. | CISA. (2019, September 27). Security Tip (ST05-016): Understanding Internationalized Domain Names. Retrieved October 20, 2020. |
| external_references[2]['url'] | https://us-cert.cisa.gov/ncas/alerts/aa20-258a | https://us-cert.cisa.gov/ncas/tips/ST05-016 |
| external_references[3]['source_name'] | FireEye APT28 | CISA MSS Sep 2020 |
| external_references[3]['description'] | FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. | CISA. (2020, September 14). Alert (AA20-258A): Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity. Retrieved October 1, 2020. |
| external_references[3]['url'] | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf | https://us-cert.cisa.gov/ncas/alerts/aa20-258a |
| external_references[4]['source_name'] | PaypalScam | bypass_webproxy_filtering |
| external_references[4]['description'] | Bob Sullivan. (2000, July 24). PayPal alert! Beware the 'PaypaI' scam. Retrieved March 2, 2017. | Fehrman, B. (2017, April 13). How to Bypass Web-Proxy Filtering. Retrieved September 20, 2019. |
| external_references[4]['url'] | https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/ | https://www.blackhillsinfosec.com/bypass-web-proxy-filtering/ |
| external_references[5]['source_name'] | CISA IDN ST05-016 | FireEye APT28 |
| external_references[5]['description'] | CISA. (2019, September 27). Security Tip (ST05-016): Understanding Internationalized Domain Names. Retrieved October 20, 2020. | FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015. |
| external_references[5]['url'] | https://us-cert.cisa.gov/ncas/tips/ST05-016 | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf |
| external_references[6]['source_name'] | Mandiant APT1 | Domain_Steal_CC |
| external_references[6]['description'] | Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. | Krebs, B. (2018, November 13). That Domain You Forgot to Renew? Yeah, it’s Now Stealing Credit Cards. Retrieved September 20, 2019. |
| external_references[6]['url'] | https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf | https://krebsonsecurity.com/2018/11/that-domain-you-forgot-to-renew-yeah-its-now-stealing-credit-cards/ |
| external_references[7]['source_name'] | ThreatConnect Infrastructure Dec 2020 | tt_obliqueRAT |
| external_references[7]['description'] | ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021. | Malhotra, A., McKay, K. et al. (2021, May 13). Transparent Tribe APT expands its Windows malware arsenal . Retrieved July 29, 2022. |
| external_references[7]['url'] | https://threatconnect.com/blog/infrastructure-research-hunting/ | https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html |
| x_mitre_data_sources[4] | Domain Name: Passive DNS | Application Log: Application Log Content |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'tt_httrack_fake_domains', 'description': 'Malhotra, A., Thattil, J. et al. (2022, March 29). Transparent Tribe campaign uses new bespoke malware to target Indian government officials . Retrieved September 6, 2022.', 'url': 'https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html'} |
| external_references | | {'source_name': 'Mandiant APT1', 'description': 'Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.', 'url': 'https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf'} |
| external_references | | {'source_name': 'Categorisation_not_boundary', 'description': 'MDSec Research. (2017, July). Categorisation is not a Security Boundary. Retrieved September 20, 2019.', 'url': 'https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-security-boundary/'} |
| external_references | | {'source_name': 'Redirectors_Domain_Fronting', 'description': 'Mudge, R. (2017, February 6). High-reputation Redirectors and Domain Fronting. Retrieved July 11, 2022.', 'url': 'https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/'} |
| external_references | | {'source_name': 'lazgroup_idn_phishing', 'description': 'RISKIQ. (2017, December 20). Mining Insights: Infrastructure Analysis of Lazarus Group Cyber Attacks on the Cryptocurrency Industry. Retrieved July 29, 2022.', 'url': 'https://www.riskiq.com/blog/labs/lazarus-group-cryptocurrency/'} |
| external_references | | {'source_name': 'httrack_unhcr', 'description': 'RISKIQ. (2022, March 15). RiskIQ Threat Intelligence Roundup: Campaigns Targeting Ukraine and Global Malware Infrastructure. Retrieved July 29, 2022.', 'url': 'https://www.riskiq.com/blog/labs/ukraine-malware-infrastructure/'} |
| external_references | | {'source_name': 'ThreatConnect Infrastructure Dec 2020', 'description': 'ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.', 'url': 'https://threatconnect.com/blog/infrastructure-research-hunting/'} |
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/630.html', 'external_id': 'CAPEC-630'} |
| x_mitre_contributors | | Oleg Kolesnikov, Securonix |
| x_mitre_contributors | | Menachem Goldstein |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
| x_mitre_data_sources | | Domain Name: Passive DNS |
[T1055.001] Process Injection: Dynamic-link Library Injection
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may inject dynamic-link libraries (DLLs) into pr | t | Adversaries may inject dynamic-link libraries (DLLs) into pr |
| ocesses in order to evade process-based defenses as well as | | ocesses in order to evade process-based defenses as well as |
| possibly elevate privileges. DLL injection is a method of ex | | possibly elevate privileges. DLL injection is a method of ex |
| ecuting arbitrary code in the address space of a separate li | | ecuting arbitrary code in the address space of a separate li |
| ve process. DLL injection is commonly performed by writin | | ve process. DLL injection is commonly performed by writin |
| g the path to a DLL in the virtual address space of the targ | | g the path to a DLL in the virtual address space of the targ |
| et process before loading the DLL by invoking a new thread. | | et process before loading the DLL by invoking a new thread. |
| The write can be performed with native Windows API calls suc | | The write can be performed with native Windows API calls suc |
| h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor | | h as <code>VirtualAllocEx</code> and <code>WriteProcessMemor |
| y</code>, then invoked with <code>CreateRemoteThread</code> | | y</code>, then invoked with <code>CreateRemoteThread</code> |
| (which calls the <code>LoadLibrary</code> API responsible fo | | (which calls the <code>LoadLibrary</code> API responsible fo |
| r loading the DLL). (Citation: Elastic Process Injection Jul | | r loading the DLL). (Citation: Elastic Process Injection Jul |
| y 2017) Variations of this method such as reflective DLL i | | y 2017) Variations of this method such as reflective DLL i |
| njection (writing a self-mapping DLL into a process) and mem | | njection (writing a self-mapping DLL into a process) and mem |
| ory module (map DLL when writing into process) overcome the | | ory module (map DLL when writing into process) overcome the |
| address relocation issue as well as the additional APIs to i | | address relocation issue as well as the additional APIs to i |
| nvoke execution (since these methods load and execute the fi | | nvoke execution (since these methods load and execute the fi |
| les in memory by manually preforming the function of <code>L | | les in memory by manually preforming the function of <code>L |
| oadLibrary</code>).(Citation: Elastic HuntingNMemory June 20 | | oadLibrary</code>).(Citation: Elastic HuntingNMemory June 20 |
| 17)(Citation: Elastic Process Injection July 2017) Running | | 17)(Citation: Elastic Process Injection July 2017) Another |
| code in the context of another process may allow access to | | variation of this method, often referred to as Module Stomp |
| the process's memory, system/network resources, and possibly | | ing/Overloading or DLL Hollowing, may be leveraged to concea |
| elevated privileges. Execution via DLL injection may also e | | l injected code within a process. This method involves loadi |
| vade detection from security products since the execution is | | ng a legitimate DLL into a remote process then manually over |
| masked under a legitimate process. | | writing the module's <code>AddressOfEntryPoint</code> before |
| | | starting a new thread in the target process.(Citation: Modu |
| | | le Stomping for Shellcode Injection) This variation allows a |
| | | ttackers to hide malicious injected code by potentially back |
| | | ing its execution with a legitimate DLL file on disk.(Citati |
| | | on: Hiding Malicious Code with Module Stomping) Running co |
| | | de in the context of another process may allow access to the |
| | | process's memory, system/network resources, and possibly el |
| | | evated privileges. Execution via DLL injection may also evad |
| | | e detection from security products since the execution is ma |
| | | sked under a legitimate process. |
New Detections:
- DS0009: Process (Process Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Boominathan Sundaram'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-18 12:20:00.382000+00:00 | 2022-10-18 21:07:23.748000+00:00 |
| description | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017)
Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread. The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL). (Citation: Elastic Process Injection July 2017)
Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).(Citation: Elastic HuntingNMemory June 2017)(Citation: Elastic Process Injection July 2017)
Another variation of this method, often referred to as Module Stomping/Overloading or DLL Hollowing, may be leveraged to conceal injected code within a process. This method involves loading a legitimate DLL into a remote process then manually overwriting the module's AddressOfEntryPoint before starting a new thread in the target process.(Citation: Module Stomping for Shellcode Injection) This variation allows attackers to hide malicious injected code by potentially backing its execution with a legitimate DLL file on disk.(Citation: Hiding Malicious Code with Module Stomping)
Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process. |
| external_references[1]['source_name'] | Elastic Process Injection July 2017 | Hiding Malicious Code with Module Stomping |
| external_references[1]['description'] | Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017. | Aliz Hammond. (2019, August 15). Hiding Malicious Code with "Module Stomping": Part 1. Retrieved July 14, 2022. |
| external_references[1]['url'] | https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process | https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/ |
| x_mitre_data_sources[0] | Process: Process Access | Process: Process Modification |
| x_mitre_data_sources[1] | Process: OS API Execution | Module: Module Load |
| x_mitre_data_sources[2] | Module: Module Load | Process: Process Metadata |
| x_mitre_data_sources[3] | Process: Process Modification | Process: Process Access |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Elastic Process Injection July 2017', 'description': 'Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.', 'url': 'https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process'} |
| external_references | | {'source_name': 'Module Stomping for Shellcode Injection', 'description': 'Red Teaming Experiments. (n.d.). Module Stomping for Shellcode Injection. Retrieved July 14, 2022.', 'url': 'https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection'} |
| x_mitre_data_sources | | Process: OS API Execution |
[T1589.002] Gather Victim Identity Information: Email Addresses
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may gather email addresses that can be used duri | t | Adversaries may gather email addresses that can be used duri |
| ng targeting. Even if internal instances exist, organization | | ng targeting. Even if internal instances exist, organization |
| s may have public-facing email infrastructure and addresses | | s may have public-facing email infrastructure and addresses |
| for employees. Adversaries may easily gather email addresse | | for employees. Adversaries may easily gather email addresse |
| s, since they may be readily available and exposed via onlin | | s, since they may be readily available and exposed via onlin |
| e or other accessible data sets (ex: [Social Media](https:// | | e or other accessible data sets (ex: [Social Media](https:// |
| attack.mitre.org/techniques/T1593/001) or [Search Victim-Own | | attack.mitre.org/techniques/T1593/001) or [Search Victim-Own |
| ed Websites](https://attack.mitre.org/techniques/T1594)).(Ci | | ed Websites](https://attack.mitre.org/techniques/T1594)).(Ci |
| tation: HackersArise Email)(Citation: CNET Leaks) Email addr | | tation: HackersArise Email)(Citation: CNET Leaks) Email addr |
| esses could also be enumerated via more active means (i.e. [ | | esses could also be enumerated via more active means (i.e. [ |
| Active Scanning](https://attack.mitre.org/techniques/T1595)) | | Active Scanning](https://attack.mitre.org/techniques/T1595)) |
| , such as probing and analyzing responses from authenticatio | | , such as probing and analyzing responses from authenticatio |
| n services that may reveal valid usernames in a system.(Cita | | n services that may reveal valid usernames in a system.(Cita |
| tion: GrimBlog UsernameEnum) Gathering this information may | | tion: GrimBlog UsernameEnum) For example, adversaries may be |
| reveal opportunities for other forms of reconnaissance (ex: | | able to enumerate email addresses in Office 365 environment |
| [Search Open Websites/Domains](https://attack.mitre.org/tec | | s by querying a variety of publicly available API endpoints, |
| hniques/T1593) or [Phishing for Information](https://attack. | | such as autodiscover and GetCredentialType.(Citation: GitHu |
| mitre.org/techniques/T1598)), establishing operational resou | | b Office 365 User Enumeration)(Citation: Azure Active Direct |
| rces (ex: [Email Accounts](https://attack.mitre.org/techniqu | | ory Reconnaisance) Gathering this information may reveal op |
| es/T1586/002)), and/or initial access (ex: [Phishing](https: | | portunities for other forms of reconnaissance (ex: [Search O |
| //attack.mitre.org/techniques/T1566) or [Brute Force](https: | | pen Websites/Domains](https://attack.mitre.org/techniques/T1 |
| //attack.mitre.org/techniques/T1110) via [External Remote Se | | 593) or [Phishing for Information](https://attack.mitre.org/ |
| rvices](https://attack.mitre.org/techniques/T1133)). | | techniques/T1598)), establishing operational resources (ex: |
| | | [Email Accounts](https://attack.mitre.org/techniques/T1586/0 |
| | | 02)), and/or initial access (ex: [Phishing](https://attack.m |
| | | itre.org/techniques/T1566) or [Brute Force](https://attack.m |
| | | itre.org/techniques/T1110) via [External Remote Services](ht |
| | | tps://attack.mitre.org/techniques/T1133)). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-12-09 21:49:30.319000+00:00 | 2022-10-21 14:30:10.979000+00:00 |
| description | Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)). | Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: HackersArise Email)(Citation: CNET Leaks) Email addresses could also be enumerated via more active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) For example, adversaries may be able to enumerate email addresses in Office 365 environments by querying a variety of publicly available API endpoints, such as autodiscover and GetCredentialType.(Citation: GitHub Office 365 User Enumeration)(Citation: Azure Active Directory Reconnaisance)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Email Accounts](https://attack.mitre.org/techniques/T1586/002)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Brute Force](https://attack.mitre.org/techniques/T1110) via [External Remote Services](https://attack.mitre.org/techniques/T1133)). |
| external_references[1]['source_name'] | HackersArise Email | Azure Active Directory Reconnaisance |
| external_references[1]['description'] | Hackers Arise. (n.d.). Email Scraping and Maltego. Retrieved October 20, 2020. | Dr. Nestori Syynimaa. (2020, June 13). Just looking: Azure Active Directory reconnaissance as an outsider. Retrieved May 27, 2022. |
| external_references[1]['url'] | https://www.hackers-arise.com/email-scraping-and-maltego | https://o365blog.com/post/just-looking/ |
| external_references[2]['source_name'] | CNET Leaks | GitHub Office 365 User Enumeration |
| external_references[2]['description'] | Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020. | gremwell. (2020, March 24). Office 365 User Enumeration. Retrieved May 27, 2022. |
| external_references[2]['url'] | https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/ | https://github.com/gremwell/o365enum |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'HackersArise Email', 'description': 'Hackers Arise. (n.d.). Email Scraping and Maltego. Retrieved October 20, 2020.', 'url': 'https://www.hackers-arise.com/email-scraping-and-maltego'} |
| external_references | | {'source_name': 'CNET Leaks', 'description': 'Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.', 'url': 'https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/'} |
[T1611] Escape to Host
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may break out of a container to gain access to t | t | Adversaries may break out of a container to gain access to t |
| he underlying host. This can allow an adversary access to ot | | he underlying host. This can allow an adversary access to ot |
| her containerized resources from the host level or to the ho | | her containerized resources from the host level or to the ho |
| st itself. In principle, containerized resources should prov | | st itself. In principle, containerized resources should prov |
| ide a clear separation of application functionality and be i | | ide a clear separation of application functionality and be i |
| solated from the host environment.(Citation: Docker Overview | | solated from the host environment.(Citation: Docker Overview |
| ) There are multiple ways an adversary may escape to a host | | ) There are multiple ways an adversary may escape to a host |
| environment. Examples include creating a container configur | | environment. Examples include creating a container configur |
| ed to mount the host’s filesystem using the bind parameter, | | ed to mount the host’s filesystem using the bind parameter, |
| which allows the adversary to drop payloads and execute cont | | which allows the adversary to drop payloads and execute cont |
| rol utilities such as cron on the host, or utilizing a privi | | rol utilities such as cron on the host; utilizing a privileg |
| leged container to run commands on the underlying host.(Cita | | ed container to run commands or load a malicious kernel modu |
| tion: Docker Bind Mounts)(Citation: Trend Micro Privileged C | | le on the underlying host; or abusing system calls such as ` |
| ontainer)(Citation: Intezer Doki July 20) Adversaries may al | | unshare` and `keyctl` to escalate privileges and steal secre |
| so escape via [Exploitation for Privilege Escalation](https: | | ts.(Citation: Docker Bind Mounts)(Citation: Trend Micro Priv |
| //attack.mitre.org/techniques/T1068), such as exploiting vul | | ileged Container)(Citation: Intezer Doki July 20)(Citation: |
| nerabilities in global symbolic links in order to access the | | Container Escape)(Citation: Crowdstrike Kubernetes Container |
| root directory of a host machine.(Citation: Windows Server | | Escape)(Citation: Keyctl-unmask) Additionally, an adversar |
| Containers Are Open) Gaining access to the host may provide | | y may be able to exploit a compromised container with a moun |
| the adversary with the opportunity to achieve follow-on obj | | ted container management socket, such as `docker.sock`, to b |
| ectives, such as establishing persistence, moving laterally | | reak out of the container via a [Container Administration Co |
| within the environment, or setting up a command and control | | mmand](https://attack.mitre.org/techniques/T1609).(Citation: |
| channel on the host. | | Container Escape) Adversaries may also escape via [Exploita |
| | | tion for Privilege Escalation](https://attack.mitre.org/tech |
| | | niques/T1068), such as exploiting vulnerabilities in global |
| | | symbolic links in order to access the root directory of a ho |
| | | st machine.(Citation: Windows Server Containers Are Open) G |
| | | aining access to the host may provide the adversary with the |
| | | opportunity to achieve follow-on objectives, such as establ |
| | | ishing persistence, moving laterally within the environment, |
| | | or setting up a command and control channel on the host. |
New Detections:
- DS0008: Kernel (Kernel Module Load)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:06:06.128000+00:00 | 2022-10-21 20:03:06.707000+00:00 |
| description | Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, or utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. | Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)
Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. |
| external_references[1]['source_name'] | Docker Overview | Container Escape |
| external_references[1]['description'] | Docker. (n.d.). Docker Overview. Retrieved March 30, 2021. | 0xn3va. (n.d.). Escaping. Retrieved May 27, 2022. |
| external_references[1]['url'] | https://docs.docker.com/get-started/overview/ | https://0xn3va.gitbook.io/cheat-sheets/container/escaping |
| external_references[2]['source_name'] | Docker Bind Mounts | Windows Server Containers Are Open |
| external_references[2]['description'] | Docker. (n.d.). Use Bind Mounts. Retrieved March 30, 2021. | Daniel Prizmant. (2020, July 15). Windows Server Containers Are Open, and Here's How You Can Break Out. Retrieved October 1, 2021. |
| external_references[2]['url'] | https://docs.docker.com/storage/bind-mounts/ | https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/ |
| external_references[3]['source_name'] | Trend Micro Privileged Container | Docker Overview |
| external_references[3]['description'] | Fiser, D., Oliveira, A.. (2019, December 20). Why a Privileged Container in Docker is a Bad Idea. Retrieved March 30, 2021. | Docker. (n.d.). Docker Overview. Retrieved March 30, 2021. |
| external_references[3]['url'] | https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html | https://docs.docker.com/get-started/overview/ |
| external_references[4]['source_name'] | Intezer Doki July 20 | Docker Bind Mounts |
| external_references[4]['description'] | Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021. | Docker. (n.d.). Use Bind Mounts. Retrieved March 30, 2021. |
| external_references[4]['url'] | https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/ | https://docs.docker.com/storage/bind-mounts/ |
| external_references[5]['source_name'] | Windows Server Containers Are Open | Trend Micro Privileged Container |
| external_references[5]['description'] | Daniel Prizmant. (2020, July 15). Windows Server Containers Are Open, and Here's How You Can Break Out. Retrieved October 1, 2021. | Fiser, D., Oliveira, A.. (2019, December 20). Why a Privileged Container in Docker is a Bad Idea. Retrieved March 30, 2021. |
| external_references[5]['url'] | https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/ | https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html |
| x_mitre_data_sources[0] | Process: OS API Execution | Kernel: Kernel Module Load |
| x_mitre_data_sources[1] | Process: Process Creation | Volume: Volume Modification |
| x_mitre_data_sources[2] | Volume: Volume Modification | Process: OS API Execution |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Intezer Doki July 20', 'description': 'Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.', 'url': 'https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/'} |
| external_references | | {'source_name': 'Crowdstrike Kubernetes Container Escape', 'description': 'Manoj Ahuje. (2022, January 31). CVE-2022-0185: Kubernetes Container Escape Using Linux Kernel Exploit. Retrieved July 6, 2022.', 'url': 'https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/'} |
| external_references | | {'source_name': 'Keyctl-unmask', 'description': 'Mark Manning. (2020, July 23). Keyctl-unmask: "Going Florida" on The State Of Containerizing Linux Keyrings. Retrieved July 6, 2022.', 'url': 'https://www.antitree.com/2020/07/keyctl-unmask-going-florida-on-the-state-of-containerizing-linux-keyrings/'} |
| x_mitre_contributors | | CrowdStrike |
| x_mitre_contributors | | Eran Ayalon, Cybereason |
| x_mitre_contributors | | Oren Ofer, Cybereason |
| x_mitre_contributors | | Ilan Sokol, Cybereason |
| x_mitre_data_sources | | Process: Process Creation |
[T1546] Event Triggered Execution
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may establish persistence and/or elevate privile | t | Adversaries may establish persistence and/or elevate privile |
| ges using system mechanisms that trigger execution based on | | ges using system mechanisms that trigger execution based on |
| specific events. Various operating systems have means to mon | | specific events. Various operating systems have means to mon |
| itor and subscribe to events such as logons or other user ac | | itor and subscribe to events such as logons or other user ac |
| tivity such as running specific applications/binaries. Adv | | tivity such as running specific applications/binaries. Cloud |
| ersaries may abuse these mechanisms as a means of maintainin | | environments may also support various functions and service |
| g persistent access to a victim via repeatedly executing mal | | s that monitor and can be invoked in response to specific cl |
| icious code. After gaining access to a victim system, advers | | oud events.(Citation: Backdooring an AWS account)(Citation: |
| aries may create/modify event triggers to point to malicious | | Varonis Power Automate Data Exfiltration)(Citation: Microsof |
| content that will be executed whenever the event trigger is | | t DART Case Report 001) Adversaries may abuse these mechani |
| invoked.(Citation: FireEye WMI 2015)(Citation: Malware Pers | | sms as a means of maintaining persistent access to a victim |
| istence on OS X)(Citation: amnesia malware) Since the execu | | via repeatedly executing malicious code. After gaining acces |
| tion can be proxied by an account with higher permissions, s | | s to a victim system, adversaries may create/modify event tr |
| uch as SYSTEM or service accounts, an adversary may be able | | iggers to point to malicious content that will be executed w |
| to abuse these triggered execution mechanisms to escalate th | | henever the event trigger is invoked.(Citation: FireEye WMI |
| eir privileges. | | 2015)(Citation: Malware Persistence on OS X)(Citation: amnes |
| | | ia malware) Since the execution can be proxied by an accoun |
| | | t with higher permissions, such as SYSTEM or service account |
| | | s, an adversary may be able to abuse these triggered executi |
| | | on mechanisms to escalate their privileges. |
New Detections:
- DS0025: Cloud Service (Cloud Service Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-08 16:39:09.283000+00:00 | 2022-10-19 15:44:20.456000+00:00 |
| description | Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. | Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.(Citation: Backdooring an AWS account)(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001)
Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code. After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.(Citation: FireEye WMI 2015)(Citation: Malware Persistence on OS X)(Citation: amnesia malware)
Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges. |
| external_references[2]['source_name'] | Malware Persistence on OS X | Microsoft DART Case Report 001 |
| external_references[2]['description'] | Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017. | Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022. |
| external_references[2]['url'] | https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf | https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team |
| x_mitre_data_sources[0] | Windows Registry: Windows Registry Key Modification | WMI: WMI Creation |
| x_mitre_data_sources[1] | Process: Process Creation | Module: Module Load |
| x_mitre_data_sources[2] | File: File Metadata | Cloud Service: Cloud Service Modification |
| x_mitre_data_sources[3] | File: File Modification | Command: Command Execution |
| x_mitre_data_sources[4] | File: File Creation | File: File Modification |
| x_mitre_data_sources[5] | Module: Module Load | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[6] | WMI: WMI Creation | Process: Process Creation |
| x_mitre_data_sources[7] | Command: Command Execution | File: File Creation |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Backdooring an AWS account', 'description': 'Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.', 'url': 'https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9'} |
| external_references | | {'source_name': 'Varonis Power Automate Data Exfiltration', 'description': 'Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.', 'url': 'https://www.varonis.com/blog/power-automate-data-exfiltration'} |
| external_references | | {'source_name': 'Malware Persistence on OS X', 'description': 'Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.', 'url': 'https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf'} |
| x_mitre_data_sources | | File: File Metadata |
| x_mitre_platforms | | SaaS |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Office 365 |
[T1567] Exfiltration Over Web Service
Current version: 1.2
Version changed from: 1.1 → 1.2
New Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:50:29.607000+00:00 | 2022-10-19 21:28:34.699000+00:00 |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Flow | File: File Access |
| x_mitre_data_sources[3] | File: File Access | Network Traffic: Network Traffic Flow |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
[T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-28 01:02:24.172000+00:00 | 2022-08-30 12:49:02.969000+00:00 |
| x_mitre_data_sources[4] | Command: Command Execution | Network Traffic: Network Connection Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network Traffic: Network Traffic Content | |
[T1068] Exploitation for Privilege Escalation
Current version: 1.4
Version changed from: 1.3 → 1.4
New Detections:
- DS0009: Process (Process Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-22 16:13:34.896000+00:00 | 2022-06-16 19:25:12.835000+00:00 |
| external_references[2]['source_name'] | Unit42 AcidBox June 2020 | Microsoft Driver Block Rules |
| external_references[2]['description'] | Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021. | Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021. |
| external_references[2]['url'] | https://unit42.paloaltonetworks.com/acidbox-rare-malware/ | https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules |
| external_references[3]['source_name'] | Microsoft Driver Block Rules | Unit42 AcidBox June 2020 |
| external_references[3]['description'] | Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021. | Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules | https://unit42.paloaltonetworks.com/acidbox-rare-malware/ |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | David Tayouri |
| x_mitre_data_sources | | Process: Process Creation |
[T1133] External Remote Services
Current version: 2.4
Version changed from: 2.3 → 2.4
New Detections:
- DS0029: Network Traffic (Network Connection Creation)
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
| external_references | | Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017. |
| external_references | | CAPEC-555 |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
| external_references | CAPEC-555 | |
| external_references | Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-19 16:57:27.209000+00:00 | 2022-06-16 19:15:22.221000+00:00 |
| external_references[1]['source_name'] | capec | Volexity Virtual Private Keylogging |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/555.html | https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/ |
| external_references[3]['source_name'] | Volexity Virtual Private Keylogging | Unit 42 Hildegard Malware |
| external_references[3]['description'] | Adair, S. (2015, October 7). Virtual Private Keylogging: Cisco Web VPNs Leveraged for Access and Persistence. Retrieved March 20, 2017. | Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. |
| external_references[3]['url'] | https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/ | https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/ |
| external_references[5]['source_name'] | Unit 42 Hildegard Malware | capec |
| external_references[5]['url'] | https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/ | https://capec.mitre.org/data/definitions/555.html |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | David Tayouri |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
[T1083] File and Directory Discovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may enumerate files and directories or may searc | t | Adversaries may enumerate files and directories or may searc |
| h in specific locations of a host or network share for certa | | h in specific locations of a host or network share for certa |
| in information within a file system. Adversaries may use the | | in information within a file system. Adversaries may use the |
| information from [File and Directory Discovery](https://att | | information from [File and Directory Discovery](https://att |
| ack.mitre.org/techniques/T1083) during automated discovery t | | ack.mitre.org/techniques/T1083) during automated discovery t |
| o shape follow-on behaviors, including whether or not the ad | | o shape follow-on behaviors, including whether or not the ad |
| versary fully infects the target and/or attempts specific ac | | versary fully infects the target and/or attempts specific ac |
| tions. Many command shell utilities can be used to obtain t | | tions. Many command shell utilities can be used to obtain t |
| his information. Examples include <code>dir</code>, <code>tr | | his information. Examples include <code>dir</code>, <code>tr |
| ee</code>, <code>ls</code>, <code>find</code>, and <code>loc | | ee</code>, <code>ls</code>, <code>find</code>, and <code>loc |
| ate</code>.(Citation: Windows Commands JPCERT) Custom tools | | ate</code>.(Citation: Windows Commands JPCERT) Custom tools |
| may also be used to gather file and directory information an | | may also be used to gather file and directory information an |
| d interact with the [Native API](https://attack.mitre.org/te | | d interact with the [Native API](https://attack.mitre.org/te |
| chniques/T1106). Adversaries may also leverage a [Network De | | chniques/T1106). Adversaries may also leverage a [Network De |
| vice CLI](https://attack.mitre.org/techniques/T1059/008) on | | vice CLI](https://attack.mitre.org/techniques/T1059/008) on |
| network devices to gather file and directory information.(Ci | | network devices to gather file and directory information (e. |
| tation: US-CERT-TA18-106A) | | g. <code>dir</code>, <code>show flash</code>, and/or <code>n |
| | | vram</code>).(Citation: US-CERT-TA18-106A) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:12:12.362000+00:00 | 2022-09-06 21:55:41.262000+00:00 |
| description | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information.(Citation: US-CERT-TA18-106A) | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A) |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1222] File and Directory Permissions Modification
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may modify file or directory permissions/attribu | t | Adversaries may modify file or directory permissions/attribu |
| tes to evade access control lists (ACLs) and access protecte | | tes to evade access control lists (ACLs) and access protecte |
| d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati | | d files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citati |
| on: Hybrid Analysis Icacls2 May 2018) File and directory per | | on: Hybrid Analysis Icacls2 May 2018) File and directory per |
| missions are commonly managed by ACLs configured by the file | | missions are commonly managed by ACLs configured by the file |
| or directory owner, or users with the appropriate permissio | | or directory owner, or users with the appropriate permissio |
| ns. File and directory ACL implementations vary by platform, | | ns. File and directory ACL implementations vary by platform, |
| but generally explicitly designate which users or groups ca | | but generally explicitly designate which users or groups ca |
| n perform which actions (read, write, execute, etc.). Modif | | n perform which actions (read, write, execute, etc.). Modif |
| ications may include changing specific access rights, which | | ications may include changing specific access rights, which |
| may require taking ownership of a file or directory and/or e | | may require taking ownership of a file or directory and/or e |
| levated permissions depending on the file or directory’s exi | | levated permissions depending on the file or directory’s exi |
| sting permissions. This may enable malicious activity such a | | sting permissions. This may enable malicious activity such a |
| s modifying, replacing, or deleting specific files or direct | | s modifying, replacing, or deleting specific files or direct |
| ories. Specific file and directory modifications may be a re | | ories. Specific file and directory modifications may be a re |
| quired step for many techniques, such as establishing Persis | | quired step for many techniques, such as establishing Persis |
| tence via [Accessibility Features](https://attack.mitre.org/ | | tence via [Accessibility Features](https://attack.mitre.org/ |
| techniques/T1546/008), [Boot or Logon Initialization Scripts | | techniques/T1546/008), [Boot or Logon Initialization Scripts |
| ](https://attack.mitre.org/techniques/T1037), [Unix Shell Co | | ](https://attack.mitre.org/techniques/T1037), [Unix Shell Co |
| nfiguration Modification](https://attack.mitre.org/technique | | nfiguration Modification](https://attack.mitre.org/technique |
| s/T1546/004), or tainting/hijacking other instrumental binar | | s/T1546/004), or tainting/hijacking other instrumental binar |
| y/configuration files via [Hijack Execution Flow](https://at | | y/configuration files via [Hijack Execution Flow](https://at |
| tack.mitre.org/techniques/T1574). | | tack.mitre.org/techniques/T1574). Adversaries may also chan |
| | | ge permissions of symbolic links. For example, malware (part |
| | | icularly ransomware) may modify symbolic links and associate |
| | | d settings to enable access to files from local shortcuts wi |
| | | th remote paths.(Citation: new_rust_based_ransomware)(Citati |
| | | on: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_at |
| | | tack)(Citation: blackmatter_blackcat)(Citation: fsutil_behav |
| | | ior) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-13 21:08:10.406000+00:00 | 2022-10-19 17:54:06.038000+00:00 |
| description | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574). | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions. This may enable malicious activity such as modifying, replacing, or deleting specific files or directories. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Accessibility Features](https://attack.mitre.org/techniques/T1546/008), [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037), [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).
Adversaries may also change permissions of symbolic links. For example, malware (particularly ransomware) may modify symbolic links and associated settings to enable access to files from local shortcuts with remote paths.(Citation: new_rust_based_ransomware)(Citation: bad_luck_blackcat)(Citation: falconoverwatch_blackcat_attack)(Citation: blackmatter_blackcat)(Citation: fsutil_behavior) |
| external_references[1]['source_name'] | Hybrid Analysis Icacls1 June 2018 | falconoverwatch_blackcat_attack |
| external_references[1]['description'] | Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018. | Falcon OverWatch Team. (2022, March 23). Falcon OverWatch Threat Hunting Contributes to Seamless Protection Against Novel BlackCat Attack. Retrieved May 5, 2022. |
| external_references[1]['url'] | https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100 | https://www.crowdstrike.com/blog/falcon-overwatch-contributes-to-blackcat-protection/ |
| external_references[2]['source_name'] | Hybrid Analysis Icacls2 May 2018 | Hybrid Analysis Icacls1 June 2018 |
| external_references[2]['description'] | Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018. | Hybrid Analysis. (2018, June 12). c9b65b764985dfd7a11d3faf599c56b8.exe. Retrieved August 19, 2018. |
| external_references[2]['url'] | https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110 | https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100 |
| external_references[3]['source_name'] | EventTracker File Permissions Feb 2014 | Hybrid Analysis Icacls2 May 2018 |
| external_references[3]['description'] | Netsurion. (2014, February 19). Monitoring File Permission Changes with the Windows Security Log. Retrieved August 19, 2018. | Hybrid Analysis. (2018, May 30). 2a8efbfadd798f6111340f7c1c956bee.dll. Retrieved August 19, 2018. |
| external_references[3]['url'] | https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/ | https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110 |
| x_mitre_data_sources[0] | Active Directory: Active Directory Object Modification | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | Active Directory: Active Directory Object Modification |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'bad_luck_blackcat', 'description': 'Kaspersky Global Research & Analysis Team (GReAT). (2022). A Bad Luck BlackCat. Retrieved May 5, 2022.', 'url': 'https://go.kaspersky.com/rs/802-IJN-240/images/TR_BlackCat_Report.pdf'} |
| external_references | | {'source_name': 'fsutil_behavior', 'description': 'Microsoft. (2021, September 27). fsutil behavior. Retrieved January 14, 2022.', 'url': 'https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior'} |
| external_references | | {'source_name': 'EventTracker File Permissions Feb 2014', 'description': 'Netsurion. (2014, February 19). Monitoring File Permission Changes with the Windows Security Log. Retrieved August 19, 2018.', 'url': 'https://www.eventtracker.com/tech-articles/monitoring-file-permission-changes-windows-security-log/'} |
| external_references | | {'source_name': 'blackmatter_blackcat', 'description': 'Pereira, T. Huey, C. (2022, March 17). From BlackMatter to BlackCat: Analyzing two attacks from one affiliate. Retrieved May 5, 2022.', 'url': 'https://blog.talosintelligence.com/2022/03/from-blackmatter-to-blackcat-analyzing.html'} |
| external_references | | {'source_name': 'new_rust_based_ransomware', 'description': 'Symantec Threat Hunter Team. (2021, December 16). Noberus: Technical Analysis Shows Sophistication of New Rust-based Ransomware. Retrieved January 14, 2022.', 'url': 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/noberus-blackcat-alphv-rust-ransomware'} |
[T1495] Firmware Corruption
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may overwrite or corrupt the flash memory conten | t | Adversaries may overwrite or corrupt the flash memory conten |
| ts of system BIOS or other firmware in devices attached to a | | ts of system BIOS or other firmware in devices attached to a |
| system in order to render them inoperable or unable to boot | | system in order to render them inoperable or unable to boot |
| , thus denying the availability to use the devices and/or th | | , thus denying the availability to use the devices and/or th |
| e system.(Citation: Symantec Chernobyl W95.CIH) Firmware is | | e system.(Citation: Symantec Chernobyl W95.CIH) Firmware is |
| software that is loaded and executed from non-volatile memor | | software that is loaded and executed from non-volatile memor |
| y on hardware devices in order to initialize and manage devi | | y on hardware devices in order to initialize and manage devi |
| ce functionality. These devices could include the motherboar | | ce functionality. These devices may include the motherboard, |
| d, hard drive, or video cards. In general, adversaries may | | hard drive, or video cards. In general, adversaries may ma |
| manipulate, overwrite, or corrupt firmware in order to deny | | nipulate, overwrite, or corrupt firmware in order to deny th |
| the use of the system or devices. Depending on the device, t | | e use of the system or devices. For example, corruption of f |
| his attack may also result in [Data Destruction](https://att | | irmware responsible for loading the operating system for net |
| ack.mitre.org/techniques/T1485). | | work devices may render the network devices inoperable.(Cita |
| | | tion: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs |
| | | _ukraine) Depending on the device, this attack may also resu |
| | | lt in [Data Destruction](https://attack.mitre.org/techniques |
| | | /T1485). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 23:01:15.945000+00:00 | 2022-08-31 17:30:05.440000+00:00 |
| description | Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices could include the motherboard, hard drive, or video cards.
In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485). | Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.
In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485). |
| external_references[1]['source_name'] | MITRE Trustworthy Firmware Measurement | cisa_malware_orgs_ukraine |
| external_references[1]['description'] | Upham, K. (2014, March). Going Deep into the BIOS with MITRE Firmware Security Research. Retrieved January 5, 2016. | CISA. (2022, April 28). Alert (AA22-057A) Update: Destructive Malware Targeting Organizations in Ukraine. Retrieved July 29, 2022. |
| external_references[1]['url'] | http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research | https://www.cisa.gov/uscert/ncas/alerts/aa22-057a |
| external_references[2]['source_name'] | Symantec Chernobyl W95.CIH | dhs_threat_to_net_devices |
| external_references[2]['description'] | Yamamura, M. (2002, April 25). W95.CIH. Retrieved April 12, 2019. | U.S. Department of Homeland Security. (2016, August 30). The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations. Retrieved July 29, 2022. |
| external_references[2]['url'] | https://web.archive.org/web/20190508170055/https://www.symantec.com/security-center/writeup/2000-122010-2655-99 | https://cyber.dhs.gov/assets/report/ar-16-20173.pdf |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'MITRE Trustworthy Firmware Measurement', 'description': 'Upham, K. (2014, March). Going Deep into the BIOS with MITRE Firmware Security Research. Retrieved January 5, 2016.', 'url': 'http://www.mitre.org/publications/project-stories/going-deep-into-the-bios-with-mitre-firmware-security-research'} |
| external_references | | {'source_name': 'Symantec Chernobyl W95.CIH', 'description': 'Yamamura, M. (2002, April 25). W95.CIH. Retrieved April 12, 2019.', 'url': 'https://web.archive.org/web/20190508170055/https://www.symantec.com/security-center/writeup/2000-122010-2655-99'} |
[T1553.001] Subvert Trust Controls: Gatekeeper Bypass
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may modify file attributes that signify programs | t | Adversaries may modify file attributes and subvert Gatekeepe |
| are from untrusted sources to subvert Gatekeeper controls i | | r functionality to evade user prompts and execute untrusted |
| n macOS. When documents, applications, or programs are downl | | programs. Gatekeeper is a set of technologies that act as la |
| oaded an extended attribute (xattr) called <code>com.apple.q | | yer of Apple’s security model to ensure only trusted applica |
| uarantine</code> can be set on the file by the application p | | tions are executed on a host. Gatekeeper was built on top of |
| erforming the download. This attribute, also known as a quar | | File Quarantine in Snow Leopard (10.6, 2009) and has grown |
| antine flag, is read by Apple's Gatekeeper defense program w | | to include Code Signing, security policy compliance, Notariz |
| hen the file is run and provides a prompt to the user to all | | ation, and more. Gatekeeper also treats applications running |
| ow or deny execution. Gatekeeper also monitors an applicatio | | for the first time differently than reopened applications.( |
| n's usage of dynamic libraries (dylibs) loaded outside the a | | Citation: TheEclecticLightCompany Quarantine and the flag)(C |
| pplication folder on any quarantined binary, often using the | | itation: TheEclecticLightCompany apple notarization ) Based |
| <code>dlopen</code> function. If the quarantine flag is set | | on an opt-in system, when files are downloaded an extended |
| in macOS 10.15+, Gatekeeper also checks for a notarization | | attribute (xattr) called `com.apple.quarantine` (also known |
| ticket and sends a cryptographic hash to Apple's servers to | | as a quarantine flag) can be set on the file by the applicat |
| check for validity for all unsigned executables.(Citation: T | | ion performing the download. Launch Services opens the appli |
| heEclecticLightCompany apple notarization )(Citation: Bypass | | cation in a suspended state. For first run applications with |
| ing Gatekeeper) The quarantine flag is an opt-in system and | | the quarantine flag set, Gatekeeper executes the following |
| not imposed by macOS. If an application opts-in, a file dow | | functions: 1. Checks extended attribute – Gatekeeper checks |
| nloaded from the Internet will be given a quarantine flag be | | for the quarantine flag, then provides an alert prompt to t |
| fore being saved to disk. Any application or user with write | | he user to allow or deny execution.(Citation: OceanLotus for |
| permissions to the file can change or strip the quarantine | | OS X)(Citation: 20 macOS Common Tools and Techniques) 2. C |
| flag. With elevated permission (sudo), this attribute can be | | hecks System Policies - Gatekeeper checks the system securit |
| removed from any file. The presence of the <code>com.apple. | | y policy, allowing execution of apps downloaded from either |
| quarantine</code> quarantine flag can be checked with the xa | | just the App Store or the App Store and identified developer |
| ttr command <code>xattr -l /path/to/examplefile</code>. Simi | | s. 3. Code Signing – Gatekeeper checks for a valid code sig |
| larly, this attribute can be recursively removed from all fi | | nature from an Apple Developer ID. 4. Notarization - Using |
| les in a folder using xattr, <code>sudo xattr -d com.apple.q | | the `api.apple-cloudkit.com` API, Gatekeeper reaches out to |
| uarantine /path/to/folder</code>.(Citation: 20 macOS Common | | Apple servers to verify or pull down the notarization ticket |
| Tools and Techniques)(Citation: TheEclecticLightCompany Quar | | and ensure the ticket is not revoked. Users can override no |
| antine and the flag)(Citation: theevilbit gatekeeper bypass | | tarization, which will result in a prompt of executing an “u |
| 2021) Apps and files loaded onto the system from a USB flas | | nauthorized app” and the security policy will be modified. |
| h drive, optical disk, external hard drive, from a drive sha | | Adversaries can subvert one or multiple security controls wi |
| red over the local network, or using the <code>curl</code> c | | thin Gatekeeper checks through logic errors (e.g. [Exploitat |
| ommand do not set this flag. Additionally, it is possible to | | ion for Defense Evasion](https://attack.mitre.org/techniques |
| avoid setting this flag using [Drive-by Compromise](https:/ | | /T1211)), unchecked file types, and external libraries. For |
| /attack.mitre.org/techniques/T1189), which may bypass Gateke | | example, prior to macOS 13 Ventura, code signing and notariz |
| eper. (Citation: Methods of Mac Malware Persistence)(Citatio | | ation checks were only conducted on first launch, allowing a |
| n: Clearing quarantine attribute)(Citation: OceanLotus for O | | dversaries to write malicious executables to previously open |
| S X) | | ed applications in order to bypass Gatekeeper security check |
| | | s.(Citation: theevilbit gatekeeper bypass 2021)(Citation: Ap |
| | | plication Bundle Manipulation Brandon Dalton) Applications |
| | | and files loaded onto the system from a USB flash drive, opt |
| | | ical disk, external hard drive, from a drive shared over the |
| | | local network, or using the curl command may not set the qu |
| | | arantine flag. Additionally, it is possible to avoid setting |
| | | the quarantine flag using [Drive-by Compromise](https://att |
| | | ack.mitre.org/techniques/T1189). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Brandon Dalton @PartyD0lphin', 'Swasti Bhushan Deb, IBM India Pvt. Ltd.'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 04:58:34.172000+00:00 | 2022-10-21 19:30:58.414000+00:00 |
| description | Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls in macOS. When documents, applications, or programs are downloaded an extended attribute (xattr) called com.apple.quarantine can be set on the file by the application performing the download. This attribute, also known as a quarantine flag, is read by Apple's Gatekeeper defense program when the file is run and provides a prompt to the user to allow or deny execution. Gatekeeper also monitors an application's usage of dynamic libraries (dylibs) loaded outside the application folder on any quarantined binary, often using the dlopen function. If the quarantine flag is set in macOS 10.15+, Gatekeeper also checks for a notarization ticket and sends a cryptographic hash to Apple's servers to check for validity for all unsigned executables.(Citation: TheEclecticLightCompany apple notarization )(Citation: Bypassing Gatekeeper)
The quarantine flag is an opt-in system and not imposed by macOS. If an application opts-in, a file downloaded from the Internet will be given a quarantine flag before being saved to disk. Any application or user with write permissions to the file can change or strip the quarantine flag. With elevated permission (sudo), this attribute can be removed from any file. The presence of the com.apple.quarantine quarantine flag can be checked with the xattr command xattr -l /path/to/examplefile. Similarly, this attribute can be recursively removed from all files in a folder using xattr, sudo xattr -d com.apple.quarantine /path/to/folder.(Citation: 20 macOS Common Tools and Techniques)(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: theevilbit gatekeeper bypass 2021)
Apps and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command do not set this flag. Additionally, it is possible to avoid setting this flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), which may bypass Gatekeeper. (Citation: Methods of Mac Malware Persistence)(Citation: Clearing quarantine attribute)(Citation: OceanLotus for OS X) | Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )
Based on an opt-in system, when files are downloaded an extended attribute (xattr) called `com.apple.quarantine` (also known as a quarantine flag) can be set on the file by the application performing the download. Launch Services opens the application in a suspended state. For first run applications with the quarantine flag set, Gatekeeper executes the following functions:
1. Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution.(Citation: OceanLotus for OS X)(Citation: 20 macOS Common Tools and Techniques)
2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers.
3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID.
4. Notarization - Using the `api.apple-cloudkit.com` API, Gatekeeper reaches out to Apple servers to verify or pull down the notarization ticket and ensure the ticket is not revoked. Users can override notarization, which will result in a prompt of executing an “unauthorized app” and the security policy will be modified.
Adversaries can subvert one or multiple security controls within Gatekeeper checks through logic errors (e.g. [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211)), unchecked file types, and external libraries. For example, prior to macOS 13 Ventura, code signing and notarization checks were only conducted on first launch, allowing adversaries to write malicious executables to previously opened applications in order to bypass Gatekeeper security checks.(Citation: theevilbit gatekeeper bypass 2021)(Citation: Application Bundle Manipulation Brandon Dalton)
Applications and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command may not set the quarantine flag. Additionally, it is possible to avoid setting the quarantine flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). |
| external_references[1]['source_name'] | theevilbit gatekeeper bypass 2021 | Application Bundle Manipulation Brandon Dalton |
| external_references[1]['description'] | Csaba Fitzl. (2021, June 29). GateKeeper - Not a Bypass (Again). Retrieved September 22, 2021. | Brandon Dalton. (2022, August 9). A bundle of nerves: Tweaking macOS security controls to thwart application bundle manipulation. Retrieved September 27, 2022. |
| external_references[1]['url'] | https://theevilbit.github.io/posts/gatekeeper_not_a_bypass/ | https://redcanary.com/blog/mac-application-bundles/ |
| external_references[2]['source_name'] | OceanLotus for OS X | theevilbit gatekeeper bypass 2021 |
| external_references[2]['description'] | Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017. | Csaba Fitzl. (2021, June 29). GateKeeper - Not a Bypass (Again). Retrieved September 22, 2021. |
| external_references[2]['url'] | https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update | https://theevilbit.github.io/posts/gatekeeper_not_a_bypass/ |
| external_references[3]['source_name'] | TheEclecticLightCompany Quarantine and the flag | OceanLotus for OS X |
| external_references[3]['description'] | hoakley. (2020, October 29). Quarantine and the quarantine flag. Retrieved September 13, 2021. | Eddie Lee. (2016, February 17). OceanLotus for OS X - an Application Bundle Pretending to be an Adobe Flash Update. Retrieved July 5, 2017. |
| external_references[3]['url'] | https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/ | https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update |
| external_references[4]['source_name'] | TheEclecticLightCompany apple notarization | TheEclecticLightCompany Quarantine and the flag |
| external_references[4]['description'] | How Notarization Works. (2020, August 28). How notarization works. Retrieved September 13, 2021. | hoakley. (2020, October 29). Quarantine and the quarantine flag. Retrieved September 13, 2021. |
| external_references[4]['url'] | https://eclecticlight.co/2020/08/28/how-notarization-works/ | https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/ |
| external_references[5]['source_name'] | Methods of Mac Malware Persistence | TheEclecticLightCompany apple notarization |
| external_references[5]['description'] | Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017. | How Notarization Works. (2020, August 28). How notarization works. Retrieved September 13, 2021. |
| external_references[5]['url'] | https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf | https://eclecticlight.co/2020/08/28/how-notarization-works/ |
| x_mitre_data_sources[0] | File: File Modification | File: File Metadata |
| x_mitre_data_sources[1] | Command: Command Execution | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | File: File Modification |
| x_mitre_data_sources[3] | File: File Metadata | Command: Command Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Clearing quarantine attribute', 'description': 'Rich Trouton. (2012, November 20). Clearing the quarantine extended attribute from downloaded applications. Retrieved July 5, 2017.', 'url': 'https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/'} | |
| external_references | {'source_name': 'Bypassing Gatekeeper', 'description': "Thomas Reed. (2016, March 31). Bypassing Apple's Gatekeeper. Retrieved July 5, 2017.", 'url': 'https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/'} | |
[T1562.003] Impair Defenses: Impair Command History Logging
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may impair command history logging to hide comma | t | Adversaries may impair command history logging to hide comma |
| nds they run on a compromised system. Various command interp | | nds they run on a compromised system. Various command interp |
| reters keep track of the commands users type in their termin | | reters keep track of the commands users type in their termin |
| al so that users can retrace what they've done. On Linux a | | al so that users can retrace what they've done. On Linux a |
| nd macOS, command history is tracked in a file pointed to by | | nd macOS, command history is tracked in a file pointed to by |
| the environment variable <code>HISTFILE</code>. When a user | | the environment variable <code>HISTFILE</code>. When a user |
| logs off a system, this information is flushed to a file in | | logs off a system, this information is flushed to a file in |
| the user's home directory called <code>~/.bash_history</cod | | the user's home directory called <code>~/.bash_history</cod |
| e>. The <code>HISTCONTROL</code> environment variable keeps | | e>. The <code>HISTCONTROL</code> environment variable keeps |
| track of what should be saved by the <code>history</code> co | | track of what should be saved by the <code>history</code> co |
| mmand and eventually into the <code>~/.bash_history</code> f | | mmand and eventually into the <code>~/.bash_history</code> f |
| ile when a user logs out. <code>HISTCONTROL</code> does not | | ile when a user logs out. <code>HISTCONTROL</code> does not |
| exist by default on macOS, but can be set by the user and wi | | exist by default on macOS, but can be set by the user and wi |
| ll be respected. Adversaries may clear the history environm | | ll be respected. Adversaries may clear the history environm |
| ent variable (<code>unset HISTFILE</code>) or set the comman | | ent variable (<code>unset HISTFILE</code>) or set the comman |
| d history size to zero (<code>export HISTFILESIZE=0</code>) | | d history size to zero (<code>export HISTFILESIZE=0</code>) |
| to prevent logging of commands. Additionally, <code>HISTCONT | | to prevent logging of commands. Additionally, <code>HISTCONT |
| ROL</code> can be configured to ignore commands that start w | | ROL</code> can be configured to ignore commands that start w |
| ith a space by simply setting it to "ignorespace". <code>HIS | | ith a space by simply setting it to "ignorespace". <code>HIS |
| TCONTROL</code> can also be set to ignore duplicate commands | | TCONTROL</code> can also be set to ignore duplicate commands |
| by setting it to "ignoredups". In some Linux systems, this | | by setting it to "ignoredups". In some Linux systems, this |
| is set by default to "ignoreboth" which covers both of the p | | is set by default to "ignoreboth" which covers both of the p |
| revious examples. This means that “ ls” will not be saved, b | | revious examples. This means that “ ls” will not be saved, b |
| ut “ls” would be saved by history. Adversaries can abuse thi | | ut “ls” would be saved by history. Adversaries can abuse thi |
| s to operate without leaving traces by simply prepending a s | | s to operate without leaving traces by simply prepending a s |
| pace to all of their terminal commands. On Windows systems | | pace to all of their terminal commands. On Windows systems |
| , the <code>PSReadLine</code> module tracks commands used in | | , the <code>PSReadLine</code> module tracks commands used in |
| all PowerShell sessions and writes them to a file (<code>$e | | all PowerShell sessions and writes them to a file (<code>$e |
| nv:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHo | | nv:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHo |
| st_history.txt</code> by default). Adversaries may change wh | | st_history.txt</code> by default). Adversaries may change wh |
| ere these logs are saved using <code>Set-PSReadLineOption -H | | ere these logs are saved using <code>Set-PSReadLineOption -H |
| istorySavePath {File Path}</code>. This will cause <code>Con | | istorySavePath {File Path}</code>. This will cause <code>Con |
| soleHost_history.txt</code> to stop receiving logs. Addition | | soleHost_history.txt</code> to stop receiving logs. Addition |
| ally, it is possible to turn off logging to this file using | | ally, it is possible to turn off logging to this file using |
| the PowerShell command <code>Set-PSReadlineOption -HistorySa | | the PowerShell command <code>Set-PSReadlineOption -HistorySa |
| veStyle SaveNothing</code>.(Citation: Microsoft PowerShell C | | veStyle SaveNothing</code>.(Citation: Microsoft PowerShell C |
| ommand History)(Citation: Sophos PowerShell command audit)(C | | ommand History)(Citation: Sophos PowerShell command audit)(C |
| itation: Sophos PowerShell Command History Forensics) Adver | | itation: Sophos PowerShell Command History Forensics) Adver |
| saries may also leverage a [Network Device CLI](https://atta | | saries may also leverage a [Network Device CLI](https://atta |
| ck.mitre.org/techniques/T1059/008) on network devices to dis | | ck.mitre.org/techniques/T1059/008) on network devices to dis |
| able historical command logging. | | able historical command logging (e.g. <code>no logging</code |
| | | >). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:11:45.153000+00:00 | 2022-09-01 20:48:29.785000+00:00 |
| description | Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.
Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.
On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging. | Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.
Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands. Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.
On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default). Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}. This will cause ConsoleHost_history.txt to stop receiving logs. Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.(Citation: Microsoft PowerShell Command History)(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to disable historical command logging (e.g. no logging). |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | User Account: User Account Metadata |
[T1562] Impair Defenses
Current version: 1.3
Version changed from: 1.2 → 1.3
New Mitigations:
- M1038: Execution Prevention
New Detections:
- DS0027: Driver (Driver Load)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:55:28.348000+00:00 | 2022-10-19 16:32:56.502000+00:00 |
| x_mitre_data_sources[0] | Command: Command Execution | Firewall: Firewall Disable |
| x_mitre_data_sources[1] | Firewall: Firewall Rule Modification | Driver: Driver Load |
| x_mitre_data_sources[2] | Cloud Service: Cloud Service Disable | Process: Process Creation |
| x_mitre_data_sources[3] | Windows Registry: Windows Registry Key Deletion | Script: Script Execution |
| x_mitre_data_sources[4] | Service: Service Metadata | Cloud Service: Cloud Service Disable |
| x_mitre_data_sources[5] | Sensor Health: Host Status | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[6] | Process: Process Creation | Sensor Health: Host Status |
| x_mitre_data_sources[7] | Process: Process Termination | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[8] | Windows Registry: Windows Registry Key Modification | Command: Command Execution |
| x_mitre_data_sources[10] | Firewall: Firewall Disable | Service: Service Metadata |
| x_mitre_data_sources[11] | Script: Script Execution | Process: Process Termination |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Firewall: Firewall Rule Modification |
[T1562.006] Impair Defenses: Indicator Blocking
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | An adversary may attempt to block indicators or events typic | t | An adversary may attempt to block indicators or events typic |
| ally captured by sensors from being gathered and analyzed. T | | ally captured by sensors from being gathered and analyzed. T |
| his could include maliciously redirecting (Citation: Microso | | his could include maliciously redirecting (Citation: Microso |
| ft Lamin Sept 2017) or even disabling host-based sensors, su | | ft Lamin Sept 2017) or even disabling host-based sensors, su |
| ch as Event Tracing for Windows (ETW),(Citation: Microsoft A | | ch as Event Tracing for Windows (ETW),(Citation: Microsoft A |
| bout Event Tracing 2018) by tampering settings that control | | bout Event Tracing 2018) by tampering settings that control |
| the collection and flow of event telemetry. (Citation: Mediu | | the collection and flow of event telemetry. (Citation: Mediu |
| m Event Tracing Tampering 2018) These settings may be stored | | m Event Tracing Tampering 2018) These settings may be stored |
| on the system in configuration files and/or in the Registry | | on the system in configuration files and/or in the Registry |
| as well as being accessible via administrative utilities su | | as well as being accessible via administrative utilities su |
| ch as [PowerShell](https://attack.mitre.org/techniques/T1059 | | ch as [PowerShell](https://attack.mitre.org/techniques/T1059 |
| /001) or [Windows Management Instrumentation](https://attack | | /001) or [Windows Management Instrumentation](https://attack |
| .mitre.org/techniques/T1047). ETW interruption can be achie | | .mitre.org/techniques/T1047). ETW interruption can be achie |
| ved multiple ways, however most directly by defining conditi | | ved multiple ways, however most directly by defining conditi |
| ons using the [PowerShell](https://attack.mitre.org/techniqu | | ons using the [PowerShell](https://attack.mitre.org/techniqu |
| es/T1059/001) <code>Set-EtwTraceProvider</code> cmdlet or by | | es/T1059/001) <code>Set-EtwTraceProvider</code> cmdlet or by |
| interfacing directly with the Registry to make alterations. | | interfacing directly with the Registry to make alterations. |
| In the case of network-based reporting of indicators, an a | | In the case of network-based reporting of indicators, an a |
| dversary may block traffic associated with reporting to prev | | dversary may block traffic associated with reporting to prev |
| ent central analysis. This may be accomplished by many means | | ent central analysis. This may be accomplished by many means |
| , such as stopping a local process responsible for forwardin | | , such as stopping a local process responsible for forwardin |
| g telemetry and/or creating a host-based firewall rule to bl | | g telemetry and/or creating a host-based firewall rule to bl |
| ock traffic to specific hosts responsible for aggregating ev | | ock traffic to specific hosts responsible for aggregating ev |
| ents, such as security information and event management (SIE | | ents, such as security information and event management (SIE |
| M) products. | | M) products. In Linux environments, adversaries may disable |
| | | or reconfigure log processing tools such as syslog or nxlog |
| | | to inhibit detection and monitoring capabilities to facilit |
| | | ate follow on behaviors (Citation: LemonDuck). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | Manoj Ahuje. (2022, April 21). LemonDuck Targets Docker for Cryptomining Operations. Retrieved June 30, 2022. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-571 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-01-13 15:56:04.897000+00:00 | 2022-06-30 16:44:16.962000+00:00 |
| description | An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products. | An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.
In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck). |
| external_references[1]['source_name'] | capec | LemonDuck |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/571.html | https://www.crowdstrike.com/blog/lemonduck-botnet-targets-docker-for-cryptomining-operations/ |
| x_mitre_data_sources[0] | Windows Registry: Windows Registry Key Modification | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Windows Registry: Windows Registry Key Modification |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/571.html', 'external_id': 'CAPEC-571'} |
[T1557.001] Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | By responding to LLMNR/NBT-NS network traffic, adversaries m | t | By responding to LLMNR/NBT-NS network traffic, adversaries m |
| ay spoof an authoritative source for name resolution to forc | | ay spoof an authoritative source for name resolution to forc |
| e communication with an adversary controlled system. This ac | | e communication with an adversary controlled system. This ac |
| tivity may be used to collect or relay authentication materi | | tivity may be used to collect or relay authentication materi |
| als. Link-Local Multicast Name Resolution (LLMNR) and NetB | | als. Link-Local Multicast Name Resolution (LLMNR) and NetB |
| IOS Name Service (NBT-NS) are Microsoft Windows components t | | IOS Name Service (NBT-NS) are Microsoft Windows components t |
| hat serve as alternate methods of host identification. LLMNR | | hat serve as alternate methods of host identification. LLMNR |
| is based upon the Domain Name System (DNS) format and allow | | is based upon the Domain Name System (DNS) format and allow |
| s hosts on the same local link to perform name resolution fo | | s hosts on the same local link to perform name resolution fo |
| r other hosts. NBT-NS identifies systems on a local network | | r other hosts. NBT-NS identifies systems on a local network |
| by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation | | by their NetBIOS name. (Citation: Wikipedia LLMNR)(Citation: |
| : TechNet NetBIOS) Adversaries can spoof an authoritative s | | TechNet NetBIOS) Adversaries can spoof an authoritative so |
| ource for name resolution on a victim network by responding | | urce for name resolution on a victim network by responding t |
| to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know | | o LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know |
| the identity of the requested host, effectively poisoning t | | the identity of the requested host, effectively poisoning th |
| he service so that the victims will communicate with the adv | | e service so that the victims will communicate with the adve |
| ersary controlled system. If the requested host belongs to a | | rsary controlled system. If the requested host belongs to a |
| resource that requires identification/authentication, the u | | resource that requires identification/authentication, the us |
| sername and NTLMv2 hash will then be sent to the adversary c | | ername and NTLMv2 hash will then be sent to the adversary co |
| ontrolled system. The adversary can then collect the hash in | | ntrolled system. The adversary can then collect the hash inf |
| formation sent over the wire through tools that monitor the | | ormation sent over the wire through tools that monitor the p |
| ports for traffic or through [Network Sniffing](https://atta | | orts for traffic or through [Network Sniffing](https://attac |
| ck.mitre.org/techniques/T1040) and crack the hashes offline | | k.mitre.org/techniques/T1040) and crack the hashes offline t |
| through [Brute Force](https://attack.mitre.org/techniques/T1 | | hrough [Brute Force](https://attack.mitre.org/techniques/T11 |
| 110) to obtain the plaintext passwords. In some cases where | | 10) to obtain the plaintext passwords. In some cases where |
| an adversary has access to a system that is in the authentic | | an adversary has access to a system that is in the authentic |
| ation path between systems or when automated scans that use | | ation path between systems or when automated scans that use |
| credentials attempt to authenticate to an adversary controll | | credentials attempt to authenticate to an adversary controll |
| ed system, the NTLMv2 hashes can be intercepted and relayed | | ed system, the NTLMv2 hashes can be intercepted and relayed |
| to access and execute code against a target system. The rela | | to access and execute code against a target system. The rela |
| y step can happen in conjunction with poisoning but may also | | y step can happen in conjunction with poisoning but may also |
| be independent of it. (Citation: byt3bl33d3r NTLM Relaying) | | be independent of it.(Citation: byt3bl33d3r NTLM Relaying)( |
| (Citation: Secure Ideas SMB Relay) Several tools exist that | | Citation: Secure Ideas SMB Relay) Additionally, adversaries |
| can be used to poison name services within local networks s | | may encapsulate the NTLMv1/v2 hashes into various protocols, |
| uch as NBNSpoof, Metasploit, and [Responder](https://attack. | | such as LDAP, SMB, MSSQL and HTTP, to expand and use multip |
| mitre.org/software/S0174). (Citation: GitHub NBNSpoof) (Cita | | le services with the valid NTLM response. Several tools ma |
| tion: Rapid7 LLMNR Spoofer) (Citation: GitHub Responder) | | y be used to poison name services within local networks such |
| | | as NBNSpoof, Metasploit, and [Responder](https://attack.mit |
| | | re.org/software/S0174).(Citation: GitHub NBNSpoof)(Citation: |
| | | Rapid7 LLMNR Spoofer)(Citation: GitHub Responder) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-28 13:09:50.809000+00:00 | 2022-10-18 20:13:48.423000+00:00 |
| description | By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords. In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it. (Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay)
Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174). (Citation: GitHub NBNSpoof) (Citation: Rapid7 LLMNR Spoofer) (Citation: GitHub Responder) | By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR)(Citation: TechNet NetBIOS)
Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system. If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system. The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through [Network Sniffing](https://attack.mitre.org/techniques/T1040) and crack the hashes offline through [Brute Force](https://attack.mitre.org/techniques/T1110) to obtain the plaintext passwords.
In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system. The relay step can happen in conjunction with poisoning but may also be independent of it.(Citation: byt3bl33d3r NTLM Relaying)(Citation: Secure Ideas SMB Relay) Additionally, adversaries may encapsulate the NTLMv1/v2 hashes into various protocols, such as LDAP, SMB, MSSQL and HTTP, to expand and use multiple services with the valid NTLM response.
Several tools may be used to poison name services within local networks such as NBNSpoof, Metasploit, and [Responder](https://attack.mitre.org/software/S0174).(Citation: GitHub NBNSpoof)(Citation: Rapid7 LLMNR Spoofer)(Citation: GitHub Responder) |
| external_references[1]['source_name'] | Wikipedia LLMNR | Rapid7 LLMNR Spoofer |
| external_references[1]['description'] | Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution. Retrieved November 17, 2017. | Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017. |
| external_references[1]['url'] | https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution | https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response |
| external_references[2]['source_name'] | TechNet NetBIOS | GitHub Responder |
| external_references[2]['description'] | Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November 17, 2017. | Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017. |
| external_references[2]['url'] | https://technet.microsoft.com/library/cc958811.aspx | https://github.com/SpiderLabs/Responder |
| external_references[3]['source_name'] | byt3bl33d3r NTLM Relaying | Secure Ideas SMB Relay |
| external_references[3]['description'] | Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019. | Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019. |
| external_references[3]['url'] | https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html | https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html |
| external_references[4]['source_name'] | Secure Ideas SMB Relay | TechNet NetBIOS |
| external_references[4]['description'] | Kuehn, E. (2018, April 11). Ever Run a Relay? Why SMB Relays Should Be On Your Mind. Retrieved February 7, 2019. | Microsoft. (n.d.). NetBIOS Name Resolution. Retrieved November 17, 2017. |
| external_references[4]['url'] | https://blog.secureideas.com/2018/04/ever-run-a-relay-why-smb-relays-should-be-on-your-mind.html | https://technet.microsoft.com/library/cc958811.aspx |
| external_references[6]['source_name'] | Rapid7 LLMNR Spoofer | GitHub Conveigh |
| external_references[6]['description'] | Francois, R. (n.d.). LLMNR Spoofer. Retrieved November 17, 2017. | Robertson, K. (2016, August 28). Conveigh. Retrieved November 17, 2017. |
| external_references[6]['url'] | https://www.rapid7.com/db/modules/auxiliary/spoof/llmnr/llmnr_response | https://github.com/Kevin-Robertson/Conveigh |
| external_references[7]['source_name'] | GitHub Responder | byt3bl33d3r NTLM Relaying |
| external_references[7]['description'] | Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017. | Salvati, M. (2017, June 2). Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes). Retrieved February 7, 2019. |
| external_references[7]['url'] | https://github.com/SpiderLabs/Responder | https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html |
| external_references[9]['source_name'] | GitHub Conveigh | Wikipedia LLMNR |
| external_references[9]['description'] | Robertson, K. (2016, August 28). Conveigh. Retrieved November 17, 2017. | Wikipedia. (2016, July 7). Link-Local Multicast Name Resolution. Retrieved November 17, 2017. |
| external_references[9]['url'] | https://github.com/Kevin-Robertson/Conveigh | https://en.wikipedia.org/wiki/Link-Local_Multicast_Name_Resolution |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Flow | Service: Service Creation |
| x_mitre_data_sources[2] | Network Traffic: Network Traffic Content | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[3] | Service: Service Creation | Network Traffic: Network Traffic Content |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Andrew Allen, @whitehat_zero |
[T1608.005] Stage Capabilities: Link Target
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may put in place resources that are referenced b | t | Adversaries may put in place resources that are referenced b |
| y a link that can be used during targeting. An adversary may | | y a link that can be used during targeting. An adversary may |
| rely upon a user clicking a malicious link in order to divu | | rely upon a user clicking a malicious link in order to divu |
| lge information (including credentials) or to gain execution | | lge information (including credentials) or to gain execution |
| , as in [Malicious Link](https://attack.mitre.org/techniques | | , as in [Malicious Link](https://attack.mitre.org/techniques |
| /T1204/001). Links can be used for spearphishing, such as se | | /T1204/001). Links can be used for spearphishing, such as se |
| nding an email accompanied by social engineering text to coa | | nding an email accompanied by social engineering text to coa |
| x the user to actively click or copy and paste a URL into a | | x the user to actively click or copy and paste a URL into a |
| browser. Prior to a phish for information (as in [Spearphish | | browser. Prior to a phish for information (as in [Spearphish |
| ing Link](https://attack.mitre.org/techniques/T1598/003)) or | | ing Link](https://attack.mitre.org/techniques/T1598/003)) or |
| a phish to gain initial access to a system (as in [Spearphi | | a phish to gain initial access to a system (as in [Spearphi |
| shing Link](https://attack.mitre.org/techniques/T1566/002)), | | shing Link](https://attack.mitre.org/techniques/T1566/002)), |
| an adversary must set up the resources for a link target fo | | an adversary must set up the resources for a link target fo |
| r the spearphishing link. Typically, the resources for a l | | r the spearphishing link. Typically, the resources for a l |
| ink target will be an HTML page that may include some client | | ink target will be an HTML page that may include some client |
| -side script such as [JavaScript](https://attack.mitre.org/t | | -side script such as [JavaScript](https://attack.mitre.org/t |
| echniques/T1059/007) to decide what content to serve to the | | echniques/T1059/007) to decide what content to serve to the |
| user. Adversaries may clone legitimate sites to serve as the | | user. Adversaries may clone legitimate sites to serve as the |
| link target, this can include cloning of login pages of leg | | link target, this can include cloning of login pages of leg |
| itimate web services or organization login pages in an effor | | itimate web services or organization login pages in an effor |
| t to harvest credentials during [Spearphishing Link](https:/ | | t to harvest credentials during [Spearphishing Link](https:/ |
| /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby | | /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby |
| tes Silent Librarian October 2020)(Citation: Proofpoint TA40 | | tes Silent Librarian October 2020)(Citation: Proofpoint TA40 |
| 7 September 2019) Adversaries may also [Upload Malware](http | | 7 September 2019) Adversaries may also [Upload Malware](http |
| s://attack.mitre.org/techniques/T1608/001) and have the link | | s://attack.mitre.org/techniques/T1608/001) and have the link |
| target point to malware for download/execution by the user. | | target point to malware for download/execution by the user. |
| Adversaries may purchase domains similar to legitimate dom | | Adversaries may purchase domains similar to legitimate dom |
| ains (ex: homoglyphs, typosquatting, different top-level dom | | ains (ex: homoglyphs, typosquatting, different top-level dom |
| ain, etc.) during acquisition of infrastructure ([Domains](h | | ain, etc.) during acquisition of infrastructure ([Domains](h |
| ttps://attack.mitre.org/techniques/T1583/001)) to help facil | | ttps://attack.mitre.org/techniques/T1583/001)) to help facil |
| itate [Malicious Link](https://attack.mitre.org/techniques/T | | itate [Malicious Link](https://attack.mitre.org/techniques/T |
| 1204/001). Link shortening services can also be employed. | | 1204/001). Link shortening services can also be employed. Ad |
| | | versaries may also use free or paid accounts on Platform-as- |
| | | a-Service providers to host link targets while taking advant |
| | | age of the widely trusted domains of those providers to avoi |
| | | d being blocked.(Citation: Netskope GCP Redirection)(Citatio |
| | | n: Netskope Cloud Phishing)(Citation: Intezer App Service Ph |
| | | ishing) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 16:28:41.565000+00:00 | 2022-10-20 20:15:57.855000+00:00 |
| description | Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Link shortening services can also be employed. | Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Link shortening services can also be employed. Adversaries may also use free or paid accounts on Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked.(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)(Citation: Intezer App Service Phishing) |
| external_references[1]['source_name'] | Malwarebytes Silent Librarian October 2020 | Netskope GCP Redirection |
| external_references[1]['description'] | Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021. | Ashwin Vamshi. (2019, January 24). Targeted Attacks Abusing Google Cloud Platform Open Redirection. Retrieved August 18, 2022. |
| external_references[1]['url'] | https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/ | https://www.netskope.com/blog/targeted-attacks-abusing-google-cloud-platform-open-redirection |
| external_references[2]['source_name'] | Proofpoint TA407 September 2019 | Netskope Cloud Phishing |
| external_references[2]['description'] | Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021. | Ashwin Vamshi. (2020, August 12). A Big Catch: Cloud Phishing from Google App Engine and Azure App Service. Retrieved August 18, 2022. |
| external_references[2]['url'] | https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian | https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Malwarebytes Silent Librarian October 2020', 'description': 'Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.', 'url': 'https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/'} |
| external_references | | {'source_name': 'Intezer App Service Phishing', 'description': 'Paul Litvak. (2020, October 8). Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure. Retrieved August 18, 2022.', 'url': 'https://www.intezer.com/blog/malware-analysis/kud-i-enter-your-server-new-vulnerabilities-in-microsoft-azure/'} |
| external_references | | {'source_name': 'Proofpoint TA407 September 2019', 'description': 'Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.', 'url': 'https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian'} |
[T1087.001] Account Discovery: Local Account
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0036: Group (Group Enumeration)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-07-28 18:05:24.567000+00:00 | 2022-08-25 13:04:39.404000+00:00 |
| x_mitre_data_sources[0] | Process: Process Creation | Group: Group Enumeration |
| x_mitre_data_sources[1] | File: File Access | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | File: File Access |
| x_mitre_data_sources[3] | Process: OS API Execution | Group: Group Enumeration |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Miriam Wiesner, @miriamxyra, Microsoft Security |
| x_mitre_data_sources | | Process: OS API Execution |
| x_mitre_data_sources | | Process: Process Creation |
[T1069.001] Permission Groups Discovery: Local Groups
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0009: Process (OS API Execution)
- DS0036: Group (Group Enumeration)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Harshal Tupsamudre, Qualys', 'Miriam Wiesner, @miriamxyra, Microsoft Security'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 17:48:27.871000+00:00 | 2022-08-25 13:03:08.484000+00:00 |
| x_mitre_data_sources[3] | Command: Command Execution | Group: Group Enumeration |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
| x_mitre_data_sources | | Process: OS API Execution |
| x_mitre_data_sources | | Group: Group Enumeration |
[T1556] Modify Authentication Process
Current version: 2.2
Version changed from: 2.1 → 2.2
New Mitigations:
- M1018: User Account Management
- M1047: Audit
New Detections:
- DS0002: User Account (User Account Authentication)
- DS0002: User Account (User Account Modification)
- DS0015: Application Log (Application Log Content)
- DS0026: Active Directory (Active Directory Object Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-10 22:26:33.374000+00:00 | 2022-10-18 16:28:56.126000+00:00 |
| external_references[2]['source_name'] | Dell Skeleton | Xorrior Authorization Plugins |
| external_references[2]['description'] | Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019. | Chris Ross. (2018, October 17). Persistent Credential Theft with Authorization Plugins. Retrieved April 22, 2021. |
| external_references[2]['url'] | https://www.secureworks.com/research/skeleton-key-malware-analysis | https://xorrior.com/persistent-credential-theft/ |
| external_references[3]['source_name'] | Xorrior Authorization Plugins | Dell Skeleton |
| external_references[3]['description'] | Chris Ross. (2018, October 17). Persistent Credential Theft with Authorization Plugins. Retrieved April 22, 2021. | Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019. |
| external_references[3]['url'] | https://xorrior.com/persistent-credential-theft/ | https://www.secureworks.com/research/skeleton-key-malware-analysis |
| external_references[4]['source_name'] | TechNet Audit Policy | dump_pwd_dcsync |
| external_references[4]['description'] | Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016. | Metcalf, S. (2015, November 22). Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync. Retrieved November 15, 2021. |
| external_references[4]['url'] | https://technet.microsoft.com/en-us/library/dn487457.aspx | https://adsecurity.org/?p=2053 |
| external_references[5]['source_name'] | dump_pwd_dcsync | TechNet Audit Policy |
| external_references[5]['description'] | Metcalf, S. (2015, November 22). Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync. Retrieved November 15, 2021. | Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016. |
| external_references[5]['url'] | https://adsecurity.org/?p=2053 | https://technet.microsoft.com/en-us/library/dn487457.aspx |
| x_mitre_data_sources[0] | File: File Modification | File: File Creation |
| x_mitre_data_sources[2] | File: File Creation | Module: Module Load |
| x_mitre_data_sources[3] | Process: OS API Execution | Active Directory: Active Directory Object Modification |
| x_mitre_data_sources[5] | Windows Registry: Windows Registry Key Modification | Process: OS API Execution |
| x_mitre_data_sources[6] | Module: Module Load | File: File Modification |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Application Log: Application Log Content |
| x_mitre_data_sources | | User Account: User Account Authentication |
| x_mitre_data_sources | | User Account: User Account Modification |
| x_mitre_data_sources | | Windows Registry: Windows Registry Key Modification |
| x_mitre_platforms | | Azure AD |
| x_mitre_platforms | | Google Workspace |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Office 365 |
| x_mitre_platforms | | SaaS |
[T1027] Obfuscated Files or Information
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may attempt to make an executable or file diffic | t | Adversaries may attempt to make an executable or file diffic |
| ult to discover or analyze by encrypting, encoding, or other | | ult to discover or analyze by encrypting, encoding, or other |
| wise obfuscating its contents on the system or in transit. T | | wise obfuscating its contents on the system or in transit. T |
| his is common behavior that can be used across different pla | | his is common behavior that can be used across different pla |
| tforms and the network to evade defenses. Payloads may be | | tforms and the network to evade defenses. Payloads may be |
| compressed, archived, or encrypted in order to avoid detecti | | compressed, archived, or encrypted in order to avoid detecti |
| on. These payloads may be used during Initial Access or late | | on. These payloads may be used during Initial Access or late |
| r to mitigate detection. Sometimes a user's action may be re | | r to mitigate detection. Sometimes a user's action may be re |
| quired to open and [Deobfuscate/Decode Files or Information] | | quired to open and [Deobfuscate/Decode Files or Information] |
| (https://attack.mitre.org/techniques/T1140) for [User Execut | | (https://attack.mitre.org/techniques/T1140) for [User Execut |
| ion](https://attack.mitre.org/techniques/T1204). The user ma | | ion](https://attack.mitre.org/techniques/T1204). The user ma |
| y also be required to input a password to open a password pr | | y also be required to input a password to open a password pr |
| otected compressed/encrypted file that was provided by the a | | otected compressed/encrypted file that was provided by the a |
| dversary. (Citation: Volexity PowerDuke November 2016) Adver | | dversary. (Citation: Volexity PowerDuke November 2016) Adver |
| saries may also used compressed or archived scripts, such as | | saries may also use compressed or archived scripts, such as |
| JavaScript. Portions of files can also be encoded to hide | | JavaScript. Portions of files can also be encoded to hide |
| the plain-text strings that would otherwise help defenders | | the plain-text strings that would otherwise help defenders w |
| with discovery. (Citation: Linux/Cdorked.A We Live Security | | ith discovery. (Citation: Linux/Cdorked.A We Live Security A |
| Analysis) Payloads may also be split into separate, seemingl | | nalysis) Payloads may also be split into separate, seemingly |
| y benign files that only reveal malicious functionality when | | benign files that only reveal malicious functionality when |
| reassembled. (Citation: Carbon Black Obfuscation Sept 2016) | | reassembled. (Citation: Carbon Black Obfuscation Sept 2016) |
| Adversaries may also obfuscate commands executed from payl | | Adversaries may also obfuscate commands executed from paylo |
| oads or directly via a [Command and Scripting Interpreter](h | | ads or directly via a [Command and Scripting Interpreter](ht |
| ttps://attack.mitre.org/techniques/T1059). Environment varia | | tps://attack.mitre.org/techniques/T1059). Environment variab |
| bles, aliases, characters, and other platform/language speci | | les, aliases, characters, and other platform/language specif |
| fic semantics can be used to evade signature based detection | | ic semantics can be used to evade signature based detections |
| s and application control mechanisms. (Citation: FireEye Obf | | and application control mechanisms. (Citation: FireEye Obfu |
| uscation June 2017) (Citation: FireEye Revoke-Obfuscation Ju | | scation June 2017) (Citation: FireEye Revoke-Obfuscation Jul |
| ly 2017)(Citation: PaloAlto EncodedCommand March 2017) | | y 2017)(Citation: PaloAlto EncodedCommand March 2017) |
New Detections:
- DS0009: Process (OS API Execution)
- DS0011: Module (Module Load)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 05:08:05.584000+00:00 | 2022-09-30 18:06:32.808000+00:00 |
| description | Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also used compressed or archived scripts, such as JavaScript.
Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)
Adversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) | Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Sometimes a user's action may be required to open and [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) for [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) Adversaries may also use compressed or archived scripts, such as JavaScript.
Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery. (Citation: Linux/Cdorked.A We Live Security Analysis) Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled. (Citation: Carbon Black Obfuscation Sept 2016)
Adversaries may also obfuscate commands executed from payloads or directly via a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Revoke-Obfuscation July 2017)(Citation: PaloAlto EncodedCommand March 2017) |
| x_mitre_data_sources[5] | File: File Metadata | Module: Module Load |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_data_sources[3] | Process: Process Creation | Process: OS API Execution |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_data_sources | | File: File Metadata |
[T1201] Password Policy Discovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may attempt to access detailed information about | t | Adversaries may attempt to access detailed information about |
| the password policy used within an enterprise network or cl | | the password policy used within an enterprise network or cl |
| oud environment. Password policies are a way to enforce comp | | oud environment. Password policies are a way to enforce comp |
| lex passwords that are difficult to guess or crack through [ | | lex passwords that are difficult to guess or crack through [ |
| Brute Force](https://attack.mitre.org/techniques/T1110). Thi | | Brute Force](https://attack.mitre.org/techniques/T1110). Thi |
| s information may help the adversary to create a list of com | | s information may help the adversary to create a list of com |
| mon passwords and launch dictionary and/or brute force attac | | mon passwords and launch dictionary and/or brute force attac |
| ks which adheres to the policy (e.g. if the minimum password | | ks which adheres to the policy (e.g. if the minimum password |
| length should be 8, then not trying passwords such as 'pass | | length should be 8, then not trying passwords such as 'pass |
| 123'; not checking for more than 3-4 passwords per account i | | 123'; not checking for more than 3-4 passwords per account i |
| f the lockout is set to 6 as to not lock out accounts). Pas | | f the lockout is set to 6 as to not lock out accounts). Pas |
| sword policies can be set and discovered on Windows, Linux, | | sword policies can be set and discovered on Windows, Linux, |
| and macOS systems via various command shell utilities such a | | and macOS systems via various command shell utilities such a |
| s <code>net accounts (/domain)</code>, <code>Get-ADDefaultDo | | s <code>net accounts (/domain)</code>, <code>Get-ADDefaultDo |
| mainPasswordPolicy</code>, <code>chage -l <username></code>, | | mainPasswordPolicy</code>, <code>chage -l <username></code>, |
| <code>cat /etc/pam.d/common-password</code>, and <code>pwpo | | <code>cat /etc/pam.d/common-password</code>, and <code>pwpo |
| licy getaccountpolicies</code> (Citation: Superuser Linux Pa | | licy getaccountpolicies</code> (Citation: Superuser Linux Pa |
| ssword Policies) (Citation: Jamf User Password Policies). Ad | | ssword Policies) (Citation: Jamf User Password Policies). Ad |
| versaries may also leverage a [Network Device CLI](https://a | | versaries may also leverage a [Network Device CLI](https://a |
| ttack.mitre.org/techniques/T1059/008) on network devices to | | ttack.mitre.org/techniques/T1059/008) on network devices to |
| discover password policy information.(Citation: US-CERT-TA18 | | discover password policy information (e.g. <code>show aaa</c |
| -106A) Password policies can be discovered in cloud environ | | ode>, <code>show aaa common-criteria policy all</code>).(Cit |
| ments using available APIs such as <code>GetAccountPasswordP | | ation: US-CERT-TA18-106A) Password policies can be discover |
| olicy</code> in AWS (Citation: AWS GetPasswordPolicy). | | ed in cloud environments using available APIs such as <code> |
| | | GetAccountPasswordPolicy</code> in AWS (Citation: AWS GetPas |
| | | swordPolicy). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:12:44.708000+00:00 | 2022-09-06 22:01:45.067000+00:00 |
| description | Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information.(Citation: US-CERT-TA18-106A)
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy). | Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to discover password policy information (e.g. show aaa, show aaa common-criteria policy all).(Citation: US-CERT-TA18-106A)
Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy). |
| x_mitre_data_sources[0] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[1] | Command: Command Execution | Process: Process Creation |
| x_mitre_version | 1.4 | 1.5 |
[T1055] Process Injection
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0009: Process (Process Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
| external_references | | GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017. |
| external_references | | https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing |
| external_references | | CAPEC-640 |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-640 | |
| external_references | https://www.gnu.org/software/acct/ | |
| external_references | Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017. | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 20:59:21.118000+00:00 | 2022-10-18 20:58:50.105000+00:00 |
| external_references[1]['source_name'] | capec | GNU Acct |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/640.html | https://www.gnu.org/software/acct/ |
| external_references[3]['source_name'] | ArtOfMemoryForensics | RHEL auditd |
| external_references[3]['description'] | Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved December 20, 2017. | Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017. |
| external_references[4]['source_name'] | GNU Acct | ArtOfMemoryForensics |
| external_references[4]['description'] | GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017. | Ligh, M.H. et al.. (2014, July). The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux, and Mac Memory. Retrieved December 20, 2017. |
| external_references[5]['source_name'] | RHEL auditd | Microsoft Sysmon v6 May 2017 |
| external_references[5]['description'] | Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017. | Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017. |
| external_references[5]['url'] | https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing | https://docs.microsoft.com/sysinternals/downloads/sysmon |
| external_references[7]['source_name'] | Microsoft Sysmon v6 May 2017 | capec |
| external_references[7]['url'] | https://docs.microsoft.com/sysinternals/downloads/sysmon | https://capec.mitre.org/data/definitions/640.html |
| x_mitre_data_sources[6] | Process: OS API Execution | File: File Modification |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_data_sources[1] | File: File Modification | Process: OS API Execution |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Access |
| x_mitre_data_sources | | Process: Process Metadata |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Access | |
[T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Current version: 1.2
Version changed from: 1.1 → 1.2
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-12 21:44:30.466000+00:00 | 2022-06-16 13:06:00.638000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_data_sources[3] | Windows Registry: Windows Registry Key Creation | Command: Command Execution |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Dray Agha, @Purp1eW0lf, Huntress Labs |
| x_mitre_data_sources | | Windows Registry: Windows Registry Key Creation |
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_data_sources | | Process: Process Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1018] Remote System Discovery
Current version: 3.4
Version changed from: 3.3 → 3.4
|
|
|---|
| t | Adversaries may attempt to get a listing of other systems by | t | Adversaries may attempt to get a listing of other systems by |
| IP address, hostname, or other logical identifier on a netw | | IP address, hostname, or other logical identifier on a netw |
| ork that may be used for Lateral Movement from the current s | | ork that may be used for Lateral Movement from the current s |
| ystem. Functionality could exist within remote access tools | | ystem. Functionality could exist within remote access tools |
| to enable this, but utilities available on the operating sys | | to enable this, but utilities available on the operating sys |
| tem could also be used such as [Ping](https://attack.mitre. | | tem could also be used such as [Ping](https://attack.mitre. |
| org/software/S0097) or <code>net view</code> using [Net](htt | | org/software/S0097) or <code>net view</code> using [Net](htt |
| ps://attack.mitre.org/software/S0039). Adversaries may also | | ps://attack.mitre.org/software/S0039). Adversaries may also |
| analyze data from local host files (ex: <code>C:\Windows\Sy | | analyze data from local host files (ex: <code>C:\Windows\Sy |
| stem32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) | | stem32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) |
| or other passive means (such as local [Arp](https://attack.m | | or other passive means (such as local [Arp](https://attack.m |
| itre.org/software/S0099) cache entries) in order to discover | | itre.org/software/S0099) cache entries) in order to discover |
| the presence of remote systems in an environment. Adversar | | the presence of remote systems in an environment. Adversar |
| ies may also target discovery of network infrastructure as w | | ies may also target discovery of network infrastructure as w |
| ell as leverage [Network Device CLI](https://attack.mitre.or | | ell as leverage [Network Device CLI](https://attack.mitre.or |
| g/techniques/T1059/008) commands on network devices to gathe | | g/techniques/T1059/008) commands on network devices to gathe |
| r detailed information about systems within a network.(Citat | | r detailed information about systems within a network (e.g. |
| ion: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS M | | <code>show cdp neighbors</code>, <code>show arp</code>).(Cit |
| ay 2021) | | ation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS |
| | | May 2021) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:10:53.167000+00:00 | 2022-09-06 22:04:59.486000+00:00 |
| description | Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).
Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment.
Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network.(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
| Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).
Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment.
Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
|
| x_mitre_version | 3.3 | 3.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1091] Replication Through Removable Media
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may move onto systems, possibly those on disconn | t | Adversaries may move onto systems, possibly those on disconn |
| ected or air-gapped networks, by copying malware to removabl | | ected or air-gapped networks, by copying malware to removabl |
| e media and taking advantage of Autorun features when the me | | e media and taking advantage of Autorun features when the me |
| dia is inserted into a system and executes. In the case of L | | dia is inserted into a system and executes. In the case of L |
| ateral Movement, this may occur through modification of exec | | ateral Movement, this may occur through modification of exec |
| utable files stored on removable media or by copying malware | | utable files stored on removable media or by copying malware |
| and renaming it to look like a legitimate file to trick use | | and renaming it to look like a legitimate file to trick use |
| rs into executing it on a separate system. In the case of In | | rs into executing it on a separate system. In the case of In |
| itial Access, this may occur through manual manipulation of | | itial Access, this may occur through manual manipulation of |
| the media, modification of systems used to initially format | | the media, modification of systems used to initially format |
| the media, or modification to the media's firmware itself. | | the media, or modification to the media's firmware itself. |
| | | Mobile devices may also be used to infect PCs with malware i |
| | | f connected via USB.(Citation: Exploiting Smartphone USB ) T |
| | | his infection may be achieved using devices (Android, iOS, e |
| | | tc.) and, in some instances, USB charging cables.(Citation: |
| | | Windows Malware Infecting Android)(Citation: iPhone Charging |
| | | Cable Hack) For example, when a smartphone is connected to |
| | | a system, it may appear to be mounted similar to a USB-conne |
| | | cted disk drive. If malware that is compatible with the conn |
| | | ected system is on the mobile device, the malware could infe |
| | | ct the machine (especially if Autorun features are enabled). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Joas Antonio dos Santos, @Cr4zyC0d3'] |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-07-20 02:18:04.581000+00:00 | 2022-10-21 19:14:13.179000+00:00 |
| description | Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself. | Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Mobile devices may also be used to infect PCs with malware if connected via USB.(Citation: Exploiting Smartphone USB ) This infection may be achieved using devices (Android, iOS, etc.) and, in some instances, USB charging cables.(Citation: Windows Malware Infecting Android)(Citation: iPhone Charging Cable Hack) For example, when a smartphone is connected to a system, it may appear to be mounted similar to a USB-connected disk drive. If malware that is compatible with the connected system is on the mobile device, the malware could infect the machine (especially if Autorun features are enabled). |
| x_mitre_data_sources[0] | File: File Creation | Drive: Drive Creation |
| x_mitre_data_sources[1] | Process: Process Creation | File: File Access |
| x_mitre_data_sources[2] | Drive: Drive Creation | Process: Process Creation |
| x_mitre_data_sources[3] | File: File Access | File: File Creation |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Windows Malware Infecting Android', 'description': 'Lucian Constantin. (2014, January 23). Windows malware tries to infect Android devices connected to PCs. Retrieved May 25, 2022.', 'url': 'https://www.computerworld.com/article/2486903/windows-malware-tries-to-infect-android-devices-connected-to-pcs.html'} |
| external_references | | {'source_name': 'iPhone Charging Cable Hack', 'description': 'Zack Whittaker. (2019, August 12). This hacker’s iPhone charging cable can hijack your computer. Retrieved May 25, 2022.', 'url': 'https://techcrunch.com/2019/08/12/iphone-charging-cable-hack-computer-def-con/'} |
| external_references | | {'source_name': 'Exploiting Smartphone USB ', 'description': 'Zhaohui Wang & Angelos Stavrou. (n.d.). Exploiting Smart-Phone USB Connectivity For Fun And Profit. Retrieved May 25, 2022.', 'url': 'https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.226.3427&rep=rep1&type=pdf'} |
[T1053.005] Scheduled Task/Job: Scheduled Task
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may abuse the Windows Task Scheduler to perform | t | Adversaries may abuse the Windows Task Scheduler to perform |
| task scheduling for initial or recurring execution of malici | | task scheduling for initial or recurring execution of malici |
| ous code. There are multiple ways to access the Task Schedul | | ous code. There are multiple ways to access the Task Schedul |
| er in Windows. The [schtasks](https://attack.mitre.org/softw | | er in Windows. The [schtasks](https://attack.mitre.org/softw |
| are/S0111) utility can be run directly on the command line, | | are/S0111) utility can be run directly on the command line, |
| or the Task Scheduler can be opened through the GUI within t | | or the Task Scheduler can be opened through the GUI within t |
| he Administrator Tools section of the Control Panel. In some | | he Administrator Tools section of the Control Panel. In some |
| cases, adversaries have used a .NET wrapper for the Windows | | cases, adversaries have used a .NET wrapper for the Windows |
| Task Scheduler, and alternatively, adversaries have used th | | Task Scheduler, and alternatively, adversaries have used th |
| e Windows netapi32 library to create a scheduled task. The | | e Windows netapi32 library to create a scheduled task. The |
| deprecated [at](https://attack.mitre.org/software/S0110) uti | | deprecated [at](https://attack.mitre.org/software/S0110) uti |
| lity could also be abused by adversaries (ex: [At](https://a | | lity could also be abused by adversaries (ex: [At](https://a |
| ttack.mitre.org/techniques/T1053/002)), though <code>at.exe< | | ttack.mitre.org/techniques/T1053/002)), though <code>at.exe< |
| /code> can not access tasks created with <code>schtasks</cod | | /code> can not access tasks created with <code>schtasks</cod |
| e> or the Control Panel. An adversary may use Windows Task | | e> or the Control Panel. An adversary may use Windows Task |
| Scheduler to execute programs at system startup or on a sche | | Scheduler to execute programs at system startup or on a sche |
| duled basis for persistence. The Windows Task Scheduler can | | duled basis for persistence. The Windows Task Scheduler can |
| also be abused to conduct remote Execution as part of Latera | | also be abused to conduct remote Execution as part of Latera |
| l Movement and/or to run a process under the context of a sp | | l Movement and/or to run a process under the context of a sp |
| ecified account (such as SYSTEM). Similar to [System Binary | | ecified account (such as SYSTEM). Similar to [System Binary |
| Proxy Execution](https://attack.mitre.org/techniques/T1218), | | Proxy Execution](https://attack.mitre.org/techniques/T1218), |
| adversaries have also abused the Windows Task Scheduler to | | adversaries have also abused the Windows Task Scheduler to |
| potentially mask one-time execution under signed/trusted sys | | potentially mask one-time execution under signed/trusted sys |
| tem processes.(Citation: ProofPoint Serpent) | | tem processes.(Citation: ProofPoint Serpent) Adversaries ma |
| | | y also create "hidden" scheduled tasks (i.e. [Hide Artifacts |
| | | ](https://attack.mitre.org/techniques/T1564)) that may not b |
| | | e visible to defender tools and manual queries used to enume |
| | | rate tasks. Specifically, an adversary may hide a task from |
| | | `schtasks /query` and the Task Scheduler by deleting the ass |
| | | ociated Security Descriptor (SD) registry value (where delet |
| | | ion of this value must be completed using SYSTEM permissions |
| | | ).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adve |
| | | rsaries may also employ alternate methods to hide tasks, suc |
| | | h as altering the metadata (e.g., `Index` value) within asso |
| | | ciated registry keys.(Citation: Defending Against Scheduled |
| | | Task Attacks in Windows Environments) |
New Detections:
- DS0024: Windows Registry (Windows Registry Key Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-14 20:59:17.110000+00:00 | 2022-07-06 20:20:13.871000+00:00 |
| description | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.
The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent) | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.
The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)
Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) |
| external_references[1]['source_name'] | ProofPoint Serpent | SigmaHQ |
| external_references[1]['description'] | Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022. | BlackB0lt. (2022, April 15). https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_removal_sd_value_scheduled_task_hide.yml. Retrieved June 1, 2022. |
| external_references[1]['url'] | https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain | https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_removal_sd_value_scheduled_task_hide.yml |
| external_references[2]['source_name'] | Twitter Leoloobeek Scheduled Task | ProofPoint Serpent |
| external_references[2]['description'] | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. | Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022. |
| external_references[2]['url'] | https://twitter.com/leoloobeek/status/939248813465853953 | https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain |
| external_references[3]['source_name'] | Microsoft Scheduled Task Events Win10 | Defending Against Scheduled Task Attacks in Windows Environments |
| external_references[3]['description'] | Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019. | Harshal Tupsamudre. (2022, June 20). Defending Against Scheduled Tasks. Retrieved July 5, 2022. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events | https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments |
| external_references[4]['source_name'] | TechNet Scheduled Task Events | Twitter Leoloobeek Scheduled Task |
| external_references[4]['description'] | Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017. | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. |
| external_references[4]['url'] | https://technet.microsoft.com/library/dd315590.aspx | https://twitter.com/leoloobeek/status/939248813465853953 |
| external_references[5]['source_name'] | TechNet Autoruns | Tarrask scheduled task |
| external_references[5]['description'] | Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016. | Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022. |
| external_references[5]['url'] | https://technet.microsoft.com/en-us/sysinternals/bb963902 | https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ |
| external_references[6]['source_name'] | TechNet Forum Scheduled Task Operational Setting | Microsoft Scheduled Task Events Win10 |
| external_references[6]['description'] | Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017. | Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019. |
| external_references[6]['url'] | https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen | https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events |
| x_mitre_data_sources[4] | File: File Modification | Windows Registry: Windows Registry Key Creation |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'TechNet Scheduled Task Events', 'description': 'Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017.', 'url': 'https://technet.microsoft.com/library/dd315590.aspx'} |
| external_references | | {'source_name': 'TechNet Autoruns', 'description': 'Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.', 'url': 'https://technet.microsoft.com/en-us/sysinternals/bb963902'} |
| external_references | | {'source_name': 'TechNet Forum Scheduled Task Operational Setting', 'description': 'Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017.', 'url': 'https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen'} |
| x_mitre_contributors | | Sittikorn Sangrattanapitak |
| x_mitre_data_sources | | File: File Modification |
[T1593] Search Open Websites/Domains
Current version: 1.1
Version changed from: 1.0 → 1.1
New Mitigations:
- M1013: Application Developer Guidance
- M1047: Audit
Dropped Mitigations:
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:52:41.104000+00:00 | 2022-10-18 22:48:33.286000+00:00 |
| external_references[1]['source_name'] | Cyware Social Media | SecurityTrails Google Hacking |
| external_references[1]['description'] | Cyware Hacker News. (2019, October 2). How Hackers Exploit Social Media To Break Into Your Company. Retrieved October 20, 2020. | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020. |
| external_references[1]['url'] | https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e | https://securitytrails.com/blog/google-hacking-techniques |
| external_references[2]['source_name'] | SecurityTrails Google Hacking | Cyware Social Media |
| external_references[2]['description'] | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020. | Cyware Hacker News. (2019, October 2). How Hackers Exploit Social Media To Break Into Your Company. Retrieved October 20, 2020. |
| external_references[2]['url'] | https://securitytrails.com/blog/google-hacking-techniques | https://cyware.com/news/how-hackers-exploit-social-media-to-break-into-your-company-88e8da8e |
| x_mitre_version | 1.0 | 1.1 |
[T1505] Server Software Component
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may abuse legitimate extensible development feat | t | Adversaries may abuse legitimate extensible development feat |
| ures of servers to establish persistent access to systems. E | | ures of servers to establish persistent access to systems. E |
| nterprise server applications may include features that allo | | nterprise server applications may include features that allo |
| w developers to write and install software or scripts to ext | | w developers to write and install software or scripts to ext |
| end the functionality of the main application. Adversaries m | | end the functionality of the main application. Adversaries m |
| ay install malicious components to extend and abuse server a | | ay install malicious components to extend and abuse server a |
| pplications. | | pplications.(Citation: volexity_0day_sophos_FW) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 17:11:00.534000+00:00 | 2022-10-19 21:18:29.349000+00:00 |
| description | Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications. | Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW) |
| external_references[1]['source_name'] | US-CERT Alert TA15-314A Web Shells | volexity_0day_sophos_FW |
| external_references[1]['description'] | US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016. | Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022. |
| external_references[1]['url'] | https://www.us-cert.gov/ncas/alerts/TA15-314A | https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ |
| x_mitre_data_sources[0] | Application Log: Application Log Content | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Flow | File: File Creation |
| x_mitre_data_sources[2] | File: File Modification | Application Log: Application Log Content |
| x_mitre_data_sources[3] | Network Traffic: Network Traffic Content | Process: Process Creation |
| x_mitre_data_sources[4] | File: File Creation | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[5] | Process: Process Creation | File: File Modification |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'US-CERT Alert TA15-314A Web Shells', 'description': 'US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA15-314A'} |
| x_mitre_platforms | | Network |
[T1547.009] Boot or Logon Autostart Execution: Shortcut Modification
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may create or edit shortcuts to run a program du | t | Adversaries may create or modify shortcuts that can execute |
| ring system boot or user login. Shortcuts or symbolic links | | a program during system boot or user login. Shortcuts or sym |
| are ways of referencing other files or programs that will be | | bolic links are used to reference other files or programs th |
| opened or executed when the shortcut is clicked or executed | | at will be opened or executed when the shortcut is clicked o |
| by a system startup process. Adversaries could use shortcu | | r executed by a system startup process. Adversaries may abu |
| ts to execute their tools for persistence. They may create a | | se shortcuts in the startup folder to execute their tools an |
| new shortcut as a means of indirection that may use [Masque | | d achieve persistence.(Citation: Shortcut for Persistence ) |
| rading](https://attack.mitre.org/techniques/T1036) to look l | | Although often used as payloads in an infection chain (e.g. |
| ike a legitimate program. Adversaries could also edit the ta | | [Spearphishing Attachment](https://attack.mitre.org/techniqu |
| rget path or entirely replace an existing shortcut so their | | es/T1566/001)), adversaries may also create a new shortcut a |
| tools will be executed instead of the intended legitimate pr | | s a means of indirection, while also abusing [Masquerading]( |
| ogram. | | https://attack.mitre.org/techniques/T1036) to make the malic |
| | | ious shortcut appear as a legitimate program. Adversaries ca |
| | | n also edit the target path or entirely replace an existing |
| | | shortcut so their malware will be executed instead of the in |
| | | tended legitimate program. Shortcuts can also be abused to |
| | | establish persistence by implementing other methods. For exa |
| | | mple, LNK browser extensions may be modified (e.g. [Browser |
| | | Extensions](https://attack.mitre.org/techniques/T1176)) to p |
| | | ersistently launch malware. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | Elastic. (n.d.). Shortcut File Written or Modified for Persistence. Retrieved June 1, 2022. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-132 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-13 21:30:24.555000+00:00 | 2022-10-19 22:29:46.175000+00:00 |
| description | Adversaries may create or edit shortcuts to run a program during system boot or user login. Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program. | Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.
Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176)) to persistently launch malware. |
| external_references[1]['source_name'] | capec | Shortcut for Persistence |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/132.html | https://www.elastic.co/guide/en/security/7.17/shortcut-file-written-or-modified-for-persistence.html#shortcut-file-written-or-modified-for-persistence |
| x_mitre_data_sources[0] | Process: Process Creation | File: File Creation |
| x_mitre_data_sources[1] | File: File Creation | Process: Process Creation |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/132.html', 'external_id': 'CAPEC-132'} |
[T1598.003] Phishing for Information: Spearphishing Link
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may send spearphishing messages with a malicious | t | Adversaries may send spearphishing messages with a malicious |
| link to elicit sensitive information that can be used durin | | link to elicit sensitive information that can be used durin |
| g targeting. Spearphishing for information is an attempt to | | g targeting. Spearphishing for information is an attempt to |
| trick targets into divulging information, frequently credent | | trick targets into divulging information, frequently credent |
| ials or other actionable information. Spearphishing for info | | ials or other actionable information. Spearphishing for info |
| rmation frequently involves social engineering techniques, s | | rmation frequently involves social engineering techniques, s |
| uch as posing as a source with a reason to collect informati | | uch as posing as a source with a reason to collect informati |
| on (ex: [Establish Accounts](https://attack.mitre.org/techni | | on (ex: [Establish Accounts](https://attack.mitre.org/techni |
| ques/T1585) or [Compromise Accounts](https://attack.mitre.or | | ques/T1585) or [Compromise Accounts](https://attack.mitre.or |
| g/techniques/T1586)) and/or sending multiple, seemingly urge | | g/techniques/T1586)) and/or sending multiple, seemingly urge |
| nt messages. All forms of spearphishing are electronically | | nt messages. All forms of spearphishing are electronically |
| delivered social engineering targeted at a specific individu | | delivered social engineering targeted at a specific individu |
| al, company, or industry. In this scenario, the malicious em | | al, company, or industry. In this scenario, the malicious em |
| ails contain links generally accompanied by social engineeri | | ails contain links generally accompanied by social engineeri |
| ng text to coax the user to actively click or copy and paste | | ng text to coax the user to actively click or copy and paste |
| a URL into a browser.(Citation: TrendMictro Phishing)(Citat | | a URL into a browser.(Citation: TrendMictro Phishing)(Citat |
| ion: PCMag FakeLogin) The given website may closely resemble | | ion: PCMag FakeLogin) The given website may be a clone of a |
| a legitimate site in appearance and have a URL containing e | | legitimate site (such as an online or corporate login portal |
| lements from the real site. From the fake website, informati | | ) or may closely resemble a legitimate site in appearance an |
| on is gathered in web forms and sent to the adversary. Adver | | d have a URL containing elements from the real site. From |
| saries may also use information from previous reconnaissance | | the fake website, information is gathered in web forms and s |
| efforts (ex: [Search Open Websites/Domains](https://attack. | | ent to the adversary. Adversaries may also use information f |
| mitre.org/techniques/T1593) or [Search Victim-Owned Websites | | rom previous reconnaissance efforts (ex: [Search Open Websit |
| ](https://attack.mitre.org/techniques/T1594)) to craft persu | | es/Domains](https://attack.mitre.org/techniques/T1593) or [S |
| asive and believable lures. | | earch Victim-Owned Websites](https://attack.mitre.org/techni |
| | | ques/T1594)) to craft persuasive and believable lures. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:57:55.192000+00:00 | 2022-10-21 16:01:47.611000+00:00 |
| description | Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. | Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.
From the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures. |
| external_references[1]['source_name'] | TrendMictro Phishing | ACSC Email Spoofing |
| external_references[1]['description'] | Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved October 20, 2020. | Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020. |
| external_references[1]['url'] | https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
| external_references[2]['source_name'] | PCMag FakeLogin | TrendMictro Phishing |
| external_references[2]['description'] | Kan, M. (2019, October 24). Hackers Try to Phish United Nations Staffers With Fake Login Pages. Retrieved October 20, 2020. | Babon, P. (2020, September 3). Tricky 'Forms' of Phishing. Retrieved October 20, 2020. |
| external_references[2]['url'] | https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages | https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html |
| external_references[3]['source_name'] | Microsoft Anti Spoofing | PCMag FakeLogin |
| external_references[3]['description'] | Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. | Kan, M. (2019, October 24). Hackers Try to Phish United Nations Staffers With Fake Login Pages. Retrieved October 20, 2020. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide | https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages |
| external_references[4]['source_name'] | ACSC Email Spoofing | Microsoft Anti Spoofing |
| external_references[4]['description'] | Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020. | Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. |
| external_references[4]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Menachem Goldstein |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network Traffic: Network Traffic Content | |
[T1566.002] Phishing: Spearphishing Link
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may send spearphishing emails with a malicious l | t | Adversaries may send spearphishing emails with a malicious l |
| ink in an attempt to gain access to victim systems. Spearphi | | ink in an attempt to gain access to victim systems. Spearphi |
| shing with a link is a specific variant of spearphishing. It | | shing with a link is a specific variant of spearphishing. It |
| is different from other forms of spearphishing in that it e | | is different from other forms of spearphishing in that it e |
| mploys the use of links to download malware contained in ema | | mploys the use of links to download malware contained in ema |
| il, instead of attaching malicious files to the email itself | | il, instead of attaching malicious files to the email itself |
| , to avoid defenses that may inspect email attachments. Spea | | , to avoid defenses that may inspect email attachments. Spea |
| rphishing may also involve social engineering techniques, su | | rphishing may also involve social engineering techniques, su |
| ch as posing as a trusted source. All forms of spearphishin | | ch as posing as a trusted source. All forms of spearphishin |
| g are electronically delivered social engineering targeted a | | g are electronically delivered social engineering targeted a |
| t a specific individual, company, or industry. In this case, | | t a specific individual, company, or industry. In this case, |
| the malicious emails contain links. Generally, the links wi | | the malicious emails contain links. Generally, the links wi |
| ll be accompanied by social engineering text and require the | | ll be accompanied by social engineering text and require the |
| user to actively click or copy and paste a URL into a brows | | user to actively click or copy and paste a URL into a brows |
| er, leveraging [User Execution](https://attack.mitre.org/tec | | er, leveraging [User Execution](https://attack.mitre.org/tec |
| hniques/T1204). The visited website may compromise the web b | | hniques/T1204). The visited website may compromise the web b |
| rowser using an exploit, or the user will be prompted to dow | | rowser using an exploit, or the user will be prompted to dow |
| nload applications, documents, zip files, or even executable | | nload applications, documents, zip files, or even executable |
| s depending on the pretext for the email in the first place. | | s depending on the pretext for the email in the first place. |
| Adversaries may also include links that are intended to int | | Adversaries may also include links that are intended to int |
| eract directly with an email reader, including embedded imag | | eract directly with an email reader, including embedded imag |
| es intended to exploit the end system directly or verify the | | es intended to exploit the end system directly or verify the |
| receipt of an email (i.e. web bugs/web beacons). Adversar | | receipt of an email (i.e. web bugs/web beacons). Additional |
| ies may also utilize links to perform consent phishing, typi | | ly, adversaries may use seemingly benign links that abuse sp |
| cally with OAuth 2.0 request URLs that when accepted by the | | ecial characters to mimic legitimate websites (known as an " |
| user provide permissions/access for malicious applications, | | IDN homograph attack").(Citation: CISA IDN ST05-016) Advers |
| allowing adversaries to [Steal Application Access Token](ht | | aries may also utilize links to perform consent phishing, ty |
| tps://attack.mitre.org/techniques/T1528)s.(Citation: Trend M | | pically with OAuth 2.0 request URLs that when accepted by th |
| icro Pawn Storm OAuth 2017) These stolen access tokens allow | | e user provide permissions/access for malicious applications |
| the adversary to perform various actions on behalf of the u | | , allowing adversaries to [Steal Application Access Token]( |
| ser via API calls. (Citation: Microsoft OAuth 2.0 Consent Ph | | https://attack.mitre.org/techniques/T1528)s.(Citation: Trend |
| ishing 2021) | | Micro Pawn Storm OAuth 2017) These stolen access tokens all |
| | | ow the adversary to perform various actions on behalf of the |
| | | user via API calls. (Citation: Microsoft OAuth 2.0 Consent |
| | | Phishing 2021) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-163 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 15:07:40.623000+00:00 | 2022-10-21 16:01:45.500000+00:00 |
| description | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons).
Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro Pawn Storm OAuth 2017) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishing 2021) | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email (i.e. web bugs/web beacons). Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an "IDN homograph attack").(Citation: CISA IDN ST05-016)
Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro Pawn Storm OAuth 2017) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishing 2021) |
| external_references[2]['source_name'] | Trend Micro Pawn Storm OAuth 2017 | CISA IDN ST05-016 |
| external_references[2]['description'] | Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019. | CISA. (2019, September 27). Security Tip (ST05-016): Understanding Internationalized Domain Names. Retrieved October 20, 2020. |
| external_references[2]['url'] | https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks | https://us-cert.cisa.gov/ncas/tips/ST05-016 |
| external_references[3]['source_name'] | Microsoft OAuth 2.0 Consent Phishing 2021 | Trend Micro Pawn Storm OAuth 2017 |
| external_references[3]['description'] | Microsoft 365 Defender Threat Intelligence Team. (2021, June 14). Microsoft delivers comprehensive solution to battle rise in consent phishing emails. Retrieved December 13, 2021. | Hacquebord, F.. (2017, April 25). Pawn Storm Abuses Open Authentication in Advanced Social Engineering Attacks. Retrieved October 4, 2019. |
| external_references[3]['url'] | https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/ | https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks |
| external_references[4]['source_name'] | Microsoft Anti Spoofing | Microsoft OAuth 2.0 Consent Phishing 2021 |
| external_references[4]['description'] | Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020. | Microsoft 365 Defender Threat Intelligence Team. (2021, June 14). Microsoft delivers comprehensive solution to battle rise in consent phishing emails. Retrieved December 13, 2021. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide | https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/ |
| external_references[5]['source_name'] | capec | Microsoft Anti Spoofing |
| external_references[5]['url'] | https://capec.mitre.org/data/definitions/163.html | https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/163.html', 'external_id': 'CAPEC-163'} |
| x_mitre_contributors | | Menachem Goldstein |
| x_mitre_data_sources | | Application Log: Application Log Content |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Application Log: Application Log Content | |
[T1608] Stage Capabilities
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may upload, install, or otherwise set up capabil | t | Adversaries may upload, install, or otherwise set up capabil |
| ities that can be used during targeting. To support their op | | ities that can be used during targeting. To support their op |
| erations, an adversary may need to take capabilities they de | | erations, an adversary may need to take capabilities they de |
| veloped ([Develop Capabilities](https://attack.mitre.org/tec | | veloped ([Develop Capabilities](https://attack.mitre.org/tec |
| hniques/T1587)) or obtained ([Obtain Capabilities](https://a | | hniques/T1587)) or obtained ([Obtain Capabilities](https://a |
| ttack.mitre.org/techniques/T1588)) and stage them on infrast | | ttack.mitre.org/techniques/T1588)) and stage them on infrast |
| ructure under their control. These capabilities may be stage | | ructure under their control. These capabilities may be stage |
| d on infrastructure that was previously purchased/rented by | | d on infrastructure that was previously purchased/rented by |
| the adversary ([Acquire Infrastructure](https://attack.mitre | | the adversary ([Acquire Infrastructure](https://attack.mitre |
| .org/techniques/T1583)) or was otherwise compromised by them | | .org/techniques/T1583)) or was otherwise compromised by them |
| ([Compromise Infrastructure](https://attack.mitre.org/techn | | ([Compromise Infrastructure](https://attack.mitre.org/techn |
| iques/T1584)). Capabilities can also be staged on web servic | | iques/T1584)). Capabilities may also be staged on web servic |
| es, such as GitHub or Pastebin.(Citation: Volexity Ocean Lot | | es, such as GitHub or Pastebin, or on Platform-as-a-Service |
| us November 2020) Staging of capabilities can aid the adver | | (PaaS) offerings that enable users to easily provision appli |
| sary in a number of initial access and post-compromise behav | | cations.(Citation: Volexity Ocean Lotus November 2020)(Citat |
| iors, including (but not limited to): * Staging web resourc | | ion: Dragos Heroku Watering Hole)(Citation: Malwarebytes Her |
| es necessary to conduct [Drive-by Compromise](https://attack | | oku Skimmers)(Citation: Netskope GCP Redirection)(Citation: |
| .mitre.org/techniques/T1189) when a user browses to a site.( | | Netskope Cloud Phishing) Staging of capabilities can aid th |
| Citation: FireEye CFR Watering Hole 2012)(Citation: Gallaghe | | e adversary in a number of initial access and post-compromis |
| r 2015)(Citation: ATT ScanBox) * Staging web resources for a | | e behaviors, including (but not limited to): * Staging web |
| link target to be used with spearphishing.(Citation: Malwar | | resources necessary to conduct [Drive-by Compromise](https:/ |
| ebytes Silent Librarian October 2020)(Citation: Proofpoint T | | /attack.mitre.org/techniques/T1189) when a user browses to a |
| A407 September 2019) * Uploading malware or tools to a locat | | site.(Citation: FireEye CFR Watering Hole 2012)(Citation: G |
| ion accessible to a victim network to enable [Ingress Tool T | | allagher 2015)(Citation: ATT ScanBox) * Staging web resource |
| ransfer](https://attack.mitre.org/techniques/T1105).(Citatio | | s for a link target to be used with spearphishing.(Citation: |
| n: Volexity Ocean Lotus November 2020) * Installing a previo | | Malwarebytes Silent Librarian October 2020)(Citation: Proof |
| usly acquired SSL/TLS certificate to use to encrypt command | | point TA407 September 2019) * Uploading malware or tools to |
| and control traffic (ex: [Asymmetric Cryptography](https://a | | a location accessible to a victim network to enable [Ingress |
| ttack.mitre.org/techniques/T1573/002) with [Web Protocols](h | | Tool Transfer](https://attack.mitre.org/techniques/T1105).( |
| ttps://attack.mitre.org/techniques/T1071/001)).(Citation: Di | | Citation: Volexity Ocean Lotus November 2020) * Installing a |
| giCert Install SSL Cert) | | previously acquired SSL/TLS certificate to use to encrypt c |
| | | ommand and control traffic (ex: [Asymmetric Cryptography](ht |
| | | tps://attack.mitre.org/techniques/T1573/002) with [Web Proto |
| | | cols](https://attack.mitre.org/techniques/T1071/001)).(Citat |
| | | ion: DigiCert Install SSL Cert) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:59:57.521000+00:00 | 2022-10-19 22:01:05.551000+00:00 |
| description | Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):
* Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)
* Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)
* Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)
* Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert) | Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):
* Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)
* Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)
* Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)
* Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert) |
| external_references[2]['source_name'] | FireEye CFR Watering Hole 2012 | Netskope GCP Redirection |
| external_references[2]['description'] | Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020. | Ashwin Vamshi. (2019, January 24). Targeted Attacks Abusing Google Cloud Platform Open Redirection. Retrieved August 18, 2022. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html | https://www.netskope.com/blog/targeted-attacks-abusing-google-cloud-platform-open-redirection |
| external_references[3]['source_name'] | Gallagher 2015 | Netskope Cloud Phishing |
| external_references[3]['description'] | Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016. | Ashwin Vamshi. (2020, August 12). A Big Catch: Cloud Phishing from Google App Engine and Azure App Service. Retrieved August 18, 2022. |
| external_references[3]['url'] | http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/ | https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service |
| external_references[5]['source_name'] | Malwarebytes Silent Librarian October 2020 | DigiCert Install SSL Cert |
| external_references[5]['description'] | Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021. | DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved April 19, 2021. |
| external_references[5]['url'] | https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/ | https://www.digicert.com/kb/ssl-certificate-installation.htm |
| external_references[6]['source_name'] | Proofpoint TA407 September 2019 | Gallagher 2015 |
| external_references[6]['description'] | Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021. | Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016. |
| external_references[6]['url'] | https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian | http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/ |
| external_references[7]['source_name'] | DigiCert Install SSL Cert | Malwarebytes Heroku Skimmers |
| external_references[7]['description'] | DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved April 19, 2021. | Jérôme Segura. (2019, December 4). There's an app for that: web skimmers found on PaaS Heroku. Retrieved August 18, 2022. |
| external_references[7]['url'] | https://www.digicert.com/kb/ssl-certificate-installation.htm | https://www.malwarebytes.com/blog/news/2019/12/theres-an-app-for-that-web-skimmers-found-on-paas-heroku |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Dragos Heroku Watering Hole', 'description': 'Kent Backman. (2021, May 18). When Intrusions Don’t Align: A New Water Watering Hole and Oldsmar. Retrieved August 18, 2022.', 'url': 'https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/'} |
| external_references | | {'source_name': 'FireEye CFR Watering Hole 2012', 'description': 'Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020.', 'url': 'https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html'} |
| external_references | | {'source_name': 'Malwarebytes Silent Librarian October 2020', 'description': 'Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.', 'url': 'https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/'} |
| external_references | | {'source_name': 'Proofpoint TA407 September 2019', 'description': 'Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.', 'url': 'https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian'} |
[T1082] System Information Discovery
Current version: 2.5
Version changed from: 2.4 → 2.5
|
|
|---|
| t | An adversary may attempt to get detailed information about t | t | An adversary may attempt to get detailed information about t |
| he operating system and hardware, including version, patches | | he operating system and hardware, including version, patches |
| , hotfixes, service packs, and architecture. Adversaries may | | , hotfixes, service packs, and architecture. Adversaries may |
| use the information from [System Information Discovery](htt | | use the information from [System Information Discovery](htt |
| ps://attack.mitre.org/techniques/T1082) during automated dis | | ps://attack.mitre.org/techniques/T1082) during automated dis |
| covery to shape follow-on behaviors, including whether or no | | covery to shape follow-on behaviors, including whether or no |
| t the adversary fully infects the target and/or attempts spe | | t the adversary fully infects the target and/or attempts spe |
| cific actions. Tools such as [Systeminfo](https://attack.mi | | cific actions. Tools such as [Systeminfo](https://attack.mi |
| tre.org/software/S0096) can be used to gather detailed syste | | tre.org/software/S0096) can be used to gather detailed syste |
| m information. If running with privileged access, a breakdow | | m information. If running with privileged access, a breakdow |
| n of system data can be gathered through the <code>systemset | | n of system data can be gathered through the <code>systemset |
| up</code> configuration tool on macOS. As an example, advers | | up</code> configuration tool on macOS. As an example, advers |
| aries with user-level access can execute the <code>df -aH</c | | aries with user-level access can execute the <code>df -aH</c |
| ode> command to obtain currently mounted disks and associate | | ode> command to obtain currently mounted disks and associate |
| d freely available space. Adversaries may also leverage a [N | | d freely available space. Adversaries may also leverage a [N |
| etwork Device CLI](https://attack.mitre.org/techniques/T1059 | | etwork Device CLI](https://attack.mitre.org/techniques/T1059 |
| /008) on network devices to gather detailed system informati | | /008) on network devices to gather detailed system informati |
| on.(Citation: US-CERT-TA18-106A) [System Information Discove | | on (e.g. <code>show version</code>).(Citation: US-CERT-TA18- |
| ry](https://attack.mitre.org/techniques/T1082) combined with | | 106A) [System Information Discovery](https://attack.mitre.or |
| information gathered from other forms of discovery and reco | | g/techniques/T1082) combined with information gathered from |
| nnaissance can drive payload development and concealment.(Ci | | other forms of discovery and reconnaissance can drive payloa |
| tation: OSX.FairyTale)(Citation: 20 macOS Common Tools and T | | d development and concealment.(Citation: OSX.FairyTale)(Cita |
| echniques) Infrastructure as a Service (IaaS) cloud provide | | tion: 20 macOS Common Tools and Techniques) Infrastructure |
| rs such as AWS, GCP, and Azure allow access to instance and | | as a Service (IaaS) cloud providers such as AWS, GCP, and Az |
| virtual machine information via APIs. Successful authenticat | | ure allow access to instance and virtual machine information |
| ed API calls can return data such as the operating system pl | | via APIs. Successful authenticated API calls can return dat |
| atform and status of a particular instance or the model view | | a such as the operating system platform and status of a part |
| of a virtual machine.(Citation: Amazon Describe Instance)(C | | icular instance or the model view of a virtual machine.(Cita |
| itation: Google Instances Resource)(Citation: Microsoft Viru | | tion: Amazon Describe Instance)(Citation: Google Instances R |
| tal Machine API) | | esource)(Citation: Microsoft Virutal Machine API) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:13:33.490000+00:00 | 2022-09-06 22:11:56.413000+00:00 |
| description | An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information.(Citation: US-CERT-TA18-106A) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) | An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. show version).(Citation: US-CERT-TA18-106A) [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)
Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API) |
| x_mitre_data_sources[0] | Process: OS API Execution | Instance: Instance Metadata |
| x_mitre_data_sources[2] | Instance: Instance Metadata | Process: OS API Execution |
| x_mitre_version | 2.4 | 2.5 |
[T1016] System Network Configuration Discovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may look for details about the network configura | t | Adversaries may look for details about the network configura |
| tion and settings, such as IP and/or MAC addresses, of syste | | tion and settings, such as IP and/or MAC addresses, of syste |
| ms they access or through information discovery of remote sy | | ms they access or through information discovery of remote sy |
| stems. Several operating system administration utilities exi | | stems. Several operating system administration utilities exi |
| st that can be used to gather this information. Examples inc | | st that can be used to gather this information. Examples inc |
| lude [Arp](https://attack.mitre.org/software/S0099), [ipconf | | lude [Arp](https://attack.mitre.org/software/S0099), [ipconf |
| ig](https://attack.mitre.org/software/S0100)/[ifconfig](http | | ig](https://attack.mitre.org/software/S0100)/[ifconfig](http |
| s://attack.mitre.org/software/S0101), [nbtstat](https://atta | | s://attack.mitre.org/software/S0101), [nbtstat](https://atta |
| ck.mitre.org/software/S0102), and [route](https://attack.mit | | ck.mitre.org/software/S0102), and [route](https://attack.mit |
| re.org/software/S0103). Adversaries may also leverage a [Ne | | re.org/software/S0103). Adversaries may also leverage a [Ne |
| twork Device CLI](https://attack.mitre.org/techniques/T1059/ | | twork Device CLI](https://attack.mitre.org/techniques/T1059/ |
| 008) on network devices to gather information about configur | | 008) on network devices to gather information about configur |
| ations and settings, such as IP addresses of configured inte | | ations and settings, such as IP addresses of configured inte |
| rfaces and static/dynamic routes.(Citation: US-CERT-TA18-106 | | rfaces and static/dynamic routes (e.g. <code>show ip route</ |
| A)(Citation: Mandiant APT41 Global Intrusion ) Adversaries | | code>, <code>show ip interface</code>).(Citation: US-CERT-TA |
| may use the information from [System Network Configuration D | | 18-106A)(Citation: Mandiant APT41 Global Intrusion ) Advers |
| iscovery](https://attack.mitre.org/techniques/T1016) during | | aries may use the information from [System Network Configura |
| automated discovery to shape follow-on behaviors, including | | tion Discovery](https://attack.mitre.org/techniques/T1016) d |
| determining certain access within the target network and wha | | uring automated discovery to shape follow-on behaviors, incl |
| t actions to do next. | | uding determining certain access within the target network a |
| | | nd what actions to do next. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:34:15.406000+00:00 | 2022-09-06 22:32:35.833000+00:00 |
| description | Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes.(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion )
Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. | Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).
Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion )
Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. |
| x_mitre_data_sources[1] | Command: Command Execution | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | Command: Command Execution |
| x_mitre_version | 1.4 | 1.5 |
[T1049] System Network Connections Discovery
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may attempt to get a listing of network connecti | t | Adversaries may attempt to get a listing of network connecti |
| ons to or from the compromised system they are currently acc | | ons to or from the compromised system they are currently acc |
| essing or from remote systems by querying for information ov | | essing or from remote systems by querying for information ov |
| er the network. An adversary who gains access to a system | | er the network. An adversary who gains access to a system |
| that is part of a cloud-based environment may map out Virtua | | that is part of a cloud-based environment may map out Virtua |
| l Private Clouds or Virtual Networks in order to determine w | | l Private Clouds or Virtual Networks in order to determine w |
| hat systems and services are connected. The actions performe | | hat systems and services are connected. The actions performe |
| d are likely the same types of discovery techniques dependin | | d are likely the same types of discovery techniques dependin |
| g on the operating system, but the resulting information may | | g on the operating system, but the resulting information may |
| include details about the networked cloud environment relev | | include details about the networked cloud environment relev |
| ant to the adversary's goals. Cloud providers may have diffe | | ant to the adversary's goals. Cloud providers may have diffe |
| rent ways in which their virtual networks operate.(Citation: | | rent ways in which their virtual networks operate.(Citation: |
| Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Net | | Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Net |
| work Overview)(Citation: Google VPC Overview) Similarly, adv | | work Overview)(Citation: Google VPC Overview) Similarly, adv |
| ersaries who gain access to network devices may also perform | | ersaries who gain access to network devices may also perform |
| similar discovery activities to gather information about co | | similar discovery activities to gather information about co |
| nnected systems and services. Utilities and commands that a | | nnected systems and services. Utilities and commands that a |
| cquire this information include [netstat](https://attack.mit | | cquire this information include [netstat](https://attack.mit |
| re.org/software/S0104), "net use," and "net session" with [N | | re.org/software/S0104), "net use," and "net session" with [N |
| et](https://attack.mitre.org/software/S0039). In Mac and Lin | | et](https://attack.mitre.org/software/S0039). In Mac and Lin |
| ux, [netstat](https://attack.mitre.org/software/S0104) and < | | ux, [netstat](https://attack.mitre.org/software/S0104) and < |
| code>lsof</code> can be used to list current connections. <c | | code>lsof</code> can be used to list current connections. <c |
| ode>who -a</code> and <code>w</code> can be used to show whi | | ode>who -a</code> and <code>w</code> can be used to show whi |
| ch users are currently logged in, similar to "net session". | | ch users are currently logged in, similar to "net session". |
| Additionally, built-in features native to network devices an | | Additionally, built-in features native to network devices an |
| d [Network Device CLI](https://attack.mitre.org/techniques/T | | d [Network Device CLI](https://attack.mitre.org/techniques/T |
| 1059/008) may be used.(Citation: US-CERT-TA18-106A) | | 1059/008) may be used (e.g. <code>show ip sockets</code>, <c |
| | | ode>show tcp brief</code>).(Citation: US-CERT-TA18-106A) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:14:30.741000+00:00 | 2022-09-06 22:35:34.231000+00:00 |
| description | Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview) Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.
Utilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), "net use," and "net session" with [Net](https://attack.mitre.org/software/S0039). In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) may be used.(Citation: US-CERT-TA18-106A) | Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview) Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.
Utilities and commands that acquire this information include [netstat](https://attack.mitre.org/software/S0104), "net use," and "net session" with [Net](https://attack.mitre.org/software/S0039). In Mac and Linux, [netstat](https://attack.mitre.org/software/S0104) and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) may be used (e.g. show ip sockets, show tcp brief).(Citation: US-CERT-TA18-106A) |
| x_mitre_data_sources[0] | Process: OS API Execution | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | Process: OS API Execution |
| x_mitre_version | 2.3 | 2.4 |
[T1007] System Service Discovery
Current version: 1.4
Version changed from: 1.3 → 1.4
New Detections:
- DS0009: Process (OS API Execution)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Harshal Tupsamudre, Qualys'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 02:39:54.386000+00:00 | 2022-07-15 13:35:54.740000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: OS API Execution |
[T1529] System Shutdown/Reboot
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may shutdown/reboot systems to interrupt access | t | Adversaries may shutdown/reboot systems to interrupt access |
| to, or aid in the destruction of, those systems. Operating s | | to, or aid in the destruction of, those systems. Operating s |
| ystems may contain commands to initiate a shutdown/reboot of | | ystems may contain commands to initiate a shutdown/reboot of |
| a machine or network device. In some cases, these commands | | a machine or network device. In some cases, these commands |
| may also be used to initiate a shutdown/reboot of a remote c | | may also be used to initiate a shutdown/reboot of a remote c |
| omputer or network device.(Citation: Microsoft Shutdown Oct | | omputer or network device via [Network Device CLI](https://a |
| 2017)(Citation: alert_TA18_106A) Shutting down or rebooting | | ttack.mitre.org/techniques/T1059/008) (e.g. <code>reload</co |
| systems may disrupt access to computer resources for legitim | | de>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert |
| ate users. Adversaries may attempt to shutdown/reboot a sys | | _TA18_106A) Shutting down or rebooting systems may disrupt a |
| tem after impacting it in other ways, such as [Disk Structur | | ccess to computer resources for legitimate users. Adversari |
| e Wipe](https://attack.mitre.org/techniques/T1561/002) or [I | | es may attempt to shutdown/reboot a system after impacting i |
| nhibit System Recovery](https://attack.mitre.org/techniques/ | | t in other ways, such as [Disk Structure Wipe](https://attac |
| T1490), to hasten the intended effects on system availabilit | | k.mitre.org/techniques/T1561/002) or [Inhibit System Recover |
| y.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic | | y](https://attack.mitre.org/techniques/T1490), to hasten the |
| Destroyer 2018) | | intended effects on system availability.(Citation: Talos Ny |
| | | etya June 2017)(Citation: Talos Olympic Destroyer 2018) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Austin Clark, @c2defense'] |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'root', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-18 21:00:33.705000+00:00 | 2022-10-20 18:27:57.587000+00:00 |
| description | Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device.(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018) | Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018) |
| external_references[1]['source_name'] | Microsoft Shutdown Oct 2017 | Talos Nyetya June 2017 |
| external_references[1]['description'] | Microsoft. (2017, October 15). Shutdown. Retrieved October 4, 2019. | Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown | https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html |
| external_references[3]['source_name'] | Talos Nyetya June 2017 | Talos Olympic Destroyer 2018 |
| external_references[3]['description'] | Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019. | Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. |
| external_references[3]['url'] | https://blog.talosintelligence.com/2017/06/worldwide-ransomware-variant.html | https://blog.talosintelligence.com/2018/02/olympic-destroyer.html |
| external_references[4]['source_name'] | Talos Olympic Destroyer 2018 | Microsoft Shutdown Oct 2017 |
| external_references[4]['description'] | Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. | Microsoft. (2017, October 15). Shutdown. Retrieved October 4, 2019. |
| external_references[4]['url'] | https://blog.talosintelligence.com/2018/02/olympic-destroyer.html | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown |
| x_mitre_version | 1.1 | 1.2 |
[T1205] Traffic Signaling
Current version: 2.4
Version changed from: 2.3 → 2.4
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 19:52:50.774000+00:00 | 2022-10-19 23:08:40.603000+00:00 |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Flow | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[2] | Network Traffic: Network Connection Creation | Process: Process Creation |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Flow |
[T1537] Transfer Data to Cloud Account
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 16:11:19.296000+00:00 | 2022-06-16 19:21:04.897000+00:00 |
| x_mitre_data_sources[2] | Snapshot: Snapshot Creation | Cloud Storage: Cloud Storage Modification |
| x_mitre_data_sources[5] | Cloud Storage: Cloud Storage Modification | Network Traffic: Network Traffic Content |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ExtraHop |
| x_mitre_data_sources | | Snapshot: Snapshot Creation |
[T1199] Trusted Relationship
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may breach or otherwise leverage organizations w | t | Adversaries may breach or otherwise leverage organizations w |
| ho have access to intended victims. Access through trusted t | | ho have access to intended victims. Access through trusted t |
| hird party relationship exploits an existing connection that | | hird party relationship abuses an existing connection that m |
| may not be protected or receives less scrutiny than standar | | ay not be protected or receives less scrutiny than standard |
| d mechanisms of gaining access to a network. Organizations | | mechanisms of gaining access to a network. Organizations of |
| often grant elevated access to second or third-party externa | | ten grant elevated access to second or third-party external |
| l providers in order to allow them to manage internal system | | providers in order to allow them to manage internal systems |
| s as well as cloud-based environments. Some examples of thes | | as well as cloud-based environments. Some examples of these |
| e relationships include IT services contractors, managed sec | | relationships include IT services contractors, managed secur |
| urity providers, infrastructure contractors (e.g. HVAC, elev | | ity providers, infrastructure contractors (e.g. HVAC, elevat |
| ators, physical security). The third-party provider's access | | ors, physical security). The third-party provider's access m |
| may be intended to be limited to the infrastructure being m | | ay be intended to be limited to the infrastructure being mai |
| aintained, but may exist on the same network as the rest of | | ntained, but may exist on the same network as the rest of th |
| the enterprise. As such, [Valid Accounts](https://attack.mit | | e enterprise. As such, [Valid Accounts](https://attack.mitre |
| re.org/techniques/T1078) used by the other party for access | | .org/techniques/T1078) used by the other party for access to |
| to internal network systems may be compromised and used.(Cit | | internal network systems may be compromised and used.(Citat |
| ation: CISA IT Service Providers) | | ion: CISA IT Service Providers) In Office 365 environments, |
| | | organizations may grant Microsoft partners or resellers del |
| | | egated administrator permissions. By compromising a partner |
| | | or reseller account, an adversary may be able to leverage ex |
| | | isting delegated administrator relationships or send new del |
| | | egated administrator offers to clients in order to gain admi |
| | | nistrative control over the victim tenant.(Citation: Office |
| | | 365 Delegated Administration) |
New Mitigations:
- M1018: User Account Management
- M1032: Multi-factor Authentication
Dropped Mitigations:
- M1052: User Account Control
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:01.045000+00:00 | 2022-10-21 14:35:00.274000+00:00 |
| description | Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers) | Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)
In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration) |
| x_mitre_data_sources[0] | Logon Session: Logon Session Creation | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Application Log: Application Log Content | Logon Session: Logon Session Metadata |
| x_mitre_data_sources[2] | Logon Session: Logon Session Metadata | Application Log: Application Log Content |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Office 365 Delegated Administration', 'description': 'Microsoft. (n.d.). Partners: Offer delegated administration. Retrieved May 27, 2022.', 'url': 'https://support.microsoft.com/en-us/topic/partners-offer-delegated-administration-26530dc0-ebba-415b-86b1-b55bc06b073e?ui=en-us&rs=en-us&ad=us'} |
| x_mitre_contributors | | ExtraHop |
| x_mitre_contributors | | Jannie Li, Microsoft Threat Intelligence Center (MSTIC) |
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
| x_mitre_platforms | | Office 365 |
[T1608.002] Stage Capabilities: Upload Tool
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may upload tools to third-party or adversary con | t | Adversaries may upload tools to third-party or adversary con |
| trolled infrastructure to make it accessible during targetin | | trolled infrastructure to make it accessible during targetin |
| g. Tools can be open or closed source, free or commercial. T | | g. Tools can be open or closed source, free or commercial. T |
| ools can be used for malicious purposes by an adversary, but | | ools can be used for malicious purposes by an adversary, but |
| (unlike malware) were not intended to be used for those pur | | (unlike malware) were not intended to be used for those pur |
| poses (ex: [PsExec](https://attack.mitre.org/software/S0029) | | poses (ex: [PsExec](https://attack.mitre.org/software/S0029) |
| ). Adversaries may upload tools to support their operations, | | ). Adversaries may upload tools to support their operations, |
| such as making a tool available to a victim network to enab | | such as making a tool available to a victim network to enab |
| le [Ingress Tool Transfer](https://attack.mitre.org/techniqu | | le [Ingress Tool Transfer](https://attack.mitre.org/techniqu |
| es/T1105) by placing it on an Internet accessible web server | | es/T1105) by placing it on an Internet accessible web server |
| . Tools may be placed on infrastructure that was previously | | . Tools may be placed on infrastructure that was previously |
| purchased/rented by the adversary ([Acquire Infrastructure] | | purchased/rented by the adversary ([Acquire Infrastructure] |
| (https://attack.mitre.org/techniques/T1583)) or was otherwis | | (https://attack.mitre.org/techniques/T1583)) or was otherwis |
| e compromised by them ([Compromise Infrastructure](https://a | | e compromised by them ([Compromise Infrastructure](https://a |
| ttack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) | | ttack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) |
| Tools can also be staged on web services, such as an adversa | | Tools can also be staged on web services, such as an adversa |
| ry controlled GitHub repo. Adversaries can avoid the need t | | ry controlled GitHub repo, or on Platform-as-a-Service offer |
| o upload a tool by having compromised victim machines downlo | | ings that enable users to easily provision applications.(Cit |
| ad the tool directly from a third-party hosting location (ex | | ation: Dragos Heroku Watering Hole)(Citation: Malwarebytes H |
| : a non-adversary controlled GitHub repo), including the ori | | eroku Skimmers)(Citation: Intezer App Service Phishing) Adv |
| ginal hosting site of the tool. | | ersaries can avoid the need to upload a tool by having compr |
| | | omised victim machines download the tool directly from a thi |
| | | rd-party hosting location (ex: a non-adversary controlled Gi |
| | | tHub repo), including the original hosting site of the tool. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 16:25:37.072000+00:00 | 2022-10-20 20:16:32.599000+00:00 |
| description | Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
Tools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo.
Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool. | Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
Tools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo, or on Platform-as-a-Service offerings that enable users to easily provision applications.(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Intezer App Service Phishing)
Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Malwarebytes Heroku Skimmers', 'description': "Jérôme Segura. (2019, December 4). There's an app for that: web skimmers found on PaaS Heroku. Retrieved August 18, 2022.", 'url': 'https://www.malwarebytes.com/blog/news/2019/12/theres-an-app-for-that-web-skimmers-found-on-paas-heroku'} |
| external_references | | {'source_name': 'Dragos Heroku Watering Hole', 'description': 'Kent Backman. (2021, May 18). When Intrusions Don’t Align: A New Water Watering Hole and Oldsmar. Retrieved August 18, 2022.', 'url': 'https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/'} |
| external_references | | {'source_name': 'Intezer App Service Phishing', 'description': 'Paul Litvak. (2020, October 8). Kud I Enter Your Server? New Vulnerabilities in Microsoft Azure. Retrieved August 18, 2022.', 'url': 'https://www.intezer.com/blog/malware-analysis/kud-i-enter-your-server-new-vulnerabilities-in-microsoft-azure/'} |
[T1055.014] Process Injection: VDSO Hijacking
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-24 15:21:39.761000+00:00 | 2022-07-07 17:09:09.048000+00:00 |
| external_references[1]['source_name'] | ELF Injection May 2009 | Backtrace VDSO |
| external_references[1]['description'] | O'Neill, R. (2009, May). Modern Day ELF Runtime infection via GOT poisoning. Retrieved March 15, 2020. | backtrace. (2016, April 22). ELF SHARED LIBRARY INJECTION FORENSICS. Retrieved June 15, 2020. |
| external_references[1]['url'] | https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html | https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/ |
| external_references[2]['source_name'] | Backtrace VDSO | Syscall 2014 |
| external_references[2]['description'] | backtrace. (2016, April 22). ELF SHARED LIBRARY INJECTION FORENSICS. Retrieved June 15, 2020. | Drysdale, D. (2014, July 16). Anatomy of a system call, part 2. Retrieved June 16, 2020. |
| external_references[2]['url'] | https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/ | https://lwn.net/Articles/604515/ |
| external_references[3]['source_name'] | VDSO Aug 2005 | GNU Acct |
| external_references[3]['description'] | Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved June 16, 2020. | GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017. |
| external_references[3]['url'] | https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/ | https://www.gnu.org/software/acct/ |
| external_references[4]['source_name'] | Syscall 2014 | RHEL auditd |
| external_references[4]['description'] | Drysdale, D. (2014, July 16). Anatomy of a system call, part 2. Retrieved June 16, 2020. | Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017. |
| external_references[4]['url'] | https://lwn.net/Articles/604515/ | https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing |
| external_references[6]['source_name'] | GNU Acct | ELF Injection May 2009 |
| external_references[6]['description'] | GNU. (2010, February 5). The GNU Accounting Utilities. Retrieved December 20, 2017. | O'Neill, R. (2009, May). Modern Day ELF Runtime infection via GOT poisoning. Retrieved March 15, 2020. |
| external_references[6]['url'] | https://www.gnu.org/software/acct/ | https://web.archive.org/web/20150711051625/http://vxer.org/lib/vrn00.html |
| external_references[7]['source_name'] | RHEL auditd | VDSO Aug 2005 |
| external_references[7]['description'] | Jahoda, M. et al.. (2017, March 14). redhat Security Guide - Chapter 7 - System Auditing. Retrieved December 20, 2017. | Petersson, J. (2005, August 14). What is linux-gate.so.1?. Retrieved June 16, 2020. |
| external_references[7]['url'] | https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing | https://web.archive.org/web/20051013084246/http://www.trilithium.com/johan/2005/08/linux-gate/ |
| x_mitre_data_sources[0] | Process: OS API Execution | Module: Module Load |
| x_mitre_data_sources[1] | Module: Module Load | Process: OS API Execution |
| x_mitre_version | 1.0 | 1.1 |
[T1078] Valid Accounts
Current version: 2.5
Version changed from: 2.4 → 2.5
|
|
|---|
| t | Adversaries may obtain and abuse credentials of existing acc | t | Adversaries may obtain and abuse credentials of existing acc |
| ounts as a means of gaining Initial Access, Persistence, Pri | | ounts as a means of gaining Initial Access, Persistence, Pri |
| vilege Escalation, or Defense Evasion. Compromised credentia | | vilege Escalation, or Defense Evasion. Compromised credentia |
| ls may be used to bypass access controls placed on various r | | ls may be used to bypass access controls placed on various r |
| esources on systems within the network and may even be used | | esources on systems within the network and may even be used |
| for persistent access to remote systems and externally avail | | for persistent access to remote systems and externally avail |
| able services, such as VPNs, Outlook Web Access and remote d | | able services, such as VPNs, Outlook Web Access, network dev |
| esktop. Compromised credentials may also grant an adversary | | ices, and remote desktop.(Citation: volexity_0day_sophos_FW) |
| increased privilege to specific systems or access to restric | | Compromised credentials may also grant an adversary increas |
| ted areas of the network. Adversaries may choose not to use | | ed privilege to specific systems or access to restricted are |
| malware or tools in conjunction with the legitimate access t | | as of the network. Adversaries may choose not to use malware |
| hose credentials provide to make it harder to detect their p | | or tools in conjunction with the legitimate access those cr |
| resence. In some cases, adversaries may abuse inactive acco | | edentials provide to make it harder to detect their presence |
| unts: for example, those belonging to individuals who are no | | . In some cases, adversaries may abuse inactive accounts: f |
| longer part of an organization. Using these accounts may al | | or example, those belonging to individuals who are no longer |
| low the adversary to evade detection, as the original accoun | | part of an organization. Using these accounts may allow the |
| t user will not be present to identify any anomalous activit | | adversary to evade detection, as the original account user |
| y taking place on their account.(Citation: CISA MFA PrintNig | | will not be present to identify any anomalous activity takin |
| htmare) The overlap of permissions for local, domain, and c | | g place on their account.(Citation: CISA MFA PrintNightmare) |
| loud accounts across a network of systems is of concern beca | | The overlap of permissions for local, domain, and cloud ac |
| use the adversary may be able to pivot across accounts and s | | counts across a network of systems is of concern because the |
| ystems to reach a high level of access (i.e., domain or ente | | adversary may be able to pivot across accounts and systems |
| rprise administrator) to bypass access controls set within t | | to reach a high level of access (i.e., domain or enterprise |
| he enterprise.(Citation: TechNet Credential Theft) | | administrator) to bypass access controls set within the ente |
| | | rprise.(Citation: TechNet Credential Theft) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-560 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 04:55:21.981000+00:00 | 2022-10-19 19:57:39.849000+00:00 |
| description | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare)
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft) | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare)
The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft) |
| external_references[1]['source_name'] | CISA MFA PrintNightmare | volexity_0day_sophos_FW |
| external_references[1]['description'] | Cybersecurity and Infrastructure Security Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability. Retrieved March 16, 2022. | Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022. |
| external_references[1]['url'] | https://www.cisa.gov/uscert/ncas/alerts/aa22-074a | https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ |
| external_references[2]['source_name'] | TechNet Credential Theft | CISA MFA PrintNightmare |
| external_references[2]['description'] | Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016. | Cybersecurity and Infrastructure Security Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability. Retrieved March 16, 2022. |
| external_references[2]['url'] | https://technet.microsoft.com/en-us/library/dn535501.aspx | https://www.cisa.gov/uscert/ncas/alerts/aa22-074a |
| external_references[3]['source_name'] | TechNet Audit Policy | TechNet Credential Theft |
| external_references[3]['description'] | Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016. | Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016. |
| external_references[3]['url'] | https://technet.microsoft.com/en-us/library/dn487457.aspx | https://technet.microsoft.com/en-us/library/dn535501.aspx |
| external_references[4]['source_name'] | capec | TechNet Audit Policy |
| external_references[4]['url'] | https://capec.mitre.org/data/definitions/560.html | https://technet.microsoft.com/en-us/library/dn487457.aspx |
| x_mitre_contributors[2] | Sekhar Sarukkai, McAfee | Sekhar Sarukkai, McAfee |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/560.html', 'external_id': 'CAPEC-560'} |
| x_mitre_platforms | | Network |
[T1505.003] Server Software Component: Web Shell
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may backdoor web servers with web shells to esta | t | Adversaries may backdoor web servers with web shells to esta |
| blish persistent access to systems. A Web shell is a Web scr | | blish persistent access to systems. A Web shell is a Web scr |
| ipt that is placed on an openly accessible Web server to all | | ipt that is placed on an openly accessible Web server to all |
| ow an adversary to use the Web server as a gateway into a ne | | ow an adversary to use the Web server as a gateway into a ne |
| twork. A Web shell may provide a set of functions to execute | | twork. A Web shell may provide a set of functions to execute |
| or a command-line interface on the system that hosts the We | | or a command-line interface on the system that hosts the We |
| b server. In addition to a server-side script, a Web shell | | b server.(Citation: volexity_0day_sophos_FW) In addition to |
| may have a client interface program that is used to talk to | | a server-side script, a Web shell may have a client interfa |
| the Web server (ex: [China Chopper](https://attack.mitre.org | | ce program that is used to talk to the Web server (e.g. [Chi |
| /software/S0020) Web shell client).(Citation: Lee 2013) | | na Chopper](https://attack.mitre.org/software/S0020) Web she |
| | | ll client).(Citation: Lee 2013) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | NSA Cybersecurity Directorate. (n.d.). Mitigating Web Shells. Retrieved July 22, 2021. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['SYSTEM', 'User'] | |
| external_references | CAPEC-650 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-07-26 13:46:47.993000+00:00 | 2022-10-19 20:11:07.800000+00:00 |
| description | Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013) | Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)
In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013) |
| external_references[1]['source_name'] | capec | NSA Cyber Mitigating Web Shells |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/650.html | https://github.com/nsacyber/Mitigating-Web-Shells |
| external_references[2]['source_name'] | Lee 2013 | volexity_0day_sophos_FW |
| external_references[2]['description'] | Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015. | Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html | https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/ |
| external_references[3]['source_name'] | NSA Cyber Mitigating Web Shells | Lee 2013 |
| external_references[3]['description'] | NSA Cybersecurity Directorate. (n.d.). Mitigating Web Shells. Retrieved July 22, 2021. | Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015. |
| external_references[3]['url'] | https://github.com/nsacyber/Mitigating-Web-Shells | https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html |
| x_mitre_data_sources[0] | File: File Modification | File: File Creation |
| x_mitre_data_sources[1] | Process: Process Creation | Application Log: Application Log Content |
| x_mitre_data_sources[3] | File: File Creation | Process: Process Creation |
| x_mitre_data_sources[4] | Application Log: Application Log Content | File: File Modification |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/650.html', 'external_id': 'CAPEC-650'} |
| x_mitre_platforms | | Network |
[T1555.004] Credentials from Password Stores: Windows Credential Manager
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may acquire credentials from the Windows Credent | t | Adversaries may acquire credentials from the Windows Credent |
| ial Manager. The Credential Manager stores credentials for s | | ial Manager. The Credential Manager stores credentials for s |
| igning into websites, applications, and/or devices that requ | | igning into websites, applications, and/or devices that requ |
| est authentication through NTLM or Kerberos in Credential Lo | | est authentication through NTLM or Kerberos in Credential Lo |
| ckers (previously known as Windows Vaults).(Citation: Micros | | ckers (previously known as Windows Vaults).(Citation: Micros |
| oft Credential Manager store)(Citation: Microsoft Credential | | oft Credential Manager store)(Citation: Microsoft Credential |
| Locker) The Windows Credential Manager separates website c | | Locker) The Windows Credential Manager separates website c |
| redentials from application or network credentials in two lo | | redentials from application or network credentials in two lo |
| ckers. As part of [Credentials from Web Browsers](https://at | | ckers. As part of [Credentials from Web Browsers](https://at |
| tack.mitre.org/techniques/T1555/003), Internet Explorer and | | tack.mitre.org/techniques/T1555/003), Internet Explorer and |
| Microsoft Edge website credentials are managed by the Creden | | Microsoft Edge website credentials are managed by the Creden |
| tial Manager and are stored in the Web Credentials locker. A | | tial Manager and are stored in the Web Credentials locker. A |
| pplication and network credentials are stored in the Windows | | pplication and network credentials are stored in the Windows |
| Credentials locker. Credential Lockers store credentials i | | Credentials locker. Credential Lockers store credentials i |
| n encrypted <code>.vcrd</code> files, located under <code>%S | | n encrypted `.vcrd` files, located under `%Systemdrive%\User |
| ystemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vaul | | s\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\` |
| t/Credentials]\</code>. The encryption key can be found in a | | . The encryption key can be found in a file named <code>Poli |
| file named <code>Policy.vpol</code>, typically located in t | | cy.vpol</code>, typically located in the same folder as the |
| he same folder as the credentials.(Citation: passcape Window | | credentials.(Citation: passcape Windows Vault)(Citation: Mal |
| s Vault)(Citation: Malwarebytes The Windows Vault) Adversar | | warebytes The Windows Vault) Adversaries may list credentia |
| ies may list credentials managed by the Windows Credential M | | ls managed by the Windows Credential Manager through several |
| anager through several mechanisms. <code>vaultcmd.exe</code> | | mechanisms. <code>vaultcmd.exe</code> is a native Windows e |
| is a native Windows executable that can be used to enumerat | | xecutable that can be used to enumerate credentials stored i |
| e credentials stored in the Credential Locker through a comm | | n the Credential Locker through a command-line interface. Ad |
| and-line interface. Adversaries may gather credentials by re | | versaries may also gather credentials by directly reading fi |
| ading files located inside of the Credential Lockers. Advers | | les located inside of the Credential Lockers. Windows APIs, |
| aries may also abuse Windows APIs such as <code>CredEnumerat | | such as <code>CredEnumerateA</code>, may also be absued to l |
| eA</code> to list credentials managed by the Credential Mana | | ist credentials managed by the Credential Manager.(Citation: |
| ger.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimi | | Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendenti |
| katz Crendential Manager) Adversaries may use password reco | | al Manager) Adversaries may also obtain credentials from cr |
| very tools to obtain plain text passwords from the Credentia | | edential backups. Credential backups and restorations may be |
| l Manager.(Citation: Malwarebytes The Windows Vault) | | performed by running <code>rundll32.exe keymgr.dll KRShowKe |
| | | yMgr</code> then selecting the “Back up...” button on the “S |
| | | tored User Names and Passwords” GUI. Password recovery tool |
| | | s may also obtain plain text passwords from the Credential M |
| | | anager.(Citation: Malwarebytes The Windows Vault) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:36:17.296000+00:00 | 2022-10-21 15:46:55.929000+00:00 |
| description | Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted .vcrd files, located under %Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may gather credentials by reading files located inside of the Credential Lockers. Adversaries may also abuse Windows APIs such as CredEnumerateA to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)
Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault) | Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted `.vcrd` files, located under `%Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\`. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may also gather credentials by directly reading files located inside of the Credential Lockers. Windows APIs, such as CredEnumerateA, may also be absued to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)
Adversaries may also obtain credentials from credential backups. Credential backups and restorations may be performed by running rundll32.exe keymgr.dll KRShowKeyMgr then selecting the “Back up...” button on the “Stored User Names and Passwords” GUI.
Password recovery tools may also obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Uriel Kosayev |
| x_mitre_contributors | | Vadim Khrykov |
| x_mitre_data_sources | | Process: Process Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
Patches
[T1557.002] Adversary-in-the-Middle: ARP Cache Poisoning
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-07-28 01:04:39.141000+00:00 | 2022-07-22 18:37:22.176000+00:00 |
| external_references[1]['source_name'] | RFC826 ARP | Cylance Cleaver |
| external_references[1]['description'] | Plummer, D. (1982, November). An Ethernet Address Resolution Protocol. Retrieved October 15, 2020. | Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017. |
| external_references[1]['url'] | https://tools.ietf.org/html/rfc826 | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
| external_references[2]['source_name'] | Sans ARP Spoofing Aug 2003 | RFC826 ARP |
| external_references[2]['description'] | Siles, R. (2003, August). Real World ARP Spoofing. Retrieved October 15, 2020. | Plummer, D. (1982, November). An Ethernet Address Resolution Protocol. Retrieved October 15, 2020. |
| external_references[2]['url'] | https://pen-testing.sans.org/resources/papers/gcih/real-world-arp-spoofing-105411 | https://tools.ietf.org/html/rfc826 |
| external_references[3]['source_name'] | Cylance Cleaver | Sans ARP Spoofing Aug 2003 |
| external_references[3]['description'] | Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017. | Siles, R. (2003, August). Real World ARP Spoofing. Retrieved October 15, 2020. |
| external_references[3]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://pen-testing.sans.org/resources/papers/gcih/real-world-arp-spoofing-105411 |
[T1059.002] Command and Scripting Interpreter: AppleScript
Current version: 1.1
|
|
|---|
| t | Adversaries may abuse AppleScript for execution. AppleScript | t | Adversaries may abuse AppleScript for execution. AppleScript |
| is a macOS scripting language designed to control applicati | | is a macOS scripting language designed to control applicati |
| ons and parts of the OS via inter-application messages calle | | ons and parts of the OS via inter-application messages calle |
| d AppleEvents.(Citation: Apple AppleScript) These AppleEvent | | d AppleEvents.(Citation: Apple AppleScript) These AppleEvent |
| messages can be sent independently or easily scripted with | | messages can be sent independently or easily scripted with |
| AppleScript. These events can locate open windows, send keys | | AppleScript. These events can locate open windows, send keys |
| trokes, and interact with almost any open application locall | | trokes, and interact with almost any open application locall |
| y or remotely. Scripts can be run from the command-line via | | y or remotely. Scripts can be run from the command-line via |
| <code>osascript /path/to/script</code> or <code>osascript - | | <code>osascript /path/to/script</code> or <code>osascript - |
| e "script here"</code>. Aside from the command line, scripts | | e "script here"</code>. Aside from the command line, scripts |
| can be executed in numerous ways including Mail rules, Cale | | can be executed in numerous ways including Mail rules, Cale |
| ndar.app alarms, and Automator workflows. AppleScripts can a | | ndar.app alarms, and Automator workflows. AppleScripts can a |
| lso be executed as plain text shell scripts by adding <code> | | lso be executed as plain text shell scripts by adding <code> |
| #!/usr/bin/osascript</code> to the start of the script file. | | #!/usr/bin/osascript</code> to the start of the script file. |
| (Citation: SentinelOne AppleScript) AppleScripts do not nee | | (Citation: SentinelOne AppleScript) AppleScripts do not nee |
| d to call <code>osascript</code> to execute, however. They m | | d to call <code>osascript</code> to execute. However, they m |
| ay be executed from within mach-O binaries by using the macO | | ay be executed from within mach-O binaries by using the macO |
| S [Native API](https://attack.mitre.org/techniques/T1106)s < | | S [Native API](https://attack.mitre.org/techniques/T1106)s < |
| code>NSAppleScript</code> or <code>OSAScript</code>, both of | | code>NSAppleScript</code> or <code>OSAScript</code>, both of |
| which execute code independent of the <code>/usr/bin/osascr | | which execute code independent of the <code>/usr/bin/osascr |
| ipt</code> command line utility. Adversaries may abuse Appl | | ipt</code> command line utility. Adversaries may abuse Appl |
| eScript to execute various behaviors, such as interacting wi | | eScript to execute various behaviors, such as interacting wi |
| th an open SSH connection, moving to remote machines, and ev | | th an open SSH connection, moving to remote machines, and ev |
| en presenting users with fake dialog boxes. These events can | | en presenting users with fake dialog boxes. These events can |
| not start applications remotely (they can start them locally | | not start applications remotely (they can start them locally |
| ), but they can interact with applications if they're alread | | ), but they can interact with applications if they're alread |
| y running remotely. On macOS 10.10 Yosemite and higher, Appl | | y running remotely. On macOS 10.10 Yosemite and higher, Appl |
| eScript has the ability to execute [Native API](https://atta | | eScript has the ability to execute [Native API](https://atta |
| ck.mitre.org/techniques/T1106)s, which otherwise would requi | | ck.mitre.org/techniques/T1106)s, which otherwise would requi |
| re compilation and execution in a mach-O binary file format. | | re compilation and execution in a mach-O binary file format. |
| (Citation: SentinelOne macOS Red Team) Since this is a scrip | | (Citation: SentinelOne macOS Red Team) Since this is a scrip |
| ting language, it can be used to launch more common techniqu | | ting language, it can be used to launch more common techniqu |
| es as well such as a reverse shell via [Python](https://atta | | es as well such as a reverse shell via [Python](https://atta |
| ck.mitre.org/techniques/T1059/006).(Citation: Macro Malware | | ck.mitre.org/techniques/T1059/006).(Citation: Macro Malware |
| Targets Macs) | | Targets Macs) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 20:26:48.143000+00:00 | 2022-10-19 15:37:28.071000+00:00 |
| description | Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)
AppleScripts do not need to call osascript to execute, however. They may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.
Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team) Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs) | Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)
AppleScripts do not need to call osascript to execute. However, they may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.
Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team) Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs) |
| x_mitre_data_sources[1] | Command: Command Execution | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | Command: Command Execution |
[T1584] Compromise Infrastructure
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 14:26:33.716000+00:00 | 2022-07-26 23:33:26.352000+00:00 |
| external_references[9]['description'] | Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. | Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. |
| external_references[9]['url'] | https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html | https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Internet Scan: Response Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Internet Scan: Response Content | |
[T1074] Data Staged
Current version: 1.4
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-10 22:19:56.116000+00:00 | 2022-07-20 20:07:40.167000+00:00 |
| external_references[1]['source_name'] | PWC Cloud Hopper April 2017 | Mandiant M-Trends 2020 |
| external_references[1]['description'] | PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. | Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020. |
| external_references[1]['url'] | https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf | https://content.fireeye.com/m-trends/rpt-m-trends-2020 |
| external_references[2]['source_name'] | Mandiant M-Trends 2020 | PWC Cloud Hopper April 2017 |
| external_references[2]['description'] | Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020. | PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. |
| external_references[2]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf |
| x_mitre_data_sources[0] | File: File Creation | Command: Command Execution |
| x_mitre_data_sources[3] | Command: Command Execution | File: File Creation |
[T1561.001] Disk Wipe: Disk Content Wipe
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['SYSTEM', 'root', 'Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-28 22:53:20.162000+00:00 | 2022-07-28 18:55:35.989000+00:00 |
| external_references[1]['source_name'] | Novetta Blockbuster | DOJ Lazarus Sony 2018 |
| external_references[1]['description'] | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. | Department of Justice. (2018, September 6). Criminal Complaint - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019. |
| external_references[1]['url'] | https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf | https://www.justice.gov/opa/press-release/file/1092091/download |
| external_references[2]['url'] | https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf |
| external_references[3]['source_name'] | DOJ Lazarus Sony 2018 | Novetta Blockbuster |
| external_references[3]['description'] | Department of Justice. (2018, September 6). Criminal Complaint - United States of America v. PARK JIN HYOK. Retrieved March 29, 2019. | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. |
| external_references[3]['url'] | https://www.justice.gov/opa/press-release/file/1092091/download | https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
| x_mitre_data_sources[0] | Drive: Drive Modification | Process: Process Creation |
| x_mitre_data_sources[1] | Driver: Driver Load | Command: Command Execution |
| x_mitre_data_sources[2] | Drive: Drive Access | Driver: Driver Load |
| x_mitre_data_sources[3] | Process: Process Creation | Drive: Drive Modification |
| x_mitre_data_sources[4] | Command: Command Execution | Drive: Drive Access |
[T1561] Disk Wipe
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'root', 'SYSTEM', 'Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-28 23:00:00.599000+00:00 | 2022-07-28 18:55:35.987000+00:00 |
| external_references[1]['url'] | https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf |
| x_mitre_data_sources[0] | Command: Command Execution | Process: Process Creation |
| x_mitre_data_sources[1] | Drive: Drive Access | Driver: Driver Load |
| x_mitre_data_sources[2] | Driver: Driver Load | Drive: Drive Modification |
| x_mitre_data_sources[3] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[4] | Drive: Drive Modification | Drive: Drive Access |
[T1548.004] Abuse Elevation Control Mechanism: Elevated Execution with Prompt
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-27 12:04:37.823000+00:00 | 2022-10-19 16:35:18.492000+00:00 |
| external_references[2]['source_name'] | Death by 1000 installers; it's all broken! | Carbon Black Shlayer Feb 2019 |
| external_references[2]['description'] | Patrick Wardle. (2017). Death by 1000 installers; it's all broken!. Retrieved August 8, 2019. | Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019. |
| external_references[2]['url'] | https://speakerdeck.com/patrickwardle/defcon-2017-death-by-1000-installers-its-all-broken?slide=8 | https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html |
| external_references[3]['source_name'] | Carbon Black Shlayer Feb 2019 | Death by 1000 installers; it's all broken! |
| external_references[3]['description'] | Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019. | Patrick Wardle. (2017). Death by 1000 installers; it's all broken!. Retrieved August 8, 2019. |
| external_references[3]['url'] | https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/ | https://speakerdeck.com/patrickwardle/defcon-2017-death-by-1000-installers-its-all-broken?slide=8 |
[T1491.001] Defacement: Internal Defacement
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 19:31:24.482000+00:00 | 2022-07-28 18:55:35.988000+00:00 |
| external_references[1]['source_name'] | Novetta Blockbuster | Novetta Blockbuster Destructive Malware |
| external_references[1]['description'] | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. |
| external_references[1]['url'] | https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf |
| external_references[2]['source_name'] | Novetta Blockbuster Destructive Malware | Novetta Blockbuster |
| external_references[2]['description'] | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. |
| external_references[2]['url'] | https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf | https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network Traffic: Network Traffic Content | |
[T1003.001] OS Credential Dumping: LSASS Memory
Current version: 1.1
|
|
|---|
| t | Adversaries may attempt to access credential material stored | t | Adversaries may attempt to access credential material stored |
| in the process memory of the Local Security Authority Subsy | | in the process memory of the Local Security Authority Subsy |
| stem Service (LSASS). After a user logs on, the system gener | | stem Service (LSASS). After a user logs on, the system gener |
| ates and stores a variety of credential materials in LSASS p | | ates and stores a variety of credential materials in LSASS p |
| rocess memory. These credential materials can be harvested b | | rocess memory. These credential materials can be harvested b |
| y an administrative user or SYSTEM and used to conduct [Late | | y an administrative user or SYSTEM and used to conduct [Late |
| ral Movement](https://attack.mitre.org/tactics/TA0008) using | | ral Movement](https://attack.mitre.org/tactics/TA0008) using |
| [Use Alternate Authentication Material](https://attack.mitr | | [Use Alternate Authentication Material](https://attack.mitr |
| e.org/techniques/T1550). As well as in-memory techniques, t | | e.org/techniques/T1550). As well as in-memory techniques, t |
| he LSASS process memory can be dumped from the target host a | | he LSASS process memory can be dumped from the target host a |
| nd analyzed on a local system. For example, on the target h | | nd analyzed on a local system. For example, on the target h |
| ost use procdump: * <code>procdump -ma lsass.exe lsass_dump | | ost use procdump: * <code>procdump -ma lsass.exe lsass_dump |
| </code> Locally, mimikatz can be run using: * <code>sekurl | | </code> Locally, mimikatz can be run using: * <code>sekurl |
| sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas | | sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas |
| swords</code> Built-in Windows tools such as comsvcs.dll ca | | swords</code> Built-in Windows tools such as comsvcs.dll ca |
| n also be used: * <code>rundll32.exe C:\Windows\System32\co | | n also be used: * <code>rundll32.exe C:\Windows\System32\co |
| msvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vole | | msvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vole |
| xity Exchange Marauder March 2021)(Citation: Symantec Attack | | xity Exchange Marauder March 2021)(Citation: Symantec Attack |
| s Against Government Sector) Windows Security Support Prov | | s Against Government Sector) Windows Security Support Prov |
| ider (SSP) DLLs are loaded into LSSAS process at system star | | ider (SSP) DLLs are loaded into LSASS process at system star |
| t. Once loaded into the LSA, SSP DLLs have access to encrypt | | t. Once loaded into the LSA, SSP DLLs have access to encrypt |
| ed and plaintext passwords that are stored in Windows, such | | ed and plaintext passwords that are stored in Windows, such |
| as any logged-on user's Domain password or smart card PINs. | | as any logged-on user's Domain password or smart card PINs. |
| The SSP configuration is stored in two Registry keys: <code> | | The SSP configuration is stored in two Registry keys: <code> |
| HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages< | | HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages< |
| /code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\O | | /code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\O |
| SConfig\Security Packages</code>. An adversary may modify th | | SConfig\Security Packages</code>. An adversary may modify th |
| ese Registry keys to add new SSPs, which will be loaded the | | ese Registry keys to add new SSPs, which will be loaded the |
| next time the system boots, or when the AddSecurityPackage W | | next time the system boots, or when the AddSecurityPackage W |
| indows API function is called.(Citation: Graeber 2014) The | | indows API function is called.(Citation: Graeber 2014) The |
| following SSPs can be used to access credentials: * Msv: In | | following SSPs can be used to access credentials: * Msv: In |
| teractive logons, batch logons, and service logons are done | | teractive logons, batch logons, and service logons are done |
| through the MSV authentication package. * Wdigest: The Diges | | through the MSV authentication package. * Wdigest: The Diges |
| t Authentication protocol is designed for use with Hypertext | | t Authentication protocol is designed for use with Hypertext |
| Transfer Protocol (HTTP) and Simple Authentication Security | | Transfer Protocol (HTTP) and Simple Authentication Security |
| Layer (SASL) exchanges.(Citation: TechNet Blogs Credential | | Layer (SASL) exchanges.(Citation: TechNet Blogs Credential |
| Protection) * Kerberos: Preferred for mutual client-server d | | Protection) * Kerberos: Preferred for mutual client-server d |
| omain authentication in Windows 2000 and later. * CredSSP: | | omain authentication in Windows 2000 and later. * CredSSP: |
| Provides SSO and Network Level Authentication for Remote Des | | Provides SSO and Network Level Authentication for Remote Des |
| ktop Services.(Citation: TechNet Blogs Credential Protection | | ktop Services.(Citation: TechNet Blogs Credential Protection |
| ) | | ) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-12 21:38:58.866000+00:00 | 2022-10-06 16:16:53.388000+00:00 |
| description | Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords
Built-in Windows tools such as comsvcs.dll can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)
Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)
| Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords
Built-in Windows tools such as comsvcs.dll can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)
|
| x_mitre_data_sources[0] | Command: Command Execution | Process: OS API Execution |
| x_mitre_data_sources[2] | Process: OS API Execution | Command: Command Execution |
[T1621] Multi-Factor Authentication Request Generation
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 19:40:51.825000+00:00 | 2022-08-05 13:55:20.002000+00:00 |
| x_mitre_data_sources[0] | Logon Session: Logon Session Metadata | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Application Log: Application Log Content | User Account: User Account Authentication |
| x_mitre_data_sources[3] | User Account: User Account Authentication | Logon Session: Logon Session Metadata |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Shanief Webb |
[T1110.001] Brute Force: Password Guessing
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 21:31:44.221000+00:00 | 2022-07-22 18:37:22.173000+00:00 |
| external_references[2]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
[T1574.009] Hijack Execution Flow: Path Interception by Unquoted Path
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018. |
| external_references | | CAPEC-38 |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-38 | |
| external_references | absolomb. (2018, January 26). Windows Privilege Escalation Guide. Retrieved August 10, 2018. | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-17 19:05:23.755000+00:00 | 2022-10-18 20:51:38.118000+00:00 |
| external_references[1]['source_name'] | capec | Windows Privilege Escalation Guide |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/38.html | https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ |
| external_references[2]['source_name'] | Microsoft CurrentControlSet Services | Windows Unquoted Services |
| external_references[2]['description'] | Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020. | HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018. |
| external_references[2]['url'] | https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree | https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/ |
| external_references[4]['source_name'] | Windows Unquoted Services | Microsoft CurrentControlSet Services |
| external_references[4]['description'] | HackHappy. (2018, April 23). Windows Privilege Escalation – Unquoted Services. Retrieved August 10, 2018. | Microsoft. (2017, April 20). HKLM\SYSTEM\CurrentControlSet\Services Registry Tree. Retrieved March 16, 2020. |
| external_references[4]['url'] | https://securityboulevard.com/2018/04/windows-privilege-escalation-unquoted-services/ | https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree |
| external_references[5]['source_name'] | Windows Privilege Escalation Guide | capec |
| external_references[5]['url'] | https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ | https://capec.mitre.org/data/definitions/38.html |
| x_mitre_data_sources[0] | File: File Creation | File: File Modification |
| x_mitre_data_sources[2] | File: File Modification | File: File Creation |
[T1596] Search Open Technical Databases
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:50:44.308000+00:00 | 2022-10-18 22:45:19.607000+00:00 |
| external_references[1]['source_name'] | WHOIS | Circl Passive DNS |
| external_references[1]['description'] | NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020. | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. |
| external_references[1]['url'] | https://www.whois.net/ | https://www.circl.lu/services/passive-dns/ |
| external_references[3]['source_name'] | Circl Passive DNS | Medium SSL Cert |
| external_references[3]['description'] | CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020. | Jain, M. (2019, September 16). Export & Download — SSL Certificate from Server (Site URL). Retrieved October 20, 2020. |
| external_references[3]['url'] | https://www.circl.lu/services/passive-dns/ | https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2 |
| external_references[4]['source_name'] | Medium SSL Cert | WHOIS |
| external_references[4]['description'] | Jain, M. (2019, September 16). Export & Download — SSL Certificate from Server (Site URL). Retrieved October 20, 2020. | NTT America. (n.d.). Whois Lookup. Retrieved October 20, 2020. |
| external_references[4]['url'] | https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2 | https://www.whois.net/ |
| external_references[5]['source_name'] | SSLShopper Lookup | Shodan |
| external_references[5]['description'] | SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020. | Shodan. (n.d.). Shodan. Retrieved October 20, 2020. |
| external_references[5]['url'] | https://www.sslshopper.com/ssl-checker.html | https://shodan.io |
| external_references[6]['source_name'] | DigitalShadows CDN | SSLShopper Lookup |
| external_references[6]['description'] | Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020. | SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020. |
| external_references[6]['url'] | https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/ | https://www.sslshopper.com/ssl-checker.html |
| external_references[7]['source_name'] | Shodan | DigitalShadows CDN |
| external_references[7]['description'] | Shodan. (n.d.). Shodan. Retrieved October 20, 2020. | Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020. |
| external_references[7]['url'] | https://shodan.io | https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/ |
[T1003.002] OS Credential Dumping: Security Account Manager
Current version: 1.0
|
|
|---|
| t | Adversaries may attempt to extract credential material from | t | Adversaries may attempt to extract credential material from |
| the Security Account Manager (SAM) database either through i | | the Security Account Manager (SAM) database either through i |
| n-memory techniques or through the Windows Registry where th | | n-memory techniques or through the Windows Registry where th |
| e SAM database is stored. The SAM is a database file that co | | e SAM database is stored. The SAM is a database file that co |
| ntains local accounts for the host, typically those found wi | | ntains local accounts for the host, typically those found wi |
| th the <code>net user</code> command. Enumerating the SAM da | | th the <code>net user</code> command. Enumerating the SAM da |
| tabase requires SYSTEM level access. A number of tools can | | tabase requires SYSTEM level access. A number of tools can |
| be used to retrieve the SAM file through in-memory technique | | be used to retrieve the SAM file through in-memory technique |
| s: * pwdumpx.exe * [gsecdump](https://attack.mitre.org/soft | | s: * pwdumpx.exe * [gsecdump](https://attack.mitre.org/soft |
| ware/S0008) * [Mimikatz](https://attack.mitre.org/software/S | | ware/S0008) * [Mimikatz](https://attack.mitre.org/software/S |
| 0002) * secretsdump.py Alternatively, the SAM can be extrac | | 0002) * secretsdump.py Alternatively, the SAM can be extrac |
| ted from the Registry with Reg: * <code>reg save HKLM\sam s | | ted from the Registry with Reg: * <code>reg save HKLM\sam s |
| am</code> * <code>reg save HKLM\system system</code> Creddu | | am</code> * <code>reg save HKLM\system system</code> Creddu |
| mp7 can then be used to process the SAM database locally to | | mp7 can then be used to process the SAM database locally to |
| retrieve hashes.(Citation: GitHub Creddump7) Notes: * RID | | retrieve hashes.(Citation: GitHub Creddump7) Notes: * RID |
| 500 account is the local, built-in administrator. * RID 501 | | 500 account is the local, built-in administrator. * RID 501 |
| is the guest account. * User accounts start with a RID of 1, | | is the guest account. * User accounts start with a RID of 1 |
| 000+. | | ,000+. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 15:17:30.640000+00:00 | 2022-06-15 16:17:19.049000+00:00 |
| description | Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe
* [gsecdump](https://attack.mitre.org/software/S0008)
* [Mimikatz](https://attack.mitre.org/software/S0002)
* secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam
* reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)
Notes:
* RID 500 account is the local, built-in administrator.
* RID 501 is the guest account.
* User accounts start with a RID of 1,000+.
| Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe
* [gsecdump](https://attack.mitre.org/software/S0008)
* [Mimikatz](https://attack.mitre.org/software/S0002)
* secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam
* reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)
Notes:
* RID 500 account is the local, built-in administrator.
* RID 501 is the guest account.
* User accounts start with a RID of 1,000+.
|
| x_mitre_data_sources[0] | Windows Registry: Windows Registry Key Access | File: File Access |
| x_mitre_data_sources[2] | File: File Access | Windows Registry: Windows Registry Key Access |
[T1489] Service Stop
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_is_subtechnique | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-02 22:11:32.017000+00:00 | 2022-07-28 18:47:11.957000+00:00 |
| external_references[1]['source_name'] | Talos Olympic Destroyer 2018 | SecureWorks WannaCry Analysis |
| external_references[1]['description'] | Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. | Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019. |
| external_references[1]['url'] | https://blog.talosintelligence.com/2018/02/olympic-destroyer.html | https://www.secureworks.com/research/wcry-ransomware-analysis |
| external_references[2]['source_name'] | Novetta Blockbuster | Talos Olympic Destroyer 2018 |
| external_references[2]['description'] | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. | Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019. |
| external_references[2]['url'] | https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf | https://blog.talosintelligence.com/2018/02/olympic-destroyer.html |
| external_references[3]['source_name'] | SecureWorks WannaCry Analysis | Novetta Blockbuster |
| external_references[3]['description'] | Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019. | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. |
| external_references[3]['url'] | https://www.secureworks.com/research/wcry-ransomware-analysis | https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
| x_mitre_data_sources[0] | Command: Command Execution | Service: Service Metadata |
| x_mitre_data_sources[1] | Process: Process Termination | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[3] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[4] | Windows Registry: Windows Registry Key Modification | Process: Process Creation |
| x_mitre_data_sources[5] | Service: Service Metadata | Process: Process Termination |
[T1543.003] Create or Modify System Process: Windows Service
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 16:22:32.605000+00:00 | 2022-06-30 20:17:33.824000+00:00 |
| x_mitre_data_sources[0] | Windows Registry: Windows Registry Key Modification | Process: Process Creation |
| x_mitre_data_sources[1] | Driver: Driver Load | Command: Command Execution |
| x_mitre_data_sources[2] | Service: Service Creation | Process: OS API Execution |
| x_mitre_data_sources[3] | Windows Registry: Windows Registry Key Creation | Service: Service Creation |
| x_mitre_data_sources[4] | Service: Service Modification | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[5] | Process: OS API Execution | Windows Registry: Windows Registry Key Creation |
| x_mitre_data_sources[6] | Command: Command Execution | Service: Service Modification |
| x_mitre_data_sources[7] | Process: Process Creation | Driver: Driver Load |
[T1595.003] Active Scanning: Wordlist Scanning
Current version: 1.0
|
|
|---|
| t | Adversaries may iteratively probe infrastructure using brute | t | Adversaries may iteratively probe infrastructure using brute |
| -forcing and crawling techniques. While this technique emplo | | -forcing and crawling techniques. While this technique emplo |
| ys similar methods to [Brute Force](https://attack.mitre.org | | ys similar methods to [Brute Force](https://attack.mitre.org |
| /techniques/T1110), its goal is the identification of conten | | /techniques/T1110), its goal is the identification of conten |
| t and infrastructure rather than the discovery of valid cred | | t and infrastructure rather than the discovery of valid cred |
| entials. Wordlists used in these scans may contain generic, | | entials. Wordlists used in these scans may contain generic, |
| commonly used names and file extensions or terms specific to | | commonly used names and file extensions or terms specific to |
| a particular software. Adversaries may also create custom, | | a particular software. Adversaries may also create custom, |
| target-specific wordlists using data gathered from other Rec | | target-specific wordlists using data gathered from other Rec |
| onnaissance techniques (ex: [Gather Victim Org Information]( | | onnaissance techniques (ex: [Gather Victim Org Information]( |
| https://attack.mitre.org/techniques/T1591), or [Search Victi | | https://attack.mitre.org/techniques/T1591), or [Search Victi |
| m-Owned Websites](https://attack.mitre.org/techniques/T1594) | | m-Owned Websites](https://attack.mitre.org/techniques/T1594) |
| ). For example, adversaries may use web content discovery t | | ). For example, adversaries may use web content discovery t |
| ools such as Dirb, DirBuster, and GoBuster and generic or cu | | ools such as Dirb, DirBuster, and GoBuster and generic or cu |
| stom wordlists to enumerate a website’s pages and directorie | | stom wordlists to enumerate a website’s pages and directorie |
| s.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help | | s.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help |
| them to discover old, vulnerable pages or hidden administra | | them to discover old, vulnerable pages or hidden administra |
| tive portals that could become the target of further operati | | tive portals that could become the target of further operati |
| ons (ex: [Exploit Public-Facing Application](https://attack. | | ons (ex: [Exploit Public-Facing Application](https://attack. |
| mitre.org/techniques/T1190) or [Brute Force](https://attack. | | mitre.org/techniques/T1190) or [Brute Force](https://attack. |
| mitre.org/techniques/T1110)). As cloud storage solutions | | mitre.org/techniques/T1110)). As cloud storage solutions |
| typically use globally unique names, adversaries may also us | | typically use globally unique names, adversaries may also us |
| e target-specific wordlists and tools such as s3recon and GC | | e target-specific wordlists and tools such as s3recon and GC |
| PBucketBrute to enumerate public and private buckets on clou | | PBucketBrute to enumerate public and private buckets on clou |
| d infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBuc | | d infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBuc |
| ketBrute) Once storage objects are discovered, adversaries m | | ketBrute) Once storage objects are discovered, adversaries m |
| ay leverage [Data from Cloud Storage Object](https://attack. | | ay leverage [Data from Cloud Storage](https://attack.mitre.o |
| mitre.org/techniques/T1530) to access valuable information t | | rg/techniques/T1530) to access valuable information that can |
| hat can be exfiltrated or used to escalate privileges and mo | | be exfiltrated or used to escalate privileges and move late |
| ve laterally. | | rally. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| description | Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).
For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)).
As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage Object](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally. | Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).
For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.(Citation: ClearSky Lebanese Cedar Jan 2021) This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [Brute Force](https://attack.mitre.org/techniques/T1110)).
As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.(Citation: S3Recon GitHub)(Citation: GCPBucketBrute) Once storage objects are discovered, adversaries may leverage [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) to access valuable information that can be exfiltrated or used to escalate privileges and move laterally. |
mobile-attack
Patches
[T1616] Call Control
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-27 18:05:42.788000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1577] Compromise Application Executable
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-05-27 13:23:34.159000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1617] Hooking
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-04 20:08:47.559000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1430.002] Location Tracking: Impersonate SS7 Nodes
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-11 19:10:05.885000+00:00 | 2022-10-21 13:44:56.301000+00:00 |
[T1516] Input Injection
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-24 15:02:13.323000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1604] Proxy Through Victim
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-12-04 20:30:31.513000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1430.001] Location Tracking: Remote Device Management Services
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 19:58:48.039000+00:00 | 2022-10-21 13:44:31.305000+00:00 |
[T1582] SMS Control
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-22 17:04:15.578000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[T1603] Scheduled Task/Job
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-11-04 19:45:38.144000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
ics-attack
New Techniques
[T0891] Hardcoded Credentials
Current version: 1.0
Description: Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset. Examples credentials that may be hardcoded in an asset include:
* Username/Passwords
* Cryptographic keys/Certificates
* API tokens
Unlike [Default Credentials](https://attack.mitre.org/techniques/T0812), these credentials are built into the system in a way that they either cannot be changed by the asset owner, or may be infeasible to change because of the impact it would cause to the control system operation. These credentials may be reused across whole product lines or device models and are often not published or known to the owner and operators of the asset.
Adversaries may utilize these hardcoded credentials to move throughout the control system environment or provide reliable access for their tools to interact with industrial assets.
Major Version Changes
[T0830] Adversary-in-the-Middle
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | Adversaries with privileged network access may seek to modif | t | Adversaries with privileged network access may seek to modif |
| y network traffic in real time using man-in-the-middle (MITM | | y network traffic in real time using adversary-in-the-middle |
| ) attacks. (Citation: Gabriel Sanchez October 2017) This typ | | (AiTM) attacks. (Citation: Gabriel Sanchez October 2017) Th |
| e of attack allows the adversary to intercept traffic to and | | is type of attack allows the adversary to intercept traffic |
| /or from a particular device on the network. If a MITM attac | | to and/or from a particular device on the network. If a AiTM |
| k is established, then the adversary has the ability to bloc | | attack is established, then the adversary has the ability t |
| k, log, modify, or inject traffic into the communication str | | o block, log, modify, or inject traffic into the communicati |
| eam. There are several ways to accomplish this attack, but s | | on stream. There are several ways to accomplish this attack, |
| ome of the most-common are Address Resolution Protocol (ARP) | | but some of the most-common are Address Resolution Protocol |
| poisoning and the use of a proxy. (Citation: Bonnie Zhu, An | | (ARP) poisoning and the use of a proxy. (Citation: Bonnie Z |
| thony Joseph, Shankar Sastry 2011) A MITM attack may allo | | hu, Anthony Joseph, Shankar Sastry 2011) An AiTM attack m |
| w an adversary to perform the following attacks: [Block Re | | ay allow an adversary to perform the following attacks: [B |
| porting Message](https://attack.mitre.org/techniques/T0804), | | lock Reporting Message](https://attack.mitre.org/techniques/ |
| [Spoof Reporting Message](https://attack.mitre.org/techniqu | | T0804), [Spoof Reporting Message](https://attack.mitre.org/t |
| es/T0856), [Modify Parameter](https://attack.mitre.org/techn | | echniques/T0856), [Modify Parameter](https://attack.mitre.or |
| iques/T0836), [Unauthorized Command Message](https://attack. | | g/techniques/T0836), [Unauthorized Command Message](https:// |
| mitre.org/techniques/T0855) | | attack.mitre.org/techniques/T0855) |
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0019: Service (Service Creation)
- DS0024: Windows Registry (Windows Registry Key Modification)
Dropped Detections:
- DS0009: Process (OS API Execution)
- DS0017: Command (Command Execution)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 19:32:27.175000+00:00 | 2022-09-26 20:38:32.749000+00:00 |
| name | Man in the Middle | Adversary-in-the-Middle |
| description | Adversaries with privileged network access may seek to modify network traffic in real time using man-in-the-middle (MITM) attacks. (Citation: Gabriel Sanchez October 2017) This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a MITM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
A MITM attack may allow an adversary to perform the following attacks:
[Block Reporting Message](https://attack.mitre.org/techniques/T0804), [Spoof Reporting Message](https://attack.mitre.org/techniques/T0856), [Modify Parameter](https://attack.mitre.org/techniques/T0836), [Unauthorized Command Message](https://attack.mitre.org/techniques/T0855) | Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. (Citation: Gabriel Sanchez October 2017) This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
An AiTM attack may allow an adversary to perform the following attacks:
[Block Reporting Message](https://attack.mitre.org/techniques/T0804), [Spoof Reporting Message](https://attack.mitre.org/techniques/T0856), [Modify Parameter](https://attack.mitre.org/techniques/T0836), [Unauthorized Command Message](https://attack.mitre.org/techniques/T0855) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 2.0 |
Minor Version Changes
[T0878] Alarm Suppression
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may target protection function alarms to prevent | t | Adversaries may target protection function alarms to prevent |
| them from notifying operators of critical conditions. Alarm | | them from notifying operators of critical conditions. Alarm |
| messages may be a part of an overall reporting system and o | | messages may be a part of an overall reporting system and o |
| f particular interest for adversaries. Disruption of the ala | | f particular interest for adversaries. Disruption of the ala |
| rm system does not imply the disruption of the reporting sys | | rm system does not imply the disruption of the reporting sys |
| tem as a whole. In the Maroochy Attack, the adversary supp | | tem as a whole. A Secura presentation on targeting OT notes |
| ressed alarm reporting to the central computer. (Citation: M | | a dual fold goal for adversaries attempting alarm suppressi |
| arshall Abrams July 2008) A Secura presentation on targetin | | on: prevent outgoing alarms from being raised and prevent in |
| g OT notes a dual fold goal for adversaries attempting alarm | | coming alarms from being responded to. (Citation: Jos Wetzel |
| suppression: prevent outgoing alarms from being raised and | | s, Marina Krotofil 2019) The method of suppression may great |
| prevent incoming alarms from being responded to. (Citation: | | ly depend on the type of alarm in question: * An alarm ra |
| Jos Wetzels, Marina Krotofil 2019) The method of suppressio | | ised by a protocol message * An alarm signaled with I/O * |
| n may greatly depend on the type of alarm in question: * An | | An alarm bit set in a flag (and read) In ICS environments, |
| alarm raised by a protocol message * An alarm signaled with | | the adversary may have to suppress or contend with multiple |
| I/O * An alarm bit set in a flag (and read) In ICS environ | | alarms and/or alarm propagation to achieve a specific goal |
| ments, the adversary may have to suppress or contend with mu | | to evade detection or prevent intended responses from occurr |
| ltiple alarms and/or alarm propagation to achieve a specific | | ing. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods |
| goal to evade detection or prevent intended responses from | | of suppression may involve tampering or altering device disp |
| occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Me | | lays and logs, modifying in memory code to fixed values, or |
| thods of suppression may involve tampering or altering devic | | even tampering with assembly level instruction code. In the |
| e displays and logs, modifying in memory code to fixed value | | Maroochy Shire attack, the adversary suppressed alarm repor |
| s, or even tampering with assembly level instruction code. | | ting to the central computer.(Citation: Marshall Abrams July |
| | | 2008) |
New Detections:
- DS0029: Network Traffic (Network Traffic Flow)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0015: Application Log (Application Log Content)
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.889000+00:00 | 2022-10-20 18:15:39.012000+00:00 |
| description | Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole. In the Maroochy Attack, the adversary suppressed alarm reporting to the central computer. (Citation: Marshall Abrams July 2008) A Secura presentation on targeting OT notes a dual fold goal for adversaries attempting alarm suppression: prevent outgoing alarms from being raised and prevent incoming alarms from being responded to. (Citation: Jos Wetzels, Marina Krotofil 2019) The method of suppression may greatly depend on the type of alarm in question: * An alarm raised by a protocol message * An alarm signaled with I/O * An alarm bit set in a flag (and read) In ICS environments, the adversary may have to suppress or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression may involve tampering or altering device displays and logs, modifying in memory code to fixed values, or even tampering with assembly level instruction code. | Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole.
A Secura presentation on targeting OT notes a dual fold goal for adversaries attempting alarm suppression: prevent outgoing alarms from being raised and prevent incoming alarms from being responded to. (Citation: Jos Wetzels, Marina Krotofil 2019) The method of suppression may greatly depend on the type of alarm in question:
* An alarm raised by a protocol message
* An alarm signaled with I/O
* An alarm bit set in a flag (and read)
In ICS environments, the adversary may have to suppress or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression may involve tampering or altering device displays and logs, modifying in memory code to fixed values, or even tampering with assembly level instruction code.
In the Maroochy Shire attack, the adversary suppressed alarm reporting to the central computer.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Marshall Abrams July 2008 | Jos Wetzels, Marina Krotofil 2019 |
| external_references[1]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | Jos Wetzels, Marina Krotofil 2019 A Diet of Poisoned Fruit: Designing Implants & OT Payloads for ICS Embedded Devices Retrieved. 2019/11/01 |
| external_references[1]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf |
| external_references[2]['source_name'] | Jos Wetzels, Marina Krotofil 2019 | Marshall Abrams July 2008 |
| external_references[2]['description'] | Jos Wetzels, Marina Krotofil 2019 A Diet of Poisoned Fruit: Designing Implants & OT Payloads for ICS Embedded Devices Retrieved. 2019/11/01 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[2]['url'] | https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Jos Wetzels, Marina Krotofil 2019', 'description': 'Jos Wetzels, Marina Krotofil 2019 A Diet of Poisoned Fruit: Designing Implants & OT Payloads for ICS Embedded Devices Retrieved. 2019/11/01 ', 'url': 'https://troopers.de/downloads/troopers19/TROOPERS19_NGI_IoT_diet_poisoned_fruit.pdf'} | |
[T0805] Block Serial COM
Current version: 1.1
Version changed from: 1.0 → 1.1
Dropped Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.892000+00:00 | 2022-10-20 21:02:54.674000+00:00 |
| description | Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages. A serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10.0.0.1 via Telnet on serial port 1 with the following command: telnet 10.0.0.1 20001. | Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages.
A serial to Ethernet converter is often connected to a serial COM to facilitate communication between serial and Ethernet devices. One approach to blocking a serial COM would be to create and hold open a TCP session with the Ethernet side of the converter. A serial to Ethernet converter may have a few ports open to facilitate multiple communications. For example, if there are three serial COM available -- 1, 2 and 3 --, the converter might be listening on the corresponding ports 20001, 20002, and 20003. If a TCP/IP connection is opened with one of these ports and held open, then the port will be unavailable for use by another party. One way the adversary could achieve this would be to initiate a TCP session with the serial to Ethernet converter at 10.0.0.1 via Telnet on serial port 1 with the following command: telnet 10.0.0.1 20001. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0807] Command-Line Interface
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may utilize command-line interfaces (CLIs) to in | t | Adversaries may utilize command-line interfaces (CLIs) to in |
| teract with systems and execute commands. CLIs provide a mea | | teract with systems and execute commands. CLIs provide a mea |
| ns of interacting with computer systems and are a common fea | | ns of interacting with computer systems and are a common fea |
| ture across many types of platforms and devices within contr | | ture across many types of platforms and devices within contr |
| ol systems environments. (Citation: Enterprise ATT&CK Januar | | ol systems environments. (Citation: Enterprise ATT&CK Januar |
| y 2018) Adversaries may also use CLIs to install and run new | | y 2018) Adversaries may also use CLIs to install and run new |
| software, including malicious tools that may be installed o | | software, including malicious tools that may be installed o |
| ver the course of an operation. CLIs are typically accessed | | ver the course of an operation. CLIs are typically accessed |
| locally, but can also be exposed via services, such as SSH, | | locally, but can also be exposed via services, such as SSH, |
| Telnet, and RDP. Commands that are executed in the CLI exe | | Telnet, and RDP. Commands that are executed in the CLI exe |
| cute with the current permissions level of the process runni | | cute with the current permissions level of the process runni |
| ng the terminal emulator, unless the command specifies a cha | | ng the terminal emulator, unless the command specifies a cha |
| nge in permissions context. Many controllers have CLI inter | | nge in permissions context. Many controllers have CLI interf |
| faces for management purposes. | | aces for management purposes. |
New Detections:
- DS0015: Application Log (Application Log Content)
Dropped Detections:
- DS0011: Module (Module Load)
- DS0012: Script (Script Execution)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.898000+00:00 | 2022-09-27 15:30:18.702000+00:00 |
| description | Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. (Citation: Enterprise ATT&CK January 2018) Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation. CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes. | Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. (Citation: Enterprise ATT&CK January 2018) Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.
CLIs are typically accessed locally, but can also be exposed via services, such as SSH, Telnet, and RDP. Commands that are executed in the CLI execute with the current permissions level of the process running the terminal emulator, unless the command specifies a change in permissions context. Many controllers have CLI interfaces for management purposes. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0885] Commonly Used Port
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 14:31:04.264000+00:00 | 2022-09-27 18:49:25.201000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0884] Connection Proxy
Current version: 1.1
Version changed from: 1.0 → 1.1
Dropped Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.900000+00:00 | 2022-10-20 21:01:00.402000+00:00 |
| description | Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications. The definition of a proxy can also be expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted connections between networks consisting of hosts or systems that regularly communicate with each other. The network may be within a single organization or across multiple organizations with trust relationships. Adversaries could use these types of relationships to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. (Citation: Enterprise ATT&CK January 2018) | Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
The definition of a proxy can also be expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted connections between networks consisting of hosts or systems that regularly communicate with each other.
The network may be within a single organization or across multiple organizations with trust relationships. Adversaries could use these types of relationships to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. (Citation: Enterprise ATT&CK January 2018) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0811] Data from Information Repositories
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may target and collect data from information rep | t | Adversaries may target and collect data from information rep |
| ositories. This can include sensitive data such as specifica | | ositories. This can include sensitive data such as specifica |
| tions, schematics, or diagrams of control system layouts, de | | tions, schematics, or diagrams of control system layouts, de |
| vices, and processes. Examples of information repositories i | | vices, and processes. Examples of information repositories i |
| nclude reference databases or local machines in the process | | nclude reference databases or local machines in the process |
| environment, as well as workstations and databases in the co | | environment, as well as workstations and databases in the co |
| rporate network that might contain information about the ICS | | rporate network that might contain information about the ICS |
| . (Citation: Cybersecurity & Infrastructure Security Agency | | .(Citation: Cybersecurity & Infrastructure Security Agency M |
| March 2018) Information collected from these systems may p | | arch 2018) Information collected from these systems may pro |
| rovide the adversary with a better understanding of the oper | | vide the adversary with a better understanding of the operat |
| ational environment, vendors used, processes, or procedures | | ional environment, vendors used, processes, or procedures of |
| of the ICS. In a campaign between 2011 and 2013 against ONG | | the ICS. In a campaign between 2011 and 2013 against ONG o |
| organizations, Chinese state-sponsored actors searched docu | | rganizations, Chinese state-sponsored actors searched docume |
| ment repositories for specific information such as, system m | | nt repositories for specific information such as, system man |
| anuals, remote terminal unit (RTU) sites, personnel lists, d | | uals, remote terminal unit (RTU) sites, personnel lists, doc |
| ocuments that included the string SCAD*, user credentials, a | | uments that included the string SCAD*, user credentials, and |
| nd remote dial-up access information. (Citation: CISA AA21-2 | | remote dial-up access information. (Citation: CISA AA21-201 |
| 01A Pipeline Intrusion July 2021) | | A Pipeline Intrusion July 2021) |
New Detections:
- DS0009: Process (OS API Execution)
- DS0009: Process (Process Creation)
- DS0012: Script (Script Execution)
- DS0017: Command (Command Execution)
- DS0033: Network Share (Network Share Access)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.905000+00:00 | 2022-09-27 18:05:21.731000+00:00 |
| description | Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of information repositories include reference databases or local machines in the process environment, as well as workstations and databases in the corporate network that might contain information about the ICS. (Citation: Cybersecurity & Infrastructure Security Agency March 2018) Information collected from these systems may provide the adversary with a better understanding of the operational environment, vendors used, processes, or procedures of the ICS. In a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD*, user credentials, and remote dial-up access information. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) | Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of information repositories include reference databases or local machines in the process environment, as well as workstations and databases in the corporate network that might contain information about the ICS.(Citation: Cybersecurity & Infrastructure Security Agency March 2018)
Information collected from these systems may provide the adversary with a better understanding of the operational environment, vendors used, processes, or procedures of the ICS.
In a campaign between 2011 and 2013 against ONG organizations, Chinese state-sponsored actors searched document repositories for specific information such as, system manuals, remote terminal unit (RTU) sites, personnel lists, documents that included the string SCAD*, user credentials, and remote dial-up access information. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0816] Device Restart/Shutdown
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may forcibly restart or shutdown a device in an | t | Adversaries may forcibly restart or shutdown a device in an |
| ICS environment to disrupt and potentially negatively impact | | ICS environment to disrupt and potentially negatively impact |
| physical processes. Methods of device restart and shutdown | | physical processes. Methods of device restart and shutdown |
| exist in some devices as built-in, standard functionalities. | | exist in some devices as built-in, standard functionalities. |
| These functionalities can be executed using interactive dev | | These functionalities can be executed using interactive dev |
| ice web interfaces, CLIs, and network protocol commands. U | | ice web interfaces, CLIs, and network protocol commands. Un |
| nexpected restart or shutdown of control system devices may | | expected restart or shutdown of control system devices may p |
| prevent expected response functions happening during critica | | revent expected response functions happening during critical |
| l states. A device restart can also be a sign of malicious | | states. A device restart can also be a sign of malicious d |
| device modifications, as many updates require a shutdown in | | evice modifications, as many updates require a shutdown in o |
| order to take effect. | | rder to take effect. |
New Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.917000+00:00 | 2022-09-26 16:50:56.401000+00:00 |
| description | Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands. Unexpected restart or shutdown of control system devices may prevent expected response functions happening during critical states. A device restart can also be a sign of malicious device modifications, as many updates require a shutdown in order to take effect. | Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands.
Unexpected restart or shutdown of control system devices may prevent expected response functions happening during critical states.
A device restart can also be a sign of malicious device modifications, as many updates require a shutdown in order to take effect. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Research - Research - Taxonomy Cyber Attacks on SCADA', 'description': 'Bonnie Zhu, Anthony Joseph, Shankar Sastry. (2011). A Taxonomy of Cyber Attacks on SCADA Systems. Retrieved January 12, 2018.', 'url': 'http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258'} | |
| external_references | {'source_name': 'Ukraine15 - EISAC - 201603', 'description': 'Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018.', 'url': 'https://ics.sans.org/media/E-ISAC%20SANS%20Ukraine%20DUC%205.pdf'} | |
[T0871] Execution through API
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0009: Process (OS API Execution)
Dropped Detections:
- DS0011: Module (Module Load)
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.918000+00:00 | 2022-09-27 15:32:03.427000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0820] Exploitation for Evasion
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may exploit a software vulnerability to take adv | t | Adversaries may exploit a software vulnerability to take adv |
| antage of a programming error in a program, service, or with | | antage of a programming error in a program, service, or with |
| in the operating system software or kernel itself to evade d | | in the operating system software or kernel itself to evade d |
| etection. Vulnerabilities may exist in software that can be | | etection. Vulnerabilities may exist in software that can be |
| used to disable or circumvent security features. Adversarie | | used to disable or circumvent security features. Adversar |
| s may have prior knowledge through [Remote System Informatio | | ies may have prior knowledge through [Remote System Informat |
| n Discovery](https://attack.mitre.org/techniques/T0888) abou | | ion Discovery](https://attack.mitre.org/techniques/T0888) ab |
| t security features implemented on control devices. These de | | out security features implemented on control devices. These |
| vice security features will likely be targeted directly for | | device security features will likely be targeted directly fo |
| exploitation. There are examples of firmware RAM/ROM consist | | r exploitation. There are examples of firmware RAM/ROM consi |
| ency checks on control devices being targeted by adversaries | | stency checks on control devices being targeted by adversari |
| to enable the installation of malicious [System Firmware](h | | es to enable the installation of malicious [System Firmware] |
| ttps://attack.mitre.org/techniques/T0857). | | (https://attack.mitre.org/techniques/T0857). |
New Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.919000+00:00 | 2022-09-30 15:28:37.716000+00:00 |
| description | Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features. Adversaries may have prior knowledge through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888) about security features implemented on control devices. These device security features will likely be targeted directly for exploitation. There are examples of firmware RAM/ROM consistency checks on control devices being targeted by adversaries to enable the installation of malicious [System Firmware](https://attack.mitre.org/techniques/T0857). | Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features.
Adversaries may have prior knowledge through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888) about security features implemented on control devices. These device security features will likely be targeted directly for exploitation. There are examples of firmware RAM/ROM consistency checks on control devices being targeted by adversaries to enable the installation of malicious [System Firmware](https://attack.mitre.org/techniques/T0857). |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0890] Exploitation for Privilege Escalation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may exploit software vulnerabilities in an attem | t | Adversaries may exploit software vulnerabilities in an attem |
| pt to elevate privileges. Exploitation of a software vulnera | | pt to elevate privileges. Exploitation of a software vulnera |
| bility occurs when an adversary takes advantage of a program | | bility occurs when an adversary takes advantage of a program |
| ming error in a program, service, or within the operating sy | | ming error in a program, service, or within the operating sy |
| stem software or kernel itself to execute adversary-controll | | stem software or kernel itself to execute adversary-controll |
| ed code. Security constructs such as permission levels will | | ed code. Security constructs such as permission levels will |
| often hinder access to information and use of certain techni | | often hinder access to information and use of certain techni |
| ques, so adversaries will likely need to perform privilege e | | ques, so adversaries will likely need to perform privilege e |
| scalation to include use of software exploitation to circumv | | scalation to include use of software exploitation to circumv |
| ent those restrictions. (Citation: The MITRE Corporation) W | | ent those restrictions. (Citation: The MITRE Corporation) |
| hen initially gaining access to a system, an adversary may b | | When initially gaining access to a system, an adversary may |
| e operating within a lower privileged process which will pre | | be operating within a lower privileged process which will pr |
| vent them from accessing certain resources on the system. Vu | | event them from accessing certain resources on the system. V |
| lnerabilities may exist, usually in operating system compone | | ulnerabilities may exist, usually in operating system compon |
| nts and software commonly running at higher permissions, tha | | ents and software commonly running at higher permissions, th |
| t can be exploited to gain higher levels of access on the sy | | at can be exploited to gain higher levels of access on the s |
| stem. This could enable someone to move from unprivileged or | | ystem. This could enable someone to move from unprivileged o |
| user level permissions to SYSTEM or root permissions depend | | r user level permissions to SYSTEM or root permissions depen |
| ing on the component that is vulnerable. This may be a neces | | ding on the component that is vulnerable. This may be a nece |
| sary step for an adversary compromising an endpoint system t | | ssary step for an adversary compromising an endpoint system |
| hat has been properly configured and limits other privilege | | that has been properly configured and limits other privilege |
| escalation methods. (Citation: The MITRE Corporation) | | escalation methods. (Citation: The MITRE Corporation) |
New Detections:
- DS0015: Application Log (Application Log Content)
Dropped Detections:
- DS0009: Process (OS API Execution)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.920000+00:00 | 2022-09-27 16:38:58.028000+00:00 |
| description | Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. (Citation: The MITRE Corporation) When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. (Citation: The MITRE Corporation) | Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. (Citation: The MITRE Corporation)
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. (Citation: The MITRE Corporation) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['description'] | The MITRE Corporation ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 | The MITRE Corporation The MITRE Corporation ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'The MITRE Corporation', 'description': 'The MITRE Corporation The MITRE Corporation ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 ATT&CK T1068: Exploitation for Privilege Escalation Retrieved. 2021/04/12 ', 'url': 'https://attack.mitre.org/techniques/T1068/'} | |
[T0823] Graphical User Interface
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may attempt to gain access to a machine via a Gr | t | Adversaries may attempt to gain access to a machine via a Gr |
| aphical User Interface (GUI) to enhance execution capabiliti | | aphical User Interface (GUI) to enhance execution capabiliti |
| es. Access to a GUI allows a user to interact with a compute | | es. Access to a GUI allows a user to interact with a compute |
| r in a more visual manner than a CLI. A GUI allows users to | | r in a more visual manner than a CLI. A GUI allows users to |
| move a cursor and click on interface objects, with a mouse a | | move a cursor and click on interface objects, with a mouse a |
| nd keyboard as the main input devices, as opposed to just us | | nd keyboard as the main input devices, as opposed to just us |
| ing the keyboard. If physical access is not an option, then | | ing the keyboard. If physical access is not an option, then |
| access might be possible via protocols such as VNC on Linux | | access might be possible via protocols such as VNC on Linux |
| -based and Unix-based operating systems, and RDP on Windows | | -based and Unix-based operating systems, and RDP on Windows |
| operating systems. An adversary can use this access to execu | | operating systems. An adversary can use this access to execu |
| te programs and applications on the target machine. In the | | te programs and applications on the target machine. |
| Oldsmar water treatment attack, adversaries utilized the ope | | |
| rator HMI interface through the graphical user interface. Th | | |
| is action led to immediate operator detection as they were a | | |
| ble to see the adversary making changes on their screen. (Ci | | |
| tation: Pinellas County Sheriffs Office February 2021) | | |
New Detections:
- DS0011: Module (Module Load)
- DS0017: Command (Command Execution)
- DS0028: Logon Session (Logon Session Creation)
Dropped Detections:
- DS0029: Network Traffic (Network Traffic Content)
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.924000+00:00 | 2022-09-30 15:02:29.881000+00:00 |
| description | Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard. If physical access is not an option, then access might be possible via protocols such as VNC on Linux-based and Unix-based operating systems, and RDP on Windows operating systems. An adversary can use this access to execute programs and applications on the target machine. In the Oldsmar water treatment attack, adversaries utilized the operator HMI interface through the graphical user interface. This action led to immediate operator detection as they were able to see the adversary making changes on their screen. (Citation: Pinellas County Sheriffs Office February 2021) | Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard.
If physical access is not an option, then access might be possible via protocols such as VNC on Linux-based and Unix-based operating systems, and RDP on Windows operating systems. An adversary can use this access to execute programs and applications on the target machine. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Pinellas County Sheriffs Office February 2021', 'description': 'Pinellas County Sheriffs Office 2021, February 8 Treatment Plant Intrusion Press Conference Retrieved. 2021/10/08 ', 'url': 'https://www.youtube.com/watch?v=MkXDSOgLQ6M'} | |
[T0874] Hooking
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0009: Process (OS API Execution)
- DS0009: Process (Process Metadata)
Dropped Detections:
- DS0011: Module (Module Load)
- DS0022: File (File Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.926000+00:00 | 2022-09-27 15:40:42.017000+00:00 |
| description | Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means. Windows processes often leverage these API functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. (Citation: Enterprise ATT&CK) One type of hooking seen in ICS involves redirecting calls to these functions via import address table (IAT) hooking. IAT hooking uses modifications to a processs IAT, where pointers to imported API functions are stored. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) | Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means. Windows processes often leverage these API functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. (Citation: Enterprise ATT&CK)
One type of hooking seen in ICS involves redirecting calls to these functions via import address table (IAT) hooking. IAT hooking uses modifications to a processs IAT, where pointers to imported API functions are stored. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0877] I/O Image
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.927000+00:00 | 2022-09-27 18:41:43.724000+00:00 |
| description | Adversaries may seek to capture process values related to the inputs and outputs of a PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules. The Input and Output Image tables described above make up the I/O Image on a PLC. This image is used by the user program instead of directly interacting with physical I/O. (Citation: Spenneberg, Ralf 2016) Adversaries may collect the I/O Image state of a PLC by utilizing a devices [Native API](https://attack.mitre.org/techniques/T0834) to access the memory regions directly. The collection of the PLCs I/O state could be used to replace values or inform future stages of an attack. | Adversaries may seek to capture process values related to the inputs and outputs of a PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
The Input and Output Image tables described above make up the I/O Image on a PLC. This image is used by the user program instead of directly interacting with physical I/O. (Citation: Spenneberg, Ralf 2016)
Adversaries may collect the I/O Image state of a PLC by utilizing a devices [Native API](https://attack.mitre.org/techniques/T0834) to access the memory regions directly. The collection of the PLCs I/O state could be used to replace values or inform future stages of an attack. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0867] Lateral Tool Transfer
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0033: Network Share (Network Share Access)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.932000+00:00 | 2022-09-27 17:39:15.755000+00:00 |
| description | Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks. | Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK)
In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['description'] | Enterprise ATT&CK Lateral Tool Transfer Retrieved. 2019/10/27 | Enterprise ATT&CK Enterprise ATT&CK Lateral Tool Transfer Retrieved. 2019/10/27 Lateral Tool Transfer Retrieved. 2019/10/27 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Enterprise ATT&CK', 'description': 'Enterprise ATT&CK Enterprise ATT&CK Lateral Tool Transfer Retrieved. 2019/10/27 Lateral Tool Transfer Retrieved. 2019/10/27 ', 'url': 'https://attack.mitre.org/techniques/T1570/'} | |
[T0835] Manipulate I/O Image
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may manipulate the I/O image of PLCs through var | t | Adversaries may manipulate the I/O image of PLCs through var |
| ious means to prevent them from functioning as expected. Met | | ious means to prevent them from functioning as expected. Met |
| hods of I/O image manipulation may include overriding the I/ | | hods of I/O image manipulation may include overriding the I/ |
| O table via direct memory manipulation or using the override | | O table via direct memory manipulation or using the override |
| function used for testing PLC programs. (Citation: Dr. Kelv | | function used for testing PLC programs. (Citation: Dr. Kelv |
| in T. Erickson December 2010) During the scan cycle, a PLC r | | in T. Erickson December 2010) During the scan cycle, a PLC r |
| eads the status of all inputs and stores them in an image ta | | eads the status of all inputs and stores them in an image ta |
| ble. (Citation: Nanjundaiah, Vaidyanath) The image table is | | ble. (Citation: Nanjundaiah, Vaidyanath) The image table is |
| the PLCs internal storage location where values of inputs/ou | | the PLCs internal storage location where values of inputs/ou |
| tputs for one scan are stored while it executes the user pro | | tputs for one scan are stored while it executes the user pro |
| gram. After the PLC has solved the entire logic program, it | | gram. After the PLC has solved the entire logic program, it |
| updates the output image table. The contents of this output | | updates the output image table. The contents of this output |
| image table are written to the corresponding output points i | | image table are written to the corresponding output points i |
| n I/O Modules. One of the unique characteristics of PLCs is | | n I/O Modules. One of the unique characteristics of PLCs i |
| their ability to override the status of a physical discrete | | s their ability to override the status of a physical discret |
| input or to override the logic driving a physical output co | | e input or to override the logic driving a physical output c |
| il and force the output to a desired status. | | oil and force the output to a desired status. |
New Detections:
Dropped Detections:
- DS0040: Operational Databases (Device Alarm)
- DS0040: Operational Databases (Process History/Live Data)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.943000+00:00 | 2022-10-20 20:46:11.459000+00:00 |
| description | Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. (Citation: Dr. Kelvin T. Erickson December 2010) During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules. One of the unique characteristics of PLCs is their ability to override the status of a physical discrete input or to override the logic driving a physical output coil and force the output to a desired status. | Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. (Citation: Dr. Kelvin T. Erickson December 2010) During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
One of the unique characteristics of PLCs is their ability to override the status of a physical discrete input or to override the logic driving a physical output coil and force the output to a desired status. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0849] Masquerading
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0003: Scheduled Job (Scheduled Job Creation)
- DS0019: Service (Service Modification)
Dropped Detections:
- DS0003: Scheduled Job (Scheduled Job Metadata)
- DS0019: Service (Service Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.947000+00:00 | 2022-09-27 16:56:31.022000+00:00 |
| description | Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions. Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment. | Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions.
Applications and other files commonly found on Windows systems or in engineering workstations have been impersonated before. This can be as simple as renaming a file to effectively disguise it in the ICS environment. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0838] Modify Alarm Settings
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify alarm settings to prevent alerts that | t | Adversaries may modify alarm settings to prevent alerts that |
| may inform operators of their presence or to prevent respon | | may inform operators of their presence or to prevent respon |
| ses to dangerous and unintended scenarios. Reporting message | | ses to dangerous and unintended scenarios. Reporting message |
| s are a standard part of data acquisition in control systems | | s are a standard part of data acquisition in control systems |
| . Reporting messages are used as a way to transmit system st | | . Reporting messages are used as a way to transmit system st |
| ate information and acknowledgements that specific actions h | | ate information and acknowledgements that specific actions h |
| ave occurred. These messages provide vital information for t | | ave occurred. These messages provide vital information for t |
| he management of a physical process, and keep operators, eng | | he management of a physical process, and keep operators, eng |
| ineers, and administrators aware of the state of system devi | | ineers, and administrators aware of the state of system devi |
| ces and physical processes. If an adversary is able to chan | | ces and physical processes. If an adversary is able to cha |
| ge the reporting settings, certain events could be prevented | | nge the reporting settings, certain events could be prevente |
| from being reported. This type of modification can also pre | | d from being reported. This type of modification can also pr |
| vent operators or devices from performing actions to keep th | | event operators or devices from performing actions to keep t |
| e system in a safe state. If critical reporting messages can | | he system in a safe state. If critical reporting messages ca |
| not trigger these actions then a [[Impact]] could occur. In | | nnot trigger these actions then a [Impact](http://attacksite |
| ICS environments, the adversary may have to use [Alarm Supp | | .mitre.org/tactics/TA0105/) could occur. In ICS environmen |
| ression](https://attack.mitre.org/techniques/T0878) or conte | | ts, the adversary may have to use [Alarm Suppression](https: |
| nd with multiple alarms and/or alarm propagation to achieve | | //attack.mitre.org/techniques/T0878) or contend with multipl |
| a specific goal to evade detection or prevent intended respo | | e alarms and/or alarm propagation to achieve a specific goal |
| nses from occurring. (Citation: Jos Wetzels, Marina Krotofil | | to evade detection or prevent intended responses from occur |
| 2019) Methods of suppression often rely on modification of | | ring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods |
| alarm settings, such as modifying in memory code to fixed v | | of suppression often rely on modification of alarm settings |
| alues or tampering with assembly level instruction code. | | , such as modifying in memory code to fixed values or tamper |
| In the Maroochy Attack, the adversary disabled alarms at fou | | ing with assembly level instruction code. In the Maroochy |
| r pumping stations. This caused alarms to not be reported to | | Shire attack, the adversary disabled alarms at four pumping |
| the central computer. (Citation: Marshall Abrams July 2008) | | stations. This caused alarms to not be reported to the centr |
| | | al computer.(Citation: Marshall Abrams July 2008) |
New Detections:
- DS0039: Asset (Asset Inventory)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.949000+00:00 | 2022-10-20 18:14:48.212000+00:00 |
| description | Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes. If an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a [[Impact]] could occur. In ICS environments, the adversary may have to use [Alarm Suppression](https://attack.mitre.org/techniques/T0878) or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code. In the Maroochy Attack, the adversary disabled alarms at four pumping stations. This caused alarms to not be reported to the central computer. (Citation: Marshall Abrams July 2008) | Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes.
If an adversary is able to change the reporting settings, certain events could be prevented from being reported. This type of modification can also prevent operators or devices from performing actions to keep the system in a safe state. If critical reporting messages cannot trigger these actions then a [Impact](http://attacksite.mitre.org/tactics/TA0105/) could occur.
In ICS environments, the adversary may have to use [Alarm Suppression](https://attack.mitre.org/techniques/T0878) or contend with multiple alarms and/or alarm propagation to achieve a specific goal to evade detection or prevent intended responses from occurring. (Citation: Jos Wetzels, Marina Krotofil 2019) Methods of suppression often rely on modification of alarm settings, such as modifying in memory code to fixed values or tampering with assembly level instruction code.
In the Maroochy Shire attack, the adversary disabled alarms at four pumping stations. This caused alarms to not be reported to the central computer.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T0821] Modify Controller Tasking
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify the tasking of a controller to allow | t | Adversaries may modify the tasking of a controller to allow |
| for the execution of their own programs. This can allow an a | | for the execution of their own programs. This can allow an a |
| dversary to manipulate the execution flow and behavior of a | | dversary to manipulate the execution flow and behavior of a |
| controller. According to 61131-3, the association of a Task | | controller. According to 61131-3, the association of a Tas |
| with a Program Organization Unit (POU) defines a task assoc | | k with a Program Organization Unit (POU) defines a task asso |
| iation. (Citation: IEC February 2013) An adversary may modif | | ciation. (Citation: IEC February 2013) An adversary may modi |
| y these associations or create new ones to manipulate the ex | | fy these associations or create new ones to manipulate the e |
| ecution flow of a controller. Modification of controller tas | | xecution flow of a controller. Modification of controller ta |
| king can be accomplished using a Program Download in additio | | sking can be accomplished using a Program Download in additi |
| n to other types of program modification such as online edit | | on to other types of program modification such as online edi |
| and program append. Tasks have properties, such as interva | | t and program append. Tasks have properties, such as interv |
| l, frequency and priority to meet the requirements of progra | | al, frequency and priority to meet the requirements of progr |
| m execution. Some controller vendors implement tasks with im | | am execution. Some controller vendors implement tasks with i |
| plicit, pre-defined properties whereas others allow for thes | | mplicit, pre-defined properties whereas others allow for the |
| e properties to be formulated explicitly. An adversary may a | | se properties to be formulated explicitly. An adversary may |
| ssociate their program with tasks that have a higher priorit | | associate their program with tasks that have a higher priori |
| y or execute associated programs more frequently. For instan | | ty or execute associated programs more frequently. For insta |
| ce, to ensure cyclic execution of their program on a Siemens | | nce, to ensure cyclic execution of their program on a Siemen |
| controller, an adversary may add their program to the task, | | s controller, an adversary may add their program to the task |
| Organization Block 1 (OB1). | | , Organization Block 1 (OB1). |
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0039: Asset (Software)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0022: File (File Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.950000+00:00 | 2022-09-27 15:49:27.003000+00:00 |
| description | Adversaries may modify the tasking of a controller to allow for the execution of their own programs. This can allow an adversary to manipulate the execution flow and behavior of a controller. According to 61131-3, the association of a Task with a Program Organization Unit (POU) defines a task association. (Citation: IEC February 2013) An adversary may modify these associations or create new ones to manipulate the execution flow of a controller. Modification of controller tasking can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. Tasks have properties, such as interval, frequency and priority to meet the requirements of program execution. Some controller vendors implement tasks with implicit, pre-defined properties whereas others allow for these properties to be formulated explicitly. An adversary may associate their program with tasks that have a higher priority or execute associated programs more frequently. For instance, to ensure cyclic execution of their program on a Siemens controller, an adversary may add their program to the task, Organization Block 1 (OB1). | Adversaries may modify the tasking of a controller to allow for the execution of their own programs. This can allow an adversary to manipulate the execution flow and behavior of a controller.
According to 61131-3, the association of a Task with a Program Organization Unit (POU) defines a task association. (Citation: IEC February 2013) An adversary may modify these associations or create new ones to manipulate the execution flow of a controller. Modification of controller tasking can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append.
Tasks have properties, such as interval, frequency and priority to meet the requirements of program execution. Some controller vendors implement tasks with implicit, pre-defined properties whereas others allow for these properties to be formulated explicitly. An adversary may associate their program with tasks that have a higher priority or execute associated programs more frequently. For instance, to ensure cyclic execution of their program on a Siemens controller, an adversary may add their program to the task, Organization Block 1 (OB1). |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0836] Modify Parameter
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify parameters used to instruct industria | t | Adversaries may modify parameters used to instruct industria |
| l control system devices. These devices operate via programs | | l control system devices. These devices operate via programs |
| that dictate how and when to perform actions based on such | | that dictate how and when to perform actions based on such |
| parameters. Such parameters can determine the extent to whic | | parameters. Such parameters can determine the extent to whic |
| h an action is performed and may specify additional options. | | h an action is performed and may specify additional options. |
| For example, a program on a control system device dictating | | For example, a program on a control system device dictating |
| motor processes may take a parameter defining the total num | | motor processes may take a parameter defining the total num |
| ber of seconds to run that motor. An adversary can po | | ber of seconds to run that motor. An adversary can po |
| tentially modify these parameters to produce an outcome outs | | tentially modify these parameters to produce an outcome outs |
| ide of what was intended by the operators. By modifying syst | | ide of what was intended by the operators. By modifying syst |
| em and process critical parameters, the adversary may cause | | em and process critical parameters, the adversary may cause |
| [Impact](https://attack.mitre.org/tactics/TA0105) to equipme | | [Impact](https://attack.mitre.org/tactics/TA0105) to equipme |
| nt and/or control processes. Modified parameters may be turn | | nt and/or control processes. Modified parameters may be turn |
| ed into dangerous, out-of-bounds, or unexpected values from | | ed into dangerous, out-of-bounds, or unexpected values from |
| typical operations. For example, specifying that a process r | | typical operations. For example, specifying that a process r |
| un for more or less time than it should, or dictating an unu | | un for more or less time than it should, or dictating an unu |
| sually high, low, or invalid value as a parameter. In th | | sually high, low, or invalid value as a parameter. In the M |
| e Maroochy Attack, Vitek Boden gained remote computer access | | aroochy Shire attack, the adversary gained remote computer a |
| to the control system and altered data so that whatever fun | | ccess to the control system and altered data so that whateve |
| ction should have occurred at affected pumping stations did | | r function should have occurred at affected pumping stations |
| not occur or occurred in a different way. The software progr | | did not occur or occurred in a different way. The software |
| am installed in the laptop was one developed by Hunter Water | | program installed in the laptop was one developed for changi |
| tech for its use in changing configurations in the PDS compu | | ng configurations in the PDS computers. This ultimately led |
| ters. This ultimately led to 800,000 liters of raw sewage be | | to 800,000 liters of raw sewage being spilled out into the c |
| ing spilled out into the community. (Citation: Marshall Abra | | ommunity.(Citation: Marshall Abrams July 2008) |
| ms July 2008) In the Oldsmar water treatment attack, adve | | |
| rsaries raised the sodium hydroxide setpoint value from 100 | | |
| part-per-million (ppm) to 11,100 ppm, far beyond normal oper | | |
| ating levels. (Citation: Pinellas County Sheriffs Office Feb | | |
| ruary 2021) | | |
New Detections:
- DS0039: Asset (Asset Inventory)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 12:09:05.073000+00:00 | 2022-10-20 18:13:48.146000+00:00 |
| description | Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.
An adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause [Impact](https://attack.mitre.org/tactics/TA0105) to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter.
In the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed by Hunter Watertech for its use in changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. (Citation: Marshall Abrams July 2008)
In the Oldsmar water treatment attack, adversaries raised the sodium hydroxide setpoint value from 100 part-per-million (ppm) to 11,100 ppm, far beyond normal operating levels. (Citation: Pinellas County Sheriffs Office February 2021) | Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.
An adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause [Impact](https://attack.mitre.org/tactics/TA0105) to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter.
In the Maroochy Shire attack, the adversary gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. The software program installed in the laptop was one developed for changing configurations in the PDS computers. This ultimately led to 800,000 liters of raw sewage being spilled out into the community.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Pinellas County Sheriffs Office February 2021', 'description': 'Pinellas County Sheriffs Office 2021, February 8 Treatment Plant Intrusion Press Conference Retrieved. 2021/10/08 ', 'url': 'https://www.youtube.com/watch?v=MkXDSOgLQ6M'} | |
[T0889] Modify Program
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0029: Network Traffic (Network Traffic Content)
- DS0039: Asset (Software)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0022: File (File Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.953000+00:00 | 2022-09-27 16:08:15.574000+00:00 |
| description | Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. Program modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU) (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. Some programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities. | Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append.
Program modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU) (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another.
Some programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0839] Module Firmware
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 11:51:30.717000+00:00 | 2022-09-26 18:41:49.037000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0840] Network Connection Enumeration
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0012: Script (Script Execution)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:24:49.040000+00:00 | 2022-09-27 17:22:27.357000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0861] Point & Tag Identification
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.960000+00:00 | 2022-09-26 15:24:07.480000+00:00 |
| description | Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment. Points may be values such as inputs, memory locations, outputs or other process specific variables. (Citation: Dennis L. Sloatman September 2016) Tags are the identifiers given to points for operator convenience. Collecting such tags provides valuable context to environmental points and enables an adversary to map inputs, outputs, and other values to their control processes. Understanding the points being collected may inform an adversary on which processes and values to keep track of over the course of an operation. | Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment. Points may be values such as inputs, memory locations, outputs or other process specific variables. (Citation: Dennis L. Sloatman September 2016) Tags are the identifiers given to points for operator convenience.
Collecting such tags provides valuable context to environmental points and enables an adversary to map inputs, outputs, and other values to their control processes. Understanding the points being collected may inform an adversary on which processes and values to keep track of over the course of an operation. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Benjamin Green', 'description': 'Benjamin Green Dennis L. Sloatman 2016, September 16 Understanding PLC Programming Methods and the Tag Database System Retrieved. 2017/12/19 On the Significance of Process Comprehension for Conducting Targeted ICS Attacks Retrieved. 2019/11/01 ', 'url': 'http://www.research.lancs.ac.uk/portal/files/196578358/sample_sigconf.pdf'} | |
[T0843] Program Download
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may perform a program download to transfer a use | t | Adversaries may perform a program download to transfer a use |
| r program to a controller. Variations of program download, | | r program to a controller. Variations of program download, |
| such as online edit and program append, allow a controller | | such as online edit and program append, allow a controller |
| to continue running during the transfer and reconfiguration | | to continue running during the transfer and reconfiguration |
| process without interruption to process control. However, be | | process without interruption to process control. However, be |
| fore starting a full program download (i.e., download all) a | | fore starting a full program download (i.e., download all) a |
| controller may need to go into a stop state. This can have | | controller may need to go into a stop state. This can have |
| negative consequences on the physical process, especially if | | negative consequences on the physical process, especially if |
| the controller is not able to fulfill a time-sensitive acti | | the controller is not able to fulfill a time-sensitive acti |
| on. Adversaries may choose to avoid a download all in favor | | on. Adversaries may choose to avoid a download all in favor |
| of an online edit or program append to avoid disrupting the | | of an online edit or program append to avoid disrupting the |
| physical process. An adversary may need to use the technique | | physical process. An adversary may need to use the technique |
| Detect Operating Mode or Change Operating Mode to make sure | | Detect Operating Mode or Change Operating Mode to make sure |
| the controller is in the proper mode to accept a program do | | the controller is in the proper mode to accept a program do |
| wnload. The granularity of control to transfer a user pro | | wnload. The granularity of control to transfer a user progr |
| gram in whole or parts is dictated by the management protoco | | am in whole or parts is dictated by the management protocol |
| l (e.g., S7CommPlus, TriStation) and underlying controller A | | (e.g., S7CommPlus, TriStation) and underlying controller API |
| PI. Thus, program download is a high-level term for the suit | | . Thus, program download is a high-level term for the suite |
| e of vendor-specific API calls used to configure a controlle | | of vendor-specific API calls used to configure a controllers |
| rs user program memory space. [Modify Controller Tasking] | | user program memory space. [Modify Controller Tasking](h |
| (https://attack.mitre.org/techniques/T0821) and [Modify Prog | | ttps://attack.mitre.org/techniques/T0821) and [Modify Progra |
| ram](https://attack.mitre.org/techniques/T0889) represent th | | m](https://attack.mitre.org/techniques/T0889) represent the |
| e configuration changes that are transferred to a controller | | configuration changes that are transferred to a controller v |
| via a program download. | | ia a program download. |
New Detections:
- DS0039: Asset (Asset Inventory)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.960000+00:00 | 2022-09-26 16:25:38.670000+00:00 |
| description | Adversaries may perform a program download to transfer a user program to a controller. Variations of program download, such as online edit and program append, allow a controller to continue running during the transfer and reconfiguration process without interruption to process control. However, before starting a full program download (i.e., download all) a controller may need to go into a stop state. This can have negative consequences on the physical process, especially if the controller is not able to fulfill a time-sensitive action. Adversaries may choose to avoid a download all in favor of an online edit or program append to avoid disrupting the physical process. An adversary may need to use the technique Detect Operating Mode or Change Operating Mode to make sure the controller is in the proper mode to accept a program download. The granularity of control to transfer a user program in whole or parts is dictated by the management protocol (e.g., S7CommPlus, TriStation) and underlying controller API. Thus, program download is a high-level term for the suite of vendor-specific API calls used to configure a controllers user program memory space. [Modify Controller Tasking](https://attack.mitre.org/techniques/T0821) and [Modify Program](https://attack.mitre.org/techniques/T0889) represent the configuration changes that are transferred to a controller via a program download. | Adversaries may perform a program download to transfer a user program to a controller.
Variations of program download, such as online edit and program append, allow a controller to continue running during the transfer and reconfiguration process without interruption to process control. However, before starting a full program download (i.e., download all) a controller may need to go into a stop state. This can have negative consequences on the physical process, especially if the controller is not able to fulfill a time-sensitive action. Adversaries may choose to avoid a download all in favor of an online edit or program append to avoid disrupting the physical process. An adversary may need to use the technique Detect Operating Mode or Change Operating Mode to make sure the controller is in the proper mode to accept a program download.
The granularity of control to transfer a user program in whole or parts is dictated by the management protocol (e.g., S7CommPlus, TriStation) and underlying controller API. Thus, program download is a high-level term for the suite of vendor-specific API calls used to configure a controllers user program memory space.
[Modify Controller Tasking](https://attack.mitre.org/techniques/T0821) and [Modify Program](https://attack.mitre.org/techniques/T0889) represent the configuration changes that are transferred to a controller via a program download. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0886] Remote Services
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may leverage remote services to move between ass | t | Adversaries may leverage remote services to move between ass |
| ets and network segments. These services are often used to a | | ets and network segments. These services are often used to a |
| llow operators to interact with systems remotely within the | | llow operators to interact with systems remotely within the |
| network, some examples are RDP, SMB, SSH, and other similar | | network, some examples are RDP, SMB, SSH, and other similar |
| mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krot | | mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krot |
| ofil, Dan Scali, Nathan Brubaker, Christopher Glyer December | | ofil, Dan Scali, Nathan Brubaker, Christopher Glyer December |
| 2017) (Citation: Dragos December 2017) (Citation: Joe Slowi | | 2017) (Citation: Dragos December 2017) (Citation: Joe Slowi |
| k April 2019) Remote services could be used to support remo | | k April 2019) Remote services could be used to support rem |
| te access, data transmission, authentication, name resolutio | | ote access, data transmission, authentication, name resoluti |
| n, and other remote functions. Further, remote services may | | on, and other remote functions. Further, remote services may |
| be necessary to allow operators and administrators to config | | be necessary to allow operators and administrators to confi |
| ure systems within the network from their engineering or man | | gure systems within the network from their engineering or ma |
| agement workstations. An adversary may use this technique to | | nagement workstations. An adversary may use this technique t |
| access devices which may be dual-homed (Citation: Blake Joh | | o access devices which may be dual-homed (Citation: Blake Jo |
| nson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker | | hnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubake |
| , Christopher Glyer December 2017) to multiple network segme | | r, Christopher Glyer December 2017) to multiple network segm |
| nts, and can be used for [Program Download](https://attack.m | | ents, and can be used for [Program Download](https://attack. |
| itre.org/techniques/T0843) or to execute attacks on control | | mitre.org/techniques/T0843) or to execute attacks on control |
| devices directly through [Valid Accounts](https://attack.mit | | devices directly through [Valid Accounts](https://attack.mi |
| re.org/techniques/T0859). Specific remote services (RDP & V | | tre.org/techniques/T0859). Specific remote services (RDP & |
| NC) may be a precursor to enable [Graphical User Interface]( | | VNC) may be a precursor to enable [Graphical User Interface] |
| https://attack.mitre.org/techniques/T0823) execution on devi | | (https://attack.mitre.org/techniques/T0823) execution on dev |
| ces such as HMIs or engineering workstation software. In th | | ices such as HMIs or engineering workstation software. Base |
| e Oldsmar water treatment attack, adversaries gained access | | d on incident data, CISA and FBI assessed that Chinese state |
| to the system through remote access software, allowing for t | | -sponsored actors also compromised various authorized remote |
| he use of the standard operator HMI interface. (Citation: Pi | | access channels, including systems designed to transfer dat |
| nellas County Sheriffs Office February 2021) Based on incid | | a and/or allow access between corporate and ICS networks. ( |
| ent data, CISA and FBI assessed that Chinese state-sponsored | | Citation: CISA AA21-201A Pipeline Intrusion July 2021) |
| actors also compromised various authorized remote access ch | | |
| annels, including systems designed to transfer data and/or a | | |
| llow access between corporate and ICS networks. (Citation: | | |
| CISA AA21-201A Pipeline Intrusion July 2021) | | |
New Detections:
- DS0011: Module (Module Load)
Dropped Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.967000+00:00 | 2022-09-30 15:01:43.553000+00:00 |
| description | Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: Joe Slowik April 2019) Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) to multiple network segments, and can be used for [Program Download](https://attack.mitre.org/techniques/T0843) or to execute attacks on control devices directly through [Valid Accounts](https://attack.mitre.org/techniques/T0859). Specific remote services (RDP & VNC) may be a precursor to enable [Graphical User Interface](https://attack.mitre.org/techniques/T0823) execution on devices such as HMIs or engineering workstation software. In the Oldsmar water treatment attack, adversaries gained access to the system through remote access software, allowing for the use of the standard operator HMI interface. (Citation: Pinellas County Sheriffs Office February 2021) Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) | Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: Joe Slowik April 2019)
Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) to multiple network segments, and can be used for [Program Download](https://attack.mitre.org/techniques/T0843) or to execute attacks on control devices directly through [Valid Accounts](https://attack.mitre.org/techniques/T0859).
Specific remote services (RDP & VNC) may be a precursor to enable [Graphical User Interface](https://attack.mitre.org/techniques/T0823) execution on devices such as HMIs or engineering workstation software.
Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['source_name'] | Dragos December 2017 | CISA AA21-201A Pipeline Intrusion July 2021 |
| external_references[2]['description'] | Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 | Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 |
| external_references[2]['url'] | https://dragos.com/blog/trisis/TRISIS-01.pdf | https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf |
| external_references[3]['source_name'] | Joe Slowik April 2019 | Dragos December 2017 |
| external_references[3]['description'] | Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 | Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 |
| external_references[3]['url'] | https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/ | https://dragos.com/blog/trisis/TRISIS-01.pdf |
| external_references[4]['source_name'] | Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017 | Joe Slowik April 2019 |
| external_references[4]['description'] | Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer 2017, December 14 Attackers Deploy New ICS Attack Framework TRITON and Cause Operational Disruption to Critical Infrastructure Retrieved. 2018/01/12 | Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27 |
| external_references[4]['url'] | https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html | https://dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/ |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Pinellas County Sheriffs Office February 2021', 'description': 'Pinellas County Sheriffs Office 2021, February 8 Treatment Plant Intrusion Press Conference Retrieved. 2021/10/08 ', 'url': 'https://www.youtube.com/watch?v=MkXDSOgLQ6M'} | |
| external_references | {'source_name': 'CISA AA21-201A Pipeline Intrusion July 2021', 'description': 'Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 ', 'url': 'https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf'} | |
[T0846] Remote System Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
- DS0029: Network Traffic (Network Traffic Flow)
Dropped Detections:
- DS0017: Command (Command Execution)
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.968000+00:00 | 2022-09-30 15:34:29.457000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0888] Remote System Information Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | An adversary may attempt to get detailed information about r | t | An adversary may attempt to get detailed information about r |
| emote systems and their peripherals, such as make/model, rol | | emote systems and their peripherals, such as make/model, rol |
| e, and configuration. Adversaries may use information from R | | e, and configuration. Adversaries may use information from R |
| emote System Information Discovery to aid in targeting and s | | emote System Information Discovery to aid in targeting and s |
| haping follow-on behaviors. For example, the systems operati | | haping follow-on behaviors. For example, the systems operati |
| onal role and model information can dictate whether it is a | | onal role and model information can dictate whether it is a |
| relevant target for the adversarys operational objectives. I | | relevant target for the adversary's operational objectives. |
| n addition, the systems configuration may be used to scope s | | In addition, the systems configuration may be used to scope |
| ubsequent technique usage. Requests for system information | | subsequent technique usage. Requests for system informatio |
| are typically implemented using automation and management p | | n are typically implemented using automation and management |
| rotocols and are often automatically requested by vendor sof | | protocols and are often automatically requested by vendor so |
| tware during normal operation. This information may be used | | ftware during normal operation. This information may be used |
| to tailor management actions, such as program download and s | | to tailor management actions, such as program download and |
| ystem or module firmware. An adversary may leverage this sam | | system or module firmware. An adversary may leverage this sa |
| e information by issuing calls directly to the systems API. | | me information by issuing calls directly to the systems API. |
New Detections:
- DS0009: Process (Process Creation)
- DS0022: File (File Access)
- DS0029: Network Traffic (Network Traffic Flow)
Dropped Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.968000+00:00 | 2022-09-26 14:40:01.435000+00:00 |
| description | An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration. Adversaries may use information from Remote System Information Discovery to aid in targeting and shaping follow-on behaviors. For example, the systems operational role and model information can dictate whether it is a relevant target for the adversarys operational objectives. In addition, the systems configuration may be used to scope subsequent technique usage. Requests for system information are typically implemented using automation and management protocols and are often automatically requested by vendor software during normal operation. This information may be used to tailor management actions, such as program download and system or module firmware. An adversary may leverage this same information by issuing calls directly to the systems API. | An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration. Adversaries may use information from Remote System Information Discovery to aid in targeting and shaping follow-on behaviors. For example, the systems operational role and model information can dictate whether it is a relevant target for the adversary's operational objectives. In addition, the systems configuration may be used to scope subsequent technique usage.
Requests for system information are typically implemented using automation and management protocols and are often automatically requested by vendor software during normal operation. This information may be used to tailor management actions, such as program download and system or module firmware. An adversary may leverage this same information by issuing calls directly to the systems API. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0848] Rogue Master
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may setup a rogue master to leverage control ser | t | Adversaries may setup a rogue master to leverage control ser |
| ver functions to communicate with outstations. A rogue maste | | ver functions to communicate with outstations. A rogue maste |
| r can be used to send legitimate control messages to other c | | r can be used to send legitimate control messages to other c |
| ontrol system devices, affecting processes in unintended way | | ontrol system devices, affecting processes in unintended way |
| s. It may also be used to disrupt network communications by | | s. It may also be used to disrupt network communications by |
| capturing and receiving the network traffic meant for the ac | | capturing and receiving the network traffic meant for the ac |
| tual master. Impersonating a master may also allow an advers | | tual master. Impersonating a master may also allow an advers |
| ary to avoid detection. In the Maroochy Attack, Vitek Bode | | ary to avoid detection. In the Maroochy Shire attack, the |
| n falsified network addresses in order to send false data an | | adversary falsified network addresses in order to send false |
| d instructions to pumping stations. (Citation: Marshall Abra | | data and instructions to pumping stations.(Citation: Marsha |
| ms July 2008) In the case of the 2017 Dallas Siren incident | | ll Abrams July 2008) In the case of the 2017 Dallas Siren i |
| , adversaries used a rogue master to send command messages t | | ncident, adversaries used a rogue master to send command mes |
| o the 156 distributed sirens across the city, either through | | sages to the 156 distributed sirens across the city, either |
| a single rogue transmitter with a strong signal, or using m | | through a single rogue transmitter with a strong signal, or |
| any distributed repeaters. (Citation: Bastille April 2017) ( | | using many distributed repeaters. (Citation: Bastille April |
| Citation: Zack Whittaker April 2017) | | 2017) (Citation: Zack Whittaker April 2017) |
New Detections:
- DS0039: Asset (Asset Inventory)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0040: Operational Databases (Process/Event Alarm)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.975000+00:00 | 2022-10-20 18:11:21.376000+00:00 |
| description | Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection. In the Maroochy Attack, Vitek Boden falsified network addresses in order to send false data and instructions to pumping stations. (Citation: Marshall Abrams July 2008) In the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017) | Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection.
In the Maroochy Shire attack, the adversary falsified network addresses in order to send false data and instructions to pumping stations.(Citation: Marshall Abrams July 2008)
In the case of the 2017 Dallas Siren incident, adversaries used a rogue master to send command messages to the 156 distributed sirens across the city, either through a single rogue transmitter with a strong signal, or using many distributed repeaters. (Citation: Bastille April 2017) (Citation: Zack Whittaker April 2017) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Marshall Abrams July 2008 | Bastille April 2017 |
| external_references[1]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 |
| external_references[1]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack |
| external_references[2]['source_name'] | Bastille April 2017 | Marshall Abrams July 2008 |
| external_references[2]['description'] | Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[2]['url'] | https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T0851] Rootkit
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may deploy rootkits to hide the presence of prog | t | Adversaries may deploy rootkits to hide the presence of prog |
| rams, files, network connections, services, drivers, and oth | | rams, files, network connections, services, drivers, and oth |
| er system components. Rootkits are programs that hide the ex | | er system components. Rootkits are programs that hide the ex |
| istence of malware by intercepting and modifying operating-s | | istence of malware by intercepting and modifying operating-s |
| ystem API calls that supply system information. Rootkits or | | ystem API calls that supply system information. Rootkits or |
| rootkit-enabling functionality may reside at the user or ker | | rootkit-enabling functionality may reside at the user or ker |
| nel level in the operating system, or lower. (Citation: Ente | | nel level in the operating system, or lower. (Citation: Ente |
| rprise ATT&CK January 2018) Firmware rootkits that affec | | rprise ATT&CK January 2018) Firmware rootkits that affec |
| t the operating system yield nearly full control of the syst | | t the operating system yield nearly full control of the syst |
| em. While firmware rootkits are normally developed for the m | | em. While firmware rootkits are normally developed for the m |
| ain processing board, they can also be developed for I/O T11 | | ain processing board, they can also be developed for the I/O |
| 09 that can be attached to the asset. Compromise of this fir | | that is attached to an asset. Compromise of this firmware a |
| mware allows the modification of all of the process variable | | llows the modification of all of the process variables and f |
| s and functions the module engages in. This may result in co | | unctions the module engages in. This may result in commands |
| mmands being disregarded and false information being fed to | | being disregarded and false information being fed to the mai |
| the main device. By tampering with device processes, an adve | | n device. By tampering with device processes, an adversary m |
| rsary may inhibit its expected response functions and possib | | ay inhibit its expected response functions and possibly enab |
| ly enable [Impact](https://attack.mitre.org/tactics/TA0105). | | le [Impact](https://attack.mitre.org/tactics/TA0105). |
Dropped Detections:
- DS0011: Module (Module Load)
- DS0016: Drive (Drive Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 12:13:28.790000+00:00 | 2022-10-20 20:44:34.980000+00:00 |
| description | Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. (Citation: Enterprise ATT&CK January 2018)
Firmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for I/O T1109 that can be attached to the asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable [Impact](https://attack.mitre.org/tactics/TA0105). | Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. (Citation: Enterprise ATT&CK January 2018)
Firmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for the I/O that is attached to an asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable [Impact](https://attack.mitre.org/tactics/TA0105). |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0865] Spearphishing Attachment
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may use a spearphishing attachment, a variant of | t | Adversaries may use a spearphishing attachment, a variant of |
| spearphishing, as a form of a social engineering attack aga | | spearphishing, as a form of a social engineering attack aga |
| inst specific targets. Spearphishing attachments are differe | | inst specific targets. Spearphishing attachments are differe |
| nt from other forms of spearphishing in that they employ mal | | nt from other forms of spearphishing in that they employ mal |
| ware attached to an email. All forms of spearphishing are el | | ware attached to an email. All forms of spearphishing are el |
| ectronically delivered and target a specific individual, com | | ectronically delivered and target a specific individual, com |
| pany, or industry. In this scenario, adversaries attach a fi | | pany, or industry. In this scenario, adversaries attach a fi |
| le to the spearphishing email and usually rely upon [User Ex | | le to the spearphishing email and usually rely upon [User Ex |
| ecution](https://attack.mitre.org/techniques/T0863) to gain | | ecution](https://attack.mitre.org/techniques/T0863) to gain |
| execution and access. (Citation: Enterprise ATT&CK October 2 | | execution and access. (Citation: Enterprise ATT&CK October 2 |
| 019) A Chinese spearphishing campaign running from December | | 019) A Chinese spearphishing campaign running from Decembe |
| 9, 2011 through February 29, 2012, targeted ONG organizatio | | r 9, 2011 through February 29, 2012, targeted ONG organizati |
| ns and their employees. The emails were constructed with a h | | ons and their employees. The emails were constructed with a |
| igh level of sophistication to convince employees to open th | | high level of sophistication to convince employees to open t |
| e malicious file attachments. (Citation: CISA AA21-201A Pipe | | he malicious file attachments. (Citation: CISA AA21-201A Pip |
| line Intrusion July 2021) | | eline Intrusion July 2021) |
New Detections:
- DS0009: Process (Process Creation)
- DS0022: File (File Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.980000+00:00 | 2022-09-27 15:22:37.964000+00:00 |
| description | Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T0863) to gain execution and access. (Citation: Enterprise ATT&CK October 2019) A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012, targeted ONG organizations and their employees. The emails were constructed with a high level of sophistication to convince employees to open the malicious file attachments. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) | Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T0863) to gain execution and access. (Citation: Enterprise ATT&CK October 2019)
A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012, targeted ONG organizations and their employees. The emails were constructed with a high level of sophistication to convince employees to open the malicious file attachments. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Enterprise ATT&CK October 2019 | CISA AA21-201A Pipeline Intrusion July 2021 |
| external_references[1]['description'] | Enterprise ATT&CK 2019, October 25 Spearphishing Attachment Retrieved. 2019/10/25 | Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 |
| external_references[1]['url'] | https://attack.mitre.org/techniques/T1193/ | https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf |
| external_references[2]['source_name'] | CISA AA21-201A Pipeline Intrusion July 2021 | Enterprise ATT&CK October 2019 |
| external_references[2]['description'] | Department of Justice (DOJ), DHS Cybersecurity & Infrastructure Security Agency (CISA) 2021, July 20 Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013 Retrieved. 2021/10/08 | Enterprise ATT&CK 2019, October 25 Spearphishing Attachment Retrieved. 2019/10/25 |
| external_references[2]['url'] | https://us-cert.cisa.gov/sites/default/files/publications/AA21-201A_Chinese_Gas_Pipeline_Intrusion_Campaign_2011_to_2013%20(1).pdf | https://attack.mitre.org/techniques/T1193/ |
| x_mitre_version | 1.0 | 1.1 |
[T0856] Spoof Reporting Message
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may spoof reporting messages in control system e | t | Adversaries may spoof reporting messages in control system e |
| nvironments for evasion and to impair process control. In co | | nvironments for evasion and to impair process control. In co |
| ntrol systems, reporting messages contain telemetry data (e. | | ntrol systems, reporting messages contain telemetry data (e. |
| g., I/O values) pertaining to the current state of equipment | | g., I/O values) pertaining to the current state of equipment |
| and the industrial process. Reporting messages are importan | | and the industrial process. Reporting messages are importan |
| t for monitoring the normal operation of a system or identif | | t for monitoring the normal operation of a system or identif |
| ying important events such as deviations from expected value | | ying important events such as deviations from expected value |
| s. If an adversary has the ability to Spoof Reporting Messa | | s. If an adversary has the ability to Spoof Reporting Mess |
| ges, they can impact the control system in many ways. The ad | | ages, they can impact the control system in many ways. The a |
| versary can Spoof Reporting Messages that state that the pro | | dversary can Spoof Reporting Messages that state that the pr |
| cess is operating normally, as a form of evasion. The advers | | ocess is operating normally, as a form of evasion. The adver |
| ary could also Spoof Reporting Messages to make the defender | | sary could also Spoof Reporting Messages to make the defende |
| s and operators think that other errors are occurring in ord | | rs and operators think that other errors are occurring in or |
| er to distract them from the actual source of a problem. (Ci | | der to distract them from the actual source of a problem. (C |
| tation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) I | | itation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) |
| n the Maroochy Attack, the adversary used a dedicated analog | | In the Maroochy Shire attack, the adversary used a dedicated |
| two-way radio system to send false data and instructions to | | analog two-way radio system to send false data and instruct |
| pumping stations and the central computer. (Citation: Marsh | | ions to pumping stations and the central computer.(Citation: |
| all Abrams July 2008) | | Marshall Abrams July 2008) |
New Detections:
- DS0024: Windows Registry (Windows Registry Key Modification)
- DS0029: Network Traffic (Network Traffic Flow)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.981000+00:00 | 2022-10-20 18:16:21.548000+00:00 |
| description | Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values. If an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) In the Maroochy Attack, the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer. (Citation: Marshall Abrams July 2008) | Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values.
If an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
In the Maroochy Shire attack, the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T0862] Supply Chain Compromise
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may perform supply chain compromise to gain cont | t | Adversaries may perform supply chain compromise to gain cont |
| rol systems environment access by means of infected products | | rol systems environment access by means of infected products |
| , software, and workflows. Supply chain compromise is the ma | | , software, and workflows. Supply chain compromise is the ma |
| nipulation of products, such as devices or software, or thei | | nipulation of products, such as devices or software, or thei |
| r delivery mechanisms before receipt by the end consumer. Ad | | r delivery mechanisms before receipt by the end consumer. Ad |
| versary compromise of these products and mechanisms is done | | versary compromise of these products and mechanisms is done |
| for the goal of data or system compromise, once infected pro | | for the goal of data or system compromise, once infected pro |
| ducts are introduced to the target environment. Supply cha | | ducts are introduced to the target environment. Supply cha |
| in compromise can occur at all stages of the supply chain, f | | in compromise can occur at all stages of the supply chain, f |
| rom manipulation of development tools and environments to ma | | rom manipulation of development tools and environments to ma |
| nipulation of developed products and tools distribution mech | | nipulation of developed products and tools distribution mech |
| anisms. This may involve the compromise and replacement of l | | anisms. This may involve the compromise and replacement of l |
| egitimate software and patches, such as on third party or ve | | egitimate software and patches, such as on third party or ve |
| ndor websites. Targeting of supply chain compromise can be d | | ndor websites. Targeting of supply chain compromise can be d |
| one in attempts to infiltrate the environments of a specific | | one in attempts to infiltrate the environments of a specific |
| audience. In control systems environments with assets in bo | | audience. In control systems environments with assets in bo |
| th the IT and OT networks, it is possible a supply chain com | | th the IT and OT networks, it is possible a supply chain com |
| promise affecting the IT environment could enable further ac | | promise affecting the IT environment could enable further ac |
| cess to the OT environment. Counterfeit devices may be int | | cess to the OT environment. Counterfeit devices may be i |
| roduced to the global supply chain posing safety and cyber r | | ntroduced to the global supply chain posing safety and cyber |
| isks to asset owners and operators. These devices may not me | | risks to asset owners and operators. These devices may not |
| et the safety, engineering and manufacturing requirements of | | meet the safety, engineering and manufacturing requirements |
| regulatory bodies but may feature tagging indicating confor | | of regulatory bodies but may feature tagging indicating conf |
| mance with industry standards. Due to the lack of adherence | | ormance with industry standards. Due to the lack of adherenc |
| to standards and overall lesser quality, the counterfeit pro | | e to standards and overall lesser quality, the counterfeit p |
| ducts may pose a serious safety and operational risk. (Citat | | roducts may pose a serious safety and operational risk. (Cit |
| ion: Control Global May 2019) Yokogawa identified instance | | ation: Control Global May 2019) Yokogawa identified instan |
| s in which their customers received counterfeit differential | | ces in which their customers received counterfeit differenti |
| pressure transmitters using the Yokogawa logo. The counterf | | al pressure transmitters using the Yokogawa logo. The counte |
| eit transmitters were nearly indistinguishable with a sembla | | rfeit transmitters were nearly indistinguishable with a semb |
| nce of functionality and interface that mimics the genuine p | | lance of functionality and interface that mimics the genuine |
| roduct. (Citation: Control Global May 2019) F-Secure Labs | | product. (Citation: Control Global May 2019) F-Secure Lab |
| analyzed the approach the adversary used to compromise victi | | s analyzed the approach the adversary used to compromise vic |
| m systems with Havex. (Citation: Daavid Hentunen, Antti Tikk | | tim systems with Havex. (Citation: Daavid Hentunen, Antti Ti |
| anen June 2014) The adversary planted trojanized software in | | kkanen June 2014) The adversary planted trojanized software |
| stallers available on legitimate ICS/SCADA vendor websites. | | installers available on legitimate ICS/SCADA vendor websites |
| After being downloaded, this software infected the host comp | | . After being downloaded, this software infected the host co |
| uter with a Remote Access Trojan (RAT). | | mputer with a Remote Access Trojan (RAT). |
New Detections:
- DS0022: File (File Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.983000+00:00 | 2022-09-27 15:25:50.699000+00:00 |
| description | Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment. Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment. Counterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. (Citation: Control Global May 2019) Yokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. (Citation: Control Global May 2019) F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT). | Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment.
Supply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.
Counterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. (Citation: Control Global May 2019)
Yokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. (Citation: Control Global May 2019)
F-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT). |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['source_name'] | Control Global May 2019 | Daavid Hentunen, Antti Tikkanen June 2014 |
| external_references[2]['description'] | Control Global 2019, May 29 Yokogawa announcement warns of counterfeit transmitters Retrieved. 2021/04/09 | Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 |
| external_references[2]['url'] | https://www.controlglobal.com/industrynews/2019/yokogawa-announcement-warns-of-counterfeit-transmitters/ | https://www.f-secure.com/weblog/archives/00002718.html |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Daavid Hentunen, Antti Tikkanen June 2014', 'description': 'Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ', 'url': 'https://www.f-secure.com/weblog/archives/00002718.html'} | |
| external_references | {'source_name': 'F-Secure Labs June 2014', 'description': 'F-Secure Labs 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/10/21 ', 'url': 'https://www.f-secure.com/weblog/archives/00002718.html'} | |
[T0857] System Firmware
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | System firmware on modern assets is often designed with an u | t | System firmware on modern assets is often designed with an u |
| pdate feature. Older device firmware may be factory installe | | pdate feature. Older device firmware may be factory installe |
| d and require special reprograming equipment. When available | | d and require special reprograming equipment. When available |
| , the firmware update feature enables vendors to remotely pa | | , the firmware update feature enables vendors to remotely pa |
| tch bugs and perform upgrades. Device firmware updates are o | | tch bugs and perform upgrades. Device firmware updates are o |
| ften delegated to the user and may be done using a software | | ften delegated to the user and may be done using a software |
| update package. It may also be possible to perform this task | | update package. It may also be possible to perform this task |
| over the network. An adversary may exploit the firmware up | | over the network. An adversary may exploit the firmware u |
| date feature on accessible devices to upload malicious or ou | | pdate feature on accessible devices to upload malicious or o |
| t-of-date firmware. Malicious modification of device firmwar | | ut-of-date firmware. Malicious modification of device firmwa |
| e may provide an adversary with root access to a device, giv | | re may provide an adversary with root access to a device, gi |
| en firmware is one of the lowest programming abstraction lay | | ven firmware is one of the lowest programming abstraction la |
| ers. (Citation: Basnight, Zachry, et al.) | | yers. (Citation: Basnight, Zachry, et al.) |
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0040: Operational Databases (Device Alarm)
Dropped Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.984000+00:00 | 2022-09-26 17:14:52.590000+00:00 |
| description | System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network. An adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers. (Citation: Basnight, Zachry, et al.) | System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network.
An adversary may exploit the firmware update feature on accessible devices to upload malicious or out-of-date firmware. Malicious modification of device firmware may provide an adversary with root access to a device, given firmware is one of the lowest programming abstraction layers. (Citation: Basnight, Zachry, et al.) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0864] Transient Cyber Asset
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may target devices that are transient across ICS | t | Adversaries may target devices that are transient across ICS |
| networks and external networks. Normally, transient assets | | networks and external networks. Normally, transient assets |
| are brought into an environment by authorized personnel and | | are brought into an environment by authorized personnel and |
| do not remain in that environment on a permanent basis. (Cit | | do not remain in that environment on a permanent basis. (Cit |
| ation: North American Electric Reliability Corporation June | | ation: North American Electric Reliability Corporation June |
| 2021) Transient assets are commonly needed to support manage | | 2021) Transient assets are commonly needed to support manage |
| ment functions and may be more common in systems where a rem | | ment functions and may be more common in systems where a rem |
| otely managed asset is not feasible, external connections fo | | otely managed asset is not feasible, external connections fo |
| r remote access do not exist, or 3rd party contractor/vendor | | r remote access do not exist, or 3rd party contractor/vendor |
| access is required. Adversaries may take advantage of tran | | access is required. Adversaries may take advantage of tra |
| sient assets in different ways. For instance, adversaries ma | | nsient assets in different ways. For instance, adversaries m |
| y target a transient asset when it is connected to an extern | | ay target a transient asset when it is connected to an exter |
| al network and then leverage its trusted access in another e | | nal network and then leverage its trusted access in another |
| nvironment to launch an attack. They may also take advantage | | environment to launch an attack. They may also take advantag |
| of installed applications and libraries that are used by le | | e of installed applications and libraries that are used by l |
| gitimate end-users to interact with control system devices. | | egitimate end-users to interact with control system devices. |
| Transient assets, in some cases, may not be deployed with a | | Transient assets, in some cases, may not be deployed with |
| secure configuration leading to weaknesses that could allow | | a secure configuration leading to weaknesses that could all |
| an adversary to propagate malicious executable code, e.g., | | ow an adversary to propagate malicious executable code, e.g. |
| the transient asset may be infected by malware and when conn | | , the transient asset may be infected by malware and when co |
| ected to an ICS environment the malware propagates onto othe | | nnected to an ICS environment the malware propagates onto ot |
| r systems. In the Maroochy attack, the adversary utilized a | | her systems. In the Maroochy Shire attack, the adversary u |
| computer, possibly stolen, with proprietary engineering sof | | tilized a computer, possibly stolen, with proprietary engine |
| tware to communicate with a wastewater system. (Citation: Ma | | ering software to communicate with a wastewater system.(Cita |
| rshall Abrams July 2008) | | tion: Marshall Abrams July 2008) |
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.989000+00:00 | 2022-10-20 18:13:19.252000+00:00 |
| description | Adversaries may target devices that are transient across ICS networks and external networks. Normally, transient assets are brought into an environment by authorized personnel and do not remain in that environment on a permanent basis. (Citation: North American Electric Reliability Corporation June 2021) Transient assets are commonly needed to support management functions and may be more common in systems where a remotely managed asset is not feasible, external connections for remote access do not exist, or 3rd party contractor/vendor access is required. Adversaries may take advantage of transient assets in different ways. For instance, adversaries may target a transient asset when it is connected to an external network and then leverage its trusted access in another environment to launch an attack. They may also take advantage of installed applications and libraries that are used by legitimate end-users to interact with control system devices. Transient assets, in some cases, may not be deployed with a secure configuration leading to weaknesses that could allow an adversary to propagate malicious executable code, e.g., the transient asset may be infected by malware and when connected to an ICS environment the malware propagates onto other systems. In the Maroochy attack, the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system. (Citation: Marshall Abrams July 2008) | Adversaries may target devices that are transient across ICS networks and external networks. Normally, transient assets are brought into an environment by authorized personnel and do not remain in that environment on a permanent basis. (Citation: North American Electric Reliability Corporation June 2021) Transient assets are commonly needed to support management functions and may be more common in systems where a remotely managed asset is not feasible, external connections for remote access do not exist, or 3rd party contractor/vendor access is required.
Adversaries may take advantage of transient assets in different ways. For instance, adversaries may target a transient asset when it is connected to an external network and then leverage its trusted access in another environment to launch an attack. They may also take advantage of installed applications and libraries that are used by legitimate end-users to interact with control system devices.
Transient assets, in some cases, may not be deployed with a secure configuration leading to weaknesses that could allow an adversary to propagate malicious executable code, e.g., the transient asset may be infected by malware and when connected to an ICS environment the malware propagates onto other systems.
In the Maroochy Shire attack, the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | North American Electric Reliability Corporation June 2021 | Marshall Abrams July 2008 |
| external_references[1]['description'] | North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[1]['url'] | https://www.nerc.com/files/glossary_of_terms.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[2]['source_name'] | Marshall Abrams July 2008 | North American Electric Reliability Corporation June 2021 |
| external_references[2]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 |
| external_references[2]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://www.nerc.com/files/glossary_of_terms.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T0855] Unauthorized Command Message
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may send unauthorized command messages to instru | t | Adversaries may send unauthorized command messages to instru |
| ct control system assets to perform actions outside of their | | ct control system assets to perform actions outside of their |
| intended functionality, or without the logical precondition | | intended functionality, or without the logical precondition |
| s to trigger their expected function. Command messages are u | | s to trigger their expected function. Command messages are u |
| sed in ICS networks to give direct instructions to control s | | sed in ICS networks to give direct instructions to control s |
| ystems devices. If an adversary can send an unauthorized com | | ystems devices. If an adversary can send an unauthorized com |
| mand message to a control system, then it can instruct the c | | mand message to a control system, then it can instruct the c |
| ontrol systems device to perform an action outside the norma | | ontrol systems device to perform an action outside the norma |
| l bounds of the device's actions. An adversary could potenti | | l bounds of the device's actions. An adversary could potenti |
| ally instruct a control systems device to perform an action | | ally instruct a control systems device to perform an action |
| that will cause an [Impact](https://attack.mitre.org/tactics | | that will cause an [Impact](https://attack.mitre.org/tactics |
| /TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sas | | /TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sas |
| try 2011) In the Maroochy Attack, the adversary used a d | | try 2011) In the Maroochy Shire attack, the adversary used |
| edicated analog two-way radio system to send false data and | | a dedicated analog two-way radio system to send false data a |
| instructions to pumping stations and the central computer. ( | | nd instructions to pumping stations and the central computer |
| Citation: Marshall Abrams July 2008) In the Dallas Siren | | .(Citation: Marshall Abrams July 2008) In the Dallas Siren |
| incident, adversaries were able to send command messages to | | incident, adversaries were able to send command messages to |
| activate tornado alarm systems across the city without an im | | activate tornado alarm systems across the city without an im |
| pending tornado or other disaster. (Citation: Zack Whittaker | | pending tornado or other disaster. (Citation: Zack Whittaker |
| April 2017) (Citation: Benjamin Freed March 2019) | | April 2017) (Citation: Benjamin Freed March 2019) |
New Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 12:18:48.810000+00:00 | 2022-10-20 18:10:48.892000+00:00 |
| description | Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
In the Maroochy Attack, the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer. (Citation: Marshall Abrams July 2008)
In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster. (Citation: Zack Whittaker April 2017) (Citation: Benjamin Freed March 2019) | Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
In the Maroochy Shire attack, the adversary used a dedicated analog two-way radio system to send false data and instructions to pumping stations and the central computer.(Citation: Marshall Abrams July 2008)
In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster. (Citation: Zack Whittaker April 2017) (Citation: Benjamin Freed March 2019) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[3]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T0863] User Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may rely on a targeted organizations user intera | t | Adversaries may rely on a targeted organizations user intera |
| ction for the execution of malicious code. User interaction | | ction for the execution of malicious code. User interaction |
| may consist of installing applications, opening email attach | | may consist of installing applications, opening email attach |
| ments, or granting higher permissions to documents. Advers | | ments, or granting higher permissions to documents. Advers |
| aries may embed malicious code or visual basic code into fil | | aries may embed malicious code or visual basic code into fil |
| es such as Microsoft Word and Excel documents or software in | | es such as Microsoft Word and Excel documents or software in |
| stallers. (Citation: Booz Allen Hamilton) Execution of this | | stallers. (Citation: Booz Allen Hamilton) Execution of this |
| code requires that the user enable scripting or write access | | code requires that the user enable scripting or write access |
| within the document. Embedded code may not always be notice | | within the document. Embedded code may not always be notice |
| able to the user especially in cases of trojanized software. | | able to the user especially in cases of trojanized software. |
| (Citation: Daavid Hentunen, Antti Tikkanen June 2014) A Ch | | (Citation: Daavid Hentunen, Antti Tikkanen June 2014) A C |
| inese spearphishing campaign running from December 9, 2011 t | | hinese spearphishing campaign running from December 9, 2011 |
| hrough February 29, 2012 delivered malware through spearphis | | through February 29, 2012 delivered malware through spearphi |
| hing attachments which required user action to achieve execu | | shing attachments which required user action to achieve exec |
| tion. (Citation: CISA AA21-201A Pipeline Intrusion July 2021 | | ution. (Citation: CISA AA21-201A Pipeline Intrusion July 202 |
| ) | | 1) |
New Detections:
- DS0022: File (File Access)
Dropped Detections:
- DS0022: File (File Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.991000+00:00 | 2022-09-27 16:03:41.333000+00:00 |
| description | Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents. Adversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. (Citation: Booz Allen Hamilton) Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012 delivered malware through spearphishing attachments which required user action to achieve execution. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) | Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents.
Adversaries may embed malicious code or visual basic code into files such as Microsoft Word and Excel documents or software installers. (Citation: Booz Allen Hamilton) Execution of this code requires that the user enable scripting or write access within the document. Embedded code may not always be noticeable to the user especially in cases of trojanized software. (Citation: Daavid Hentunen, Antti Tikkanen June 2014)
A Chinese spearphishing campaign running from December 9, 2011 through February 29, 2012 delivered malware through spearphishing attachments which required user action to achieve execution. (Citation: CISA AA21-201A Pipeline Intrusion July 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0859] Valid Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0028: Logon Session (Logon Session Metadata)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 11:56:16.241000+00:00 | 2022-09-27 16:35:12.478000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| x_mitre_version | 1.0 | 1.1 |
[T0860] Wireless Compromise
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may perform wireless compromise as a method of g | t | Adversaries may perform wireless compromise as a method of g |
| aining communications and unauthorized access to a wireless | | aining communications and unauthorized access to a wireless |
| network. Access to a wireless network may be gained through | | network. Access to a wireless network may be gained through |
| the compromise of a wireless device. (Citation: Alexander Bo | | the compromise of a wireless device. (Citation: Alexander Bo |
| lshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev | | lshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev |
| March 2014) Adversaries may also utilize radios and other wi | | March 2014) Adversaries may also utilize radios and other wi |
| reless communication devices on the same frequency as the wi | | reless communication devices on the same frequency as the wi |
| reless network. Wireless compromise can be done as an initia | | reless network. Wireless compromise can be done as an initia |
| l access vector from a remote distance. A joint case stu | | l access vector from a remote distance. In the Maroochy Sh |
| dy on the Maroochy Shire Water Services event examined the a | | ire attack, the adversary used a two-way radio to communicat |
| ttack from a cyber security perspective. (Citation: Marshall | | e with and set the frequencies of Maroochy Shire's repeater |
| Abrams July 2008) The adversary disrupted Maroochy Shire's | | stations.(Citation: Marshall Abrams July 2008) A Polish stu |
| radio-controlled sewage system by driving around with stolen | | dent used a modified TV remote controller to gain access to |
| radio equipment and issuing commands with them. Boden used | | and control over the Lodz city tram system in Poland. (Citat |
| a two-way radio to communicate with and set the frequencies | | ion: John Bill May 2017) (Citation: Shelley Smith February 2 |
| of Maroochy Shire's repeater stations. A Polish student us | | 008) The remote controller device allowed the student to int |
| ed a modified TV remote controller to gain access to and con | | erface with the trams network to modify track settings and o |
| trol over the Lodz city tram system in Poland. (Citation: Jo | | verride operator control. The adversary may have accomplishe |
| hn Bill May 2017) (Citation: Shelley Smith February 2008) Th | | d this by aligning the controller to the frequency and ampli |
| e remote controller device allowed the student to interface | | tude of IR control protocol signals. (Citation: Bruce Schnei |
| with the trams network to modify track settings and override | | er January 2008) The controller then enabled initial access |
| operator control. The adversary may have accomplished this | | to the network, allowing the capture and replay of tram sign |
| by aligning the controller to the frequency and amplitude of | | als. (Citation: John Bill May 2017) |
| IR control protocol signals. (Citation: Bruce Schneier Janu | | |
| ary 2008) The controller then enabled initial access to the | | |
| network, allowing the capture and replay of tram signals. (C | | |
| itation: John Bill May 2017) | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.995000+00:00 | 2022-10-20 20:40:16.860000+00:00 |
| description | Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance. A joint case study on the Maroochy Shire Water Services event examined the attack from a cyber security perspective. (Citation: Marshall Abrams July 2008) The adversary disrupted Maroochy Shire's radio-controlled sewage system by driving around with stolen radio equipment and issuing commands with them. Boden used a two-way radio to communicate with and set the frequencies of Maroochy Shire's repeater stations. A Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. (Citation: Bruce Schneier January 2008) The controller then enabled initial access to the network, allowing the capture and replay of tram signals. (Citation: John Bill May 2017) | Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance.
In the Maroochy Shire attack, the adversary used a two-way radio to communicate with and set the frequencies of Maroochy Shire's repeater stations.(Citation: Marshall Abrams July 2008)
A Polish student used a modified TV remote controller to gain access to and control over the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) The remote controller device allowed the student to interface with the trams network to modify track settings and override operator control. The adversary may have accomplished this by aligning the controller to the frequency and amplitude of IR control protocol signals. (Citation: Bruce Schneier January 2008) The controller then enabled initial access to the network, allowing the capture and replay of tram signals. (Citation: John Bill May 2017) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Alexander Bolshev, Gleb Cherbov July 2014 | Alexander Bolshev March 2014 |
| external_references[1]['description'] | Alexander Bolshev, Gleb Cherbov 2014, July 08 ICSCorsair: How I will PWN your ERP through 4-20 mA current loop Retrieved. 2020/01/05 | Alexander Bolshev 2014, March 11 S4x14: HART As An Attack Vector Retrieved. 2020/01/05 |
| external_references[1]['url'] | https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf | https://www.slideshare.net/dgpeters/17-bolshev-1-13 |
| external_references[2]['source_name'] | Alexander Bolshev March 2014 | Alexander Bolshev, Gleb Cherbov July 2014 |
| external_references[2]['description'] | Alexander Bolshev 2014, March 11 S4x14: HART As An Attack Vector Retrieved. 2020/01/05 | Alexander Bolshev, Gleb Cherbov 2014, July 08 ICSCorsair: How I will PWN your ERP through 4-20 mA current loop Retrieved. 2020/01/05 |
| external_references[2]['url'] | https://www.slideshare.net/dgpeters/17-bolshev-1-13 | https://www.blackhat.com/docs/us-14/materials/us-14-Bolshev-ICSCorsair-How-I-Will-PWN-Your-ERP-Through-4-20mA-Current-Loop-WP.pdf |
| external_references[3]['source_name'] | Marshall Abrams July 2008 | Bruce Schneier January 2008 |
| external_references[3]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 |
| external_references[3]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html |
| external_references[5]['source_name'] | Shelley Smith February 2008 | Marshall Abrams July 2008 |
| external_references[5]['description'] | Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[5]['url'] | https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/ | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[6]['source_name'] | Bruce Schneier January 2008 | Shelley Smith February 2008 |
| external_references[6]['description'] | Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 | Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 |
| external_references[6]['url'] | https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html | https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/ |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'John Bill May 2017', 'description': 'John Bill 2017, May 12 Hacked Cyber Security Railways Retrieved. 2019/10/17 ', 'url': 'https://www.londonreconnections.com/2017/hacked-cyber-security-railways/'} | |
[T0887] Wireless Sniffing
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may seek to capture radio frequency (RF) communi | t | Adversaries may seek to capture radio frequency (RF) communi |
| cation used for remote control and reporting in distributed | | cation used for remote control and reporting in distributed |
| environments. RF communication frequencies vary between 3 kH | | environments. RF communication frequencies vary between 3 kH |
| z to 300 GHz, although are commonly between 300 MHz to 6 GHz | | z to 300 GHz, although are commonly between 300 MHz to 6 GHz |
| . (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quim | | . (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quim |
| by, J., Remley, K. April 2018) The wavelength and frequency | | by, J., Remley, K. April 2018) The wavelength and frequency |
| of the signal affect how the signal propagates through open | | of the signal affect how the signal propagates through open |
| air, obstacles (e.g. walls and trees) and the type of radio | | air, obstacles (e.g. walls and trees) and the type of radio |
| required to capture them. These characteristics are often s | | required to capture them. These characteristics are often s |
| tandardized in the protocol and hardware and may have an eff | | tandardized in the protocol and hardware and may have an eff |
| ect on how the signal is captured. Some examples of wireless | | ect on how the signal is captured. Some examples of wireless |
| protocols that may be found in cyber-physical environments | | protocols that may be found in cyber-physical environments |
| are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety | | are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety |
| Spectrum. Adversaries may capture RF communications by usi | | Spectrum. Adversaries may capture RF communications by us |
| ng specialized hardware, such as software defined radio (SDR | | ing specialized hardware, such as software defined radio (SD |
| ), handheld radio, or a computer with radio demodulator tune | | R), handheld radio, or a computer with radio demodulator tun |
| d to the communication frequency. (Citation: Bastille April | | ed to the communication frequency. (Citation: Bastille April |
| 2017) Information transmitted over a wireless medium may be | | 2017) Information transmitted over a wireless medium may be |
| captured in-transit whether the sniffing device is the inten | | captured in-transit whether the sniffing device is the inte |
| ded destination or not. This technique may be particularly u | | nded destination or not. This technique may be particularly |
| seful to an adversary when the communications are not encryp | | useful to an adversary when the communications are not encry |
| ted. (Citation: Gallagher, S. April 2017) In the 2017 Dalla | | pted. (Citation: Gallagher, S. April 2017) In the 2017 Dal |
| s Siren incident, it is suspected that adversaries likely ca | | las Siren incident, it is suspected that adversaries likely |
| ptured wireless command message broadcasts on a 700 MHz freq | | captured wireless command message broadcasts on a 700 MHz fr |
| uency during a regular test of the system. These messages we | | equency during a regular test of the system. These messages |
| re later replayed to trigger the alarm systems. (Citation: G | | were later replayed to trigger the alarm systems. (Citation: |
| allagher, S. April 2017) | | Gallagher, S. April 2017) |
New Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.997000+00:00 | 2022-09-27 17:37:02.773000+00:00 |
| description | Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments. RF communication frequencies vary between 3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018) The wavelength and frequency of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the type of radio required to capture them. These characteristics are often standardized in the protocol and hardware and may have an effect on how the signal is captured. Some examples of wireless protocols that may be found in cyber-physical environments are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety Spectrum. Adversaries may capture RF communications by using specialized hardware, such as software defined radio (SDR), handheld radio, or a computer with radio demodulator tuned to the communication frequency. (Citation: Bastille April 2017) Information transmitted over a wireless medium may be captured in-transit whether the sniffing device is the intended destination or not. This technique may be particularly useful to an adversary when the communications are not encrypted. (Citation: Gallagher, S. April 2017) In the 2017 Dallas Siren incident, it is suspected that adversaries likely captured wireless command message broadcasts on a 700 MHz frequency during a regular test of the system. These messages were later replayed to trigger the alarm systems. (Citation: Gallagher, S. April 2017) | Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments. RF communication frequencies vary between 3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018) The wavelength and frequency of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the type of radio required to capture them. These characteristics are often standardized in the protocol and hardware and may have an effect on how the signal is captured. Some examples of wireless protocols that may be found in cyber-physical environments are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety Spectrum.
Adversaries may capture RF communications by using specialized hardware, such as software defined radio (SDR), handheld radio, or a computer with radio demodulator tuned to the communication frequency. (Citation: Bastille April 2017) Information transmitted over a wireless medium may be captured in-transit whether the sniffing device is the intended destination or not. This technique may be particularly useful to an adversary when the communications are not encrypted. (Citation: Gallagher, S. April 2017)
In the 2017 Dallas Siren incident, it is suspected that adversaries likely captured wireless command message broadcasts on a 700 MHz frequency during a regular test of the system. These messages were later replayed to trigger the alarm systems. (Citation: Gallagher, S. April 2017) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018 | Bastille April 2017 |
| external_references[1]['description'] | Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. 2018, April Guide to Industrial Wireless Systems Deployments Retrieved. 2020/12/01 | Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 |
| external_references[1]['url'] | https://nvlpubs.nist.gov/nistpubs/ams/NIST.AMS.300-4.pdf | https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack |
| external_references[2]['source_name'] | Bastille April 2017 | Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018 |
| external_references[2]['description'] | Bastille 2017, April 17 Dallas Siren Attack Retrieved. 2020/11/06 | Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. 2018, April Guide to Industrial Wireless Systems Deployments Retrieved. 2020/12/01 |
| external_references[2]['url'] | https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack | https://nvlpubs.nist.gov/nistpubs/ams/NIST.AMS.300-4.pdf |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Gallagher, S. April 2017', 'description': 'Gallagher, S. 2017, April 12 Pirate radio: Signal spoof set off Dallas emergency sirens, not network hack Retrieved. 2020/12/01 ', 'url': 'https://arstechnica.com/information-technology/2017/04/dallas-siren-hack-used-radio-signals-to-spoof-alarm-says-city-manager/'} | |
Patches
[T0800] Activate Firmware Update Mode
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.886000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0802] Automated Collection
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.889000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0803] Block Command Message
Current version: 1.0
Dropped Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.891000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0804] Block Reporting Message
Current version: 1.0
Dropped Detections:
- DS0029: Network Traffic (Network Connection Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.892000+00:00 | 2022-09-19 13:57:23.538000+00:00 |
| description | Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator. Blocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) | Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator.
Blocking reporting messages in control systems that manage physical processes may contribute to system impact, causing inhibition of a response function. A control system may not be able to respond in a proper or timely manner to an event, such as a dangerous fault, if its corresponding reporting message is blocked. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0806] Brute Force I/O
Current version: 1.0
|
|
|---|
| t | Adversaries may repetitively or successively change I/O poin | t | Adversaries may repetitively or successively change I/O poin |
| t values to perform an action. Brute Force I/O may be achiev | | t values to perform an action. Brute Force I/O may be achiev |
| ed by changing either a range of I/O point values or a singl | | ed by changing either a range of I/O point values or a singl |
| e point value repeatedly to manipulate a process function. T | | e point value repeatedly to manipulate a process function. T |
| he adversarys goal and the information they have about the t | | he adversarys goal and the information they have about the t |
| arget environment will influence which of the options they c | | arget environment will influence which of the options they c |
| hoose. In the case of brute forcing a range of point values, | | hoose. In the case of brute forcing a range of point values, |
| the adversary may be able to achieve an impact without targ | | the adversary may be able to achieve an impact without targ |
| eting a specific point. In the case where a single point is | | eting a specific point. In the case where a single point is |
| targeted, the adversary may be able to generate instability | | targeted, the adversary may be able to generate instability |
| on the process function associated with that particular poin | | on the process function associated with that particular poin |
| t. Adversaries may use Brute Force I/O to cause failures wi | | t. Adversaries may use Brute Force I/O to cause failures w |
| thin various industrial processes. These failures could be t | | ithin various industrial processes. These failures could be |
| he result of wear on equipment or damage to downstream equip | | the result of wear on equipment or damage to downstream equi |
| ment. | | pment. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.893000+00:00 | 2022-09-20 19:28:07.225000+00:00 |
| description | Adversaries may repetitively or successively change I/O point values to perform an action. Brute Force I/O may be achieved by changing either a range of I/O point values or a single point value repeatedly to manipulate a process function. The adversarys goal and the information they have about the target environment will influence which of the options they choose. In the case of brute forcing a range of point values, the adversary may be able to achieve an impact without targeting a specific point. In the case where a single point is targeted, the adversary may be able to generate instability on the process function associated with that particular point. Adversaries may use Brute Force I/O to cause failures within various industrial processes. These failures could be the result of wear on equipment or damage to downstream equipment. | Adversaries may repetitively or successively change I/O point values to perform an action. Brute Force I/O may be achieved by changing either a range of I/O point values or a single point value repeatedly to manipulate a process function. The adversarys goal and the information they have about the target environment will influence which of the options they choose. In the case of brute forcing a range of point values, the adversary may be able to achieve an impact without targeting a specific point. In the case where a single point is targeted, the adversary may be able to generate instability on the process function associated with that particular point.
Adversaries may use Brute Force I/O to cause failures within various industrial processes. These failures could be the result of wear on equipment or damage to downstream equipment. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0879] Damage to Property
Current version: 1.0
|
|
|---|
| t | Adversaries may cause damage and destruction of property to | t | Adversaries may cause damage and destruction of property to |
| infrastructure, equipment, and the surrounding environment w | | infrastructure, equipment, and the surrounding environment w |
| hen attacking control systems. This technique may result in | | hen attacking control systems. This technique may result in |
| device and operational equipment breakdown, or represent tan | | device and operational equipment breakdown, or represent tan |
| gential damage from other techniques used in an attack. Depe | | gential damage from other techniques used in an attack. Depe |
| nding on the severity of physical damage and disruption caus | | nding on the severity of physical damage and disruption caus |
| ed to control processes and systems, this technique may resu | | ed to control processes and systems, this technique may resu |
| lt in [Loss of Safety](https://attack.mitre.org/techniques/T | | lt in [Loss of Safety](https://attack.mitre.org/techniques/T |
| 0880). Operations that result in [Loss of Control](https://a | | 0880). Operations that result in [Loss of Control](https://a |
| ttack.mitre.org/techniques/T0827) may also cause damage to p | | ttack.mitre.org/techniques/T0827) may also cause damage to p |
| roperty, which may be directly or indirectly motivated by an | | roperty, which may be directly or indirectly motivated by an |
| adversary seeking to cause impact in the form of [Loss of P | | adversary seeking to cause impact in the form of [Loss of P |
| roductivity and Revenue](https://attack.mitre.org/techniques | | roductivity and Revenue](https://attack.mitre.org/techniques |
| /T0828). The German Federal Office for Information Securit | | /T0828). In the Maroochy Shire attack, the adversary gaine |
| y (BSI) reported a targeted attack on a steel mill under an | | d remote computer access to the control system and altered d |
| incidents affecting business section of its 2014 IT Security | | ata so that whatever function should have occurred at affect |
| Report. (Citation: BSI State of IT Security 2014) These ta | | ed pumping stations did not occur or occurred in a different |
| rgeted attacks affected industrial operations and resulted i | | way. This ultimately led to 800,000 liters of raw sewage be |
| n breakdowns of control system components and even entire in | | ing spilled out into the community. The raw sewage affected |
| stallations. As a result of these breakdowns, massive impact | | local parks, rivers, and even a local hotel. This resulted i |
| and damage resulted from the uncontrolled shutdown of a bla | | n harm to marine life and produced a sickening stench from t |
| st furnace. In the Maroochy Attack, Vitek Boden gained remo | | he community's now blackened rivers.(Citation: Marshall Abra |
| te computer access to the control system and altered data so | | ms July 2008) The German Federal Office for Information Sec |
| that whatever function should have occurred at affected pum | | urity (BSI) reported a targeted attack on a steel mill under |
| ping stations did not occur or occurred in a different way. | | an incidents affecting business section of its 2014 IT Secu |
| This ultimately led to 800,000 liters of raw sewage being sp | | rity Report. (Citation: BSI State of IT Security 2014) Thes |
| illed out into the community. The raw sewage affected local | | e targeted attacks affected industrial operations and result |
| parks, rivers, and even a local hotel. This resulted in harm | | ed in breakdowns of control system components and even entir |
| to marine life and produced a sickening stench from the com | | e installations. As a result of these breakdowns, massive im |
| munity's now blackened rivers. (Citation: Marshall Abrams Ju | | pact and damage resulted from the uncontrolled shutdown of a |
| ly 2008) A Polish student used a remote controller device t | | blast furnace. A Polish student used a remote controller |
| o interface with the Lodz city tram system in Poland. (Citat | | device to interface with the Lodz city tram system in Poland |
| ion: John Bill May 2017) (Citation: Shelley Smith February 2 | | . (Citation: John Bill May 2017) (Citation: Shelley Smith Fe |
| 008) (Citation: Bruce Schneier January 2008) Using this remo | | bruary 2008) (Citation: Bruce Schneier January 2008) Using t |
| te, the student was able to capture and replay legitimate tr | | his remote, the student was able to capture and replay legit |
| am signals. This resulted in damage to impacted trams, peopl | | imate tram signals. This resulted in damage to impacted tram |
| e, and the surrounding property. Reportedly, four trams were | | s, people, and the surrounding property. Reportedly, four tr |
| derailed and were forced to make emergency stops. (Citation | | ams were derailed and were forced to make emergency stops. ( |
| : Shelley Smith February 2008) Commands issued by the studen | | Citation: Shelley Smith February 2008) Commands issued by th |
| t may have also resulted in tram collisions, causing harm to | | e student may have also resulted in tram collisions, causing |
| those on board and the environment outside. (Citation: Bruc | | harm to those on board and the environment outside. (Citati |
| e Schneier January 2008) | | on: Bruce Schneier January 2008) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.903000+00:00 | 2022-10-20 18:12:38.570000+00:00 |
| description | Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems. This technique may result in device and operational equipment breakdown, or represent tangential damage from other techniques used in an attack. Depending on the severity of physical damage and disruption caused to control processes and systems, this technique may result in [Loss of Safety](https://attack.mitre.org/techniques/T0880). Operations that result in [Loss of Control](https://attack.mitre.org/techniques/T0827) may also cause damage to property, which may be directly or indirectly motivated by an adversary seeking to cause impact in the form of [Loss of Productivity and Revenue](https://attack.mitre.org/techniques/T0828). The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill under an incidents affecting business section of its 2014 IT Security Report. (Citation: BSI State of IT Security 2014) These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact and damage resulted from the uncontrolled shutdown of a blast furnace. In the Maroochy Attack, Vitek Boden gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. The raw sewage affected local parks, rivers, and even a local hotel. This resulted in harm to marine life and produced a sickening stench from the community's now blackened rivers. (Citation: Marshall Abrams July 2008) A Polish student used a remote controller device to interface with the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) (Citation: Bruce Schneier January 2008) Using this remote, the student was able to capture and replay legitimate tram signals. This resulted in damage to impacted trams, people, and the surrounding property. Reportedly, four trams were derailed and were forced to make emergency stops. (Citation: Shelley Smith February 2008) Commands issued by the student may have also resulted in tram collisions, causing harm to those on board and the environment outside. (Citation: Bruce Schneier January 2008) | Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems. This technique may result in device and operational equipment breakdown, or represent tangential damage from other techniques used in an attack. Depending on the severity of physical damage and disruption caused to control processes and systems, this technique may result in [Loss of Safety](https://attack.mitre.org/techniques/T0880). Operations that result in [Loss of Control](https://attack.mitre.org/techniques/T0827) may also cause damage to property, which may be directly or indirectly motivated by an adversary seeking to cause impact in the form of [Loss of Productivity and Revenue](https://attack.mitre.org/techniques/T0828).
In the Maroochy Shire attack, the adversary gained remote computer access to the control system and altered data so that whatever function should have occurred at affected pumping stations did not occur or occurred in a different way. This ultimately led to 800,000 liters of raw sewage being spilled out into the community. The raw sewage affected local parks, rivers, and even a local hotel. This resulted in harm to marine life and produced a sickening stench from the community's now blackened rivers.(Citation: Marshall Abrams July 2008)
The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill under an incidents affecting business section of its 2014 IT Security Report. (Citation: BSI State of IT Security 2014) These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact and damage resulted from the uncontrolled shutdown of a blast furnace.
A Polish student used a remote controller device to interface with the Lodz city tram system in Poland. (Citation: John Bill May 2017) (Citation: Shelley Smith February 2008) (Citation: Bruce Schneier January 2008) Using this remote, the student was able to capture and replay legitimate tram signals. This resulted in damage to impacted trams, people, and the surrounding property. Reportedly, four trams were derailed and were forced to make emergency stops. (Citation: Shelley Smith February 2008) Commands issued by the student may have also resulted in tram collisions, causing harm to those on board and the environment outside. (Citation: Bruce Schneier January 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | BSI State of IT Security 2014 | Bruce Schneier January 2008 |
| external_references[1]['description'] | Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 | Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 |
| external_references[1]['url'] | https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3 | https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html |
| external_references[2]['source_name'] | Marshall Abrams July 2008 | BSI State of IT Security 2014 |
| external_references[2]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 |
| external_references[2]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3 |
| external_references[4]['source_name'] | Shelley Smith February 2008 | Marshall Abrams July 2008 |
| external_references[4]['description'] | Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[4]['url'] | https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/ | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[5]['source_name'] | Bruce Schneier January 2008 | Shelley Smith February 2008 |
| external_references[5]['description'] | Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 | Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 |
| external_references[5]['url'] | https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html | https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/ |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Shelley Smith February 2008', 'description': 'Shelley Smith 2008, February 12 Teen Hacker in Poland Plays Trains and Derails City Tram System Retrieved. 2019/10/17 ', 'url': 'https://inhomelandsecurity.com/teen_hacker_in_poland_plays_tr/'} | |
| external_references | {'source_name': 'Bruce Schneier January 2008', 'description': 'Bruce Schneier 2008, January 17 Hacking Polish Trams Retrieved. 2019/10/17 ', 'url': 'https://www.schneier.com/blog/archives/2008/01/hacking_the_pol.html'} | |
[T0809] Data Destruction
Current version: 1.0
|
|
|---|
| t | Adversaries may perform data destruction over the course of | t | Adversaries may perform data destruction over the course of |
| an operation. The adversary may drop or create malware, tool | | an operation. The adversary may drop or create malware, tool |
| s, or other non-native files on a target system to accomplis | | s, or other non-native files on a target system to accomplis |
| h this, potentially leaving behind traces of malicious activ | | h this, potentially leaving behind traces of malicious activ |
| ities. Such non-native files and other data may be removed o | | ities. Such non-native files and other data may be removed o |
| ver the course of an intrusion to maintain a small footprint | | ver the course of an intrusion to maintain a small footprint |
| or as a standard part of the post-intrusion cleanup process | | or as a standard part of the post-intrusion cleanup process |
| . (Citation: Enterprise ATT&CK January 2018) Data destruct | | . (Citation: Enterprise ATT&CK January 2018) Data destructi |
| ion may also be used to render operator interfaces unable to | | on may also be used to render operator interfaces unable to |
| respond and to disrupt response functions from occurring as | | respond and to disrupt response functions from occurring as |
| expected. An adversary may also destroy data backups that a | | expected. An adversary may also destroy data backups that ar |
| re vital to recovery after an incident. Standard file delet | | e vital to recovery after an incident. Standard file deleti |
| ion commands are available on most operating system and devi | | on commands are available on most operating system and devic |
| ce interfaces to perform cleanup, but adversaries may use ot | | e interfaces to perform cleanup, but adversaries may use oth |
| her tools as well. Two examples are Windows Sysinternals SDe | | er tools as well. Two examples are Windows Sysinternals SDel |
| lete and Active@ Killdisk. | | ete and Active@ Killdisk. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.904000+00:00 | 2022-09-19 14:12:22.878000+00:00 |
| description | Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process. (Citation: Enterprise ATT&CK January 2018) Data destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident. Standard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk. | Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process. (Citation: Enterprise ATT&CK January 2018)
Data destruction may also be used to render operator interfaces unable to respond and to disrupt response functions from occurring as expected. An adversary may also destroy data backups that are vital to recovery after an incident.
Standard file deletion commands are available on most operating system and device interfaces to perform cleanup, but adversaries may use other tools as well. Two examples are Windows Sysinternals SDelete and Active@ Killdisk. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0812] Default Credentials
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.906000+00:00 | 2022-09-19 14:07:23.199000+00:00 |
| description | Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed. (Citation: Keith Stouffer May 2015) Default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled. | Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed. (Citation: Keith Stouffer May 2015)
Default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0813] Denial of Control
Current version: 1.0
|
|
|---|
| t | Adversaries may cause a denial of control to temporarily pre | t | Adversaries may cause a denial of control to temporarily pre |
| vent operators and engineers from interacting with process c | | vent operators and engineers from interacting with process c |
| ontrols. An adversary may attempt to deny process control ac | | ontrols. An adversary may attempt to deny process control ac |
| cess to cause a temporary loss of communication with the con | | cess to cause a temporary loss of communication with the con |
| trol device or to prevent operator adjustment of process con | | trol device or to prevent operator adjustment of process con |
| trols. An affected process may still be operating during the | | trols. An affected process may still be operating during the |
| period of control loss, but not necessarily in a desired st | | period of control loss, but not necessarily in a desired st |
| ate. (Citation: Corero) (Citation: Michael J. Assante and Ro | | ate. (Citation: Corero) (Citation: Michael J. Assante and Ro |
| bert M. Lee) (Citation: Tyson Macaulay) In the Maroochy att | | bert M. Lee) (Citation: Tyson Macaulay) In the Maroochy Shi |
| ack, the adversary was able to temporarily shut an investiga | | re attack, the adversary temporarily shut an investigator ou |
| tor out of the network preventing them from issuing any cont | | t of the network preventing them from issuing any controls.( |
| rols. In the 2017 Dallas Siren incident operators were unab | | Citation: Marshall Abrams July 2008) In the 2017 Dallas Sir |
| le to disable the false alarms from the Office of Emergency | | en incident operators were unable to disable the false alarm |
| Management headquarters. (Citation: Mark Loveless April 2017 | | s from the Office of Emergency Management headquarters. (Cit |
| ) | | ation: Mark Loveless April 2017) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.908000+00:00 | 2022-10-20 18:09:55.792000+00:00 |
| description | Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls. An adversary may attempt to deny process control access to cause a temporary loss of communication with the control device or to prevent operator adjustment of process controls. An affected process may still be operating during the period of control loss, but not necessarily in a desired state. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) In the Maroochy attack, the adversary was able to temporarily shut an investigator out of the network preventing them from issuing any controls. In the 2017 Dallas Siren incident operators were unable to disable the false alarms from the Office of Emergency Management headquarters. (Citation: Mark Loveless April 2017) | Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls. An adversary may attempt to deny process control access to cause a temporary loss of communication with the control device or to prevent operator adjustment of process controls. An affected process may still be operating during the period of control loss, but not necessarily in a desired state. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
In the Maroochy Shire attack, the adversary temporarily shut an investigator out of the network preventing them from issuing any controls.(Citation: Marshall Abrams July 2008)
In the 2017 Dallas Siren incident operators were unable to disable the false alarms from the Office of Emergency Management headquarters. (Citation: Mark Loveless April 2017) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['source_name'] | Michael J. Assante and Robert M. Lee | Mark Loveless April 2017 |
| external_references[2]['description'] | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 | Mark Loveless 2017, April 11 THE DALLAS COUNTY SIREN HACK Retrieved. 2020/11/06 |
| external_references[2]['url'] | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 | https://duo.com/decipher/the-dallas-county-siren-hack |
| external_references[3]['source_name'] | Tyson Macaulay | Marshall Abrams July 2008 |
| external_references[3]['description'] | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[3]['url'] | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[4]['source_name'] | Mark Loveless April 2017 | Michael J. Assante and Robert M. Lee |
| external_references[4]['description'] | Mark Loveless 2017, April 11 THE DALLAS COUNTY SIREN HACK Retrieved. 2020/11/06 | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 |
| external_references[4]['url'] | https://duo.com/decipher/the-dallas-county-siren-hack | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Tyson Macaulay', 'description': 'Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ', 'url': 'https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false'} |
[T0814] Denial of Service
Current version: 1.0
|
|
|---|
| t | Adversaries may perform Denial-of-Service (DoS) attacks to d | t | Adversaries may perform Denial-of-Service (DoS) attacks to d |
| isrupt expected device functionality. Examples of DoS attack | | isrupt expected device functionality. Examples of DoS attack |
| s include overwhelming the target device with a high volume | | s include overwhelming the target device with a high volume |
| of requests in a short time period and sending the target de | | of requests in a short time period and sending the target de |
| vice a request it does not know how to handle. Disrupting de | | vice a request it does not know how to handle. Disrupting de |
| vice state may temporarily render it unresponsive, possibly | | vice state may temporarily render it unresponsive, possibly |
| lasting until a reboot can occur. When placed in this state, | | lasting until a reboot can occur. When placed in this state, |
| devices may be unable to send and receive requests, and may | | devices may be unable to send and receive requests, and may |
| not perform expected response functions in reaction to othe | | not perform expected response functions in reaction to othe |
| r events in the environment. Some ICS devices are particula | | r events in the environment. Some ICS devices are particul |
| rly sensitive to DoS events, and may become unresponsive in | | arly sensitive to DoS events, and may become unresponsive in |
| reaction to even a simple ping sweep. Adversaries may also a | | reaction to even a simple ping sweep. Adversaries may also |
| ttempt to execute a Permanent Denial-of-Service (PDoS) again | | attempt to execute a Permanent Denial-of-Service (PDoS) agai |
| st certain devices, such as in the case of the BrickerBot ma | | nst certain devices, such as in the case of the BrickerBot m |
| lware. (Citation: ICS-CERT April 2017) Adversaries may expl | | alware. (Citation: ICS-CERT April 2017) Adversaries may ex |
| oit a software vulnerability to cause a denial of service by | | ploit a software vulnerability to cause a denial of service |
| taking advantage of a programming error in a program, servi | | by taking advantage of a programming error in a program, ser |
| ce, or within the operating system software or kernel itself | | vice, or within the operating system software or kernel itse |
| to execute adversary-controlled code. Vulnerabilities may e | | lf to execute adversary-controlled code. Vulnerabilities may |
| xist in software that can be used to cause a T1023 or denial | | exist in software that can be used to cause a denial of ser |
| of service condition. Adversaries may have prior knowledge | | vice condition. Adversaries may have prior knowledge about |
| about industrial protocols or control devices used in the e | | industrial protocols or control devices used in the environ |
| nvironment through [Remote System Information Discovery](htt | | ment through [Remote System Information Discovery](https://a |
| ps://attack.mitre.org/techniques/T0888). There are examples | | ttack.mitre.org/techniques/T0888). There are examples of adv |
| of adversaries remotely causing a [Device Restart/Shutdown]( | | ersaries remotely causing a [Device Restart/Shutdown](https: |
| https://attack.mitre.org/techniques/T0816) by exploiting a v | | //attack.mitre.org/techniques/T0816) by exploiting a vulnera |
| ulnerability that induces uncontrolled resource consumption. | | bility that induces uncontrolled resource consumption. (Cita |
| (Citation: ICS-CERT August 2018) (Citation: Common Weakness | | tion: ICS-CERT August 2018) (Citation: Common Weakness Enume |
| Enumeration January 2019) (Citation: MITRE March 2018) In | | ration January 2019) (Citation: MITRE March 2018) In the M |
| the Maroochy attack, the adversary was able to shut an inves | | aroochy Shire attack, the adversary shut an investigator out |
| tigator out of the network. (Citation: Marshall Abrams July | | of the network.(Citation: Marshall Abrams July 2008) |
| 2008) | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.911000+00:00 | 2022-10-20 18:17:08.160000+00:00 |
| description | Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment. Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. (Citation: ICS-CERT April 2017) Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a T1023 or denial of service condition. Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888). There are examples of adversaries remotely causing a [Device Restart/Shutdown](https://attack.mitre.org/techniques/T0816) by exploiting a vulnerability that induces uncontrolled resource consumption. (Citation: ICS-CERT August 2018) (Citation: Common Weakness Enumeration January 2019) (Citation: MITRE March 2018) In the Maroochy attack, the adversary was able to shut an investigator out of the network. (Citation: Marshall Abrams July 2008) | Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment.
Some ICS devices are particularly sensitive to DoS events, and may become unresponsive in reaction to even a simple ping sweep. Adversaries may also attempt to execute a Permanent Denial-of-Service (PDoS) against certain devices, such as in the case of the BrickerBot malware. (Citation: ICS-CERT April 2017)
Adversaries may exploit a software vulnerability to cause a denial of service by taking advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in software that can be used to cause a denial of service condition.
Adversaries may have prior knowledge about industrial protocols or control devices used in the environment through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888). There are examples of adversaries remotely causing a [Device Restart/Shutdown](https://attack.mitre.org/techniques/T0816) by exploiting a vulnerability that induces uncontrolled resource consumption. (Citation: ICS-CERT August 2018) (Citation: Common Weakness Enumeration January 2019) (Citation: MITRE March 2018)
In the Maroochy Shire attack, the adversary shut an investigator out of the network.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | ICS-CERT April 2017 | Common Weakness Enumeration January 2019 |
| external_references[1]['description'] | ICS-CERT 2017, April 18 CS Alert (ICS-ALERT-17-102-01A) BrickerBot Permanent Denial-of-Service Attack Retrieved. 2019/10/24 | Common Weakness Enumeration 2019, January 03 CWE-400: Uncontrolled Resource Consumption Retrieved. 2019/03/14 |
| external_references[1]['url'] | https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A | http://cwe.mitre.org/data/definitions/400.html |
| external_references[2]['source_name'] | ICS-CERT August 2018 | ICS-CERT April 2017 |
| external_references[2]['description'] | ICS-CERT 2018, August 27 Advisory (ICSA-15-202-01) - Siemens SIPROTEC Denial-of-Service Vulnerability Retrieved. 2019/03/14 | ICS-CERT 2017, April 18 CS Alert (ICS-ALERT-17-102-01A) BrickerBot Permanent Denial-of-Service Attack Retrieved. 2019/10/24 |
| external_references[2]['url'] | https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01 | https://www.us-cert.gov/ics/alerts/ICS-ALERT-17-102-01A |
| external_references[3]['source_name'] | Common Weakness Enumeration January 2019 | ICS-CERT August 2018 |
| external_references[3]['description'] | Common Weakness Enumeration 2019, January 03 CWE-400: Uncontrolled Resource Consumption Retrieved. 2019/03/14 | ICS-CERT 2018, August 27 Advisory (ICSA-15-202-01) - Siemens SIPROTEC Denial-of-Service Vulnerability Retrieved. 2019/03/14 |
| external_references[3]['url'] | http://cwe.mitre.org/data/definitions/400.html | https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01 |
| external_references[4]['source_name'] | MITRE March 2018 | Marshall Abrams July 2008 |
| external_references[4]['description'] | MITRE 2018, March 22 CVE-2015-5374 Retrieved. 2019/03/14 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[4]['url'] | https://nvd.nist.gov/vuln/detail/CVE-2015-5374 | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[5]['source_name'] | Marshall Abrams July 2008 | MITRE March 2018 |
| external_references[5]['description'] | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 | MITRE 2018, March 22 CVE-2015-5374 Retrieved. 2019/03/14 |
| external_references[5]['url'] | https://www.mitre.org/sites/default/files/pdf/08_1145.pdf | https://nvd.nist.gov/vuln/detail/CVE-2015-5374 |
[T0815] Denial of View
Current version: 1.0
|
|
|---|
| t | Adversaries may cause a denial of view in attempt to disrupt | t | Adversaries may cause a denial of view in attempt to disrupt |
| and prevent operator oversight on the status of an ICS envi | | and prevent operator oversight on the status of an ICS envi |
| ronment. This may manifest itself as a temporary communicati | | ronment. This may manifest itself as a temporary communicati |
| on failure between a device and its control source, where th | | on failure between a device and its control source, where th |
| e interface recovers and becomes available once the interfer | | e interface recovers and becomes available once the interfer |
| ence ceases. (Citation: Corero) (Citation: Michael J. Assant | | ence ceases. (Citation: Corero) (Citation: Michael J. Assant |
| e and Robert M. Lee) (Citation: Tyson Macaulay) An adversa | | e and Robert M. Lee) (Citation: Tyson Macaulay) An adversa |
| ry may attempt to deny operator visibility by preventing the | | ry may attempt to deny operator visibility by preventing the |
| m from receiving status and reporting messages. Denying this | | m from receiving status and reporting messages. Denying this |
| view may temporarily block and prevent operators from notic | | view may temporarily block and prevent operators from notic |
| ing a change in state or anomalous behavior. The environment | | ing a change in state or anomalous behavior. The environment |
| 's data and processes may still be operational, but function | | 's data and processes may still be operational, but function |
| ing in an unintended or adversarial manner. In the Maroochy | | ing in an unintended or adversarial manner. In the Marooch |
| attack, the adversary was able to temporarily shut an inves | | y Shire attack, the adversary temporarily shut an investigat |
| tigator out of the network, preventing them from viewing the | | or out of the network, preventing them from viewing the stat |
| state of the system. | | e of the system.(Citation: Marshall Abrams July 2008) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.912000+00:00 | 2022-10-20 18:08:38.480000+00:00 |
| description | Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment. This may manifest itself as a temporary communication failure between a device and its control source, where the interface recovers and becomes available once the interference ceases. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) An adversary may attempt to deny operator visibility by preventing them from receiving status and reporting messages. Denying this view may temporarily block and prevent operators from noticing a change in state or anomalous behavior. The environment's data and processes may still be operational, but functioning in an unintended or adversarial manner. In the Maroochy attack, the adversary was able to temporarily shut an investigator out of the network, preventing them from viewing the state of the system. | Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment. This may manifest itself as a temporary communication failure between a device and its control source, where the interface recovers and becomes available once the interference ceases. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
An adversary may attempt to deny operator visibility by preventing them from receiving status and reporting messages. Denying this view may temporarily block and prevent operators from noticing a change in state or anomalous behavior. The environment's data and processes may still be operational, but functioning in an unintended or adversarial manner.
In the Maroochy Shire attack, the adversary temporarily shut an investigator out of the network, preventing them from viewing the state of the system.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['source_name'] | Michael J. Assante and Robert M. Lee | Marshall Abrams July 2008 |
| external_references[2]['description'] | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 | Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 |
| external_references[2]['url'] | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 | https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf |
| external_references[3]['source_name'] | Tyson Macaulay | Michael J. Assante and Robert M. Lee |
| external_references[3]['description'] | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 |
| external_references[3]['url'] | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Tyson Macaulay', 'description': 'Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 ', 'url': 'https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false'} |
[T0817] Drive-by Compromise
Current version: 1.0
|
|
|---|
| t | Adversaries may gain access to a system during a drive-by co | t | Adversaries may gain access to a system during a drive-by co |
| mpromise, when a user visits a website as part of a regular | | mpromise, when a user visits a website as part of a regular |
| browsing session.With this technique, the user's web browser | | browsing session. With this technique, the user's web browse |
| is targeted and exploited simply by visiting the compromise | | r is targeted and exploited simply by visiting the compromis |
| d website. The adversary may target a specific community, | | ed website. The adversary may target a specific community, |
| such as trusted third party suppliers or other industry spec | | such as trusted third party suppliers or other industry spe |
| ific groups, which often visit the target website. This kind | | cific groups, which often visit the target website. This kin |
| of targeted attack relies on a common interest, and is know | | d of targeted attack relies on a common interest, and is kno |
| n as a strategic web compromise or watering hole attack. T | | wn as a strategic web compromise or watering hole attack. |
| he National Cyber Awareness System (NCAS) has issued a Techn | | The National Cyber Awareness System (NCAS) has issued a Tech |
| ical Alert (TA) regarding Russian government cyber activity | | nical Alert (TA) regarding Russian government cyber activity |
| targeting critical infrastructure sectors. (Citation: Cybers | | targeting critical infrastructure sectors. (Citation: Cyber |
| ecurity & Infrastructure Security Agency March 2018) Analysi | | security & Infrastructure Security Agency March 2018) Analys |
| s by DHS and FBI has noted two distinct categories of victim | | is by DHS and FBI has noted two distinct categories of victi |
| s in the Dragonfly campaign on the Western energy sector: st | | ms in the Dragonfly campaign on the Western energy sector: s |
| aging and intended targets. The adversary targeted the less | | taging and intended targets. The adversary targeted the less |
| secure networks of staging targets, including trusted third- | | secure networks of staging targets, including trusted third |
| party suppliers and related peripheral organizations. Initia | | -party suppliers and related peripheral organizations. Initi |
| l access to the intended targets used watering hole attacks | | al access to the intended targets used watering hole attacks |
| to target process control, ICS, and critical infrastructure | | to target process control, ICS, and critical infrastructure |
| related trade publications and informational websites. | | related trade publications and informational websites. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.918000+00:00 | 2022-09-20 18:27:54.818000+00:00 |
| description | Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session.With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website. The adversary may target a specific community, such as trusted third party suppliers or other industry specific groups, which often visit the target website. This kind of targeted attack relies on a common interest, and is known as a strategic web compromise or watering hole attack. The National Cyber Awareness System (NCAS) has issued a Technical Alert (TA) regarding Russian government cyber activity targeting critical infrastructure sectors. (Citation: Cybersecurity & Infrastructure Security Agency March 2018) Analysis by DHS and FBI has noted two distinct categories of victims in the Dragonfly campaign on the Western energy sector: staging and intended targets. The adversary targeted the less secure networks of staging targets, including trusted third-party suppliers and related peripheral organizations. Initial access to the intended targets used watering hole attacks to target process control, ICS, and critical infrastructure related trade publications and informational websites. | Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session. With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website.
The adversary may target a specific community, such as trusted third party suppliers or other industry specific groups, which often visit the target website. This kind of targeted attack relies on a common interest, and is known as a strategic web compromise or watering hole attack.
The National Cyber Awareness System (NCAS) has issued a Technical Alert (TA) regarding Russian government cyber activity targeting critical infrastructure sectors. (Citation: Cybersecurity & Infrastructure Security Agency March 2018) Analysis by DHS and FBI has noted two distinct categories of victims in the Dragonfly campaign on the Western energy sector: staging and intended targets. The adversary targeted the less secure networks of staging targets, including trusted third-party suppliers and related peripheral organizations. Initial access to the intended targets used watering hole attacks to target process control, ICS, and critical infrastructure related trade publications and informational websites. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0819] Exploit Public-Facing Application
Current version: 1.0
|
|
|---|
| t | Adversaries may leverage weaknesses to exploit internet-faci | t | Adversaries may leverage weaknesses to exploit internet-faci |
| ng software for initial access into an industrial network. I | | ng software for initial access into an industrial network. I |
| nternet-facing software may be user applications, underlying | | nternet-facing software may be user applications, underlying |
| networking implementations, an assets operating system, wea | | networking implementations, an assets operating system, wea |
| k defenses, etc. Targets of this technique may be intentiona | | k defenses, etc. Targets of this technique may be intentiona |
| lly exposed for the purpose of remote management and visibil | | lly exposed for the purpose of remote management and visibil |
| ity. An adversary may seek to target public-facing applica | | ity. An adversary may seek to target public-facing applicat |
| tions as they may provide direct access into an ICS environm | | ions as they may provide direct access into an ICS environme |
| ent or the ability to move into the ICS network. Publicly ex | | nt or the ability to move into the ICS network. Publicly exp |
| posed applications may be found through online tools that sc | | osed applications may be found through online tools that sca |
| an the internet for open ports and services. Version numbers | | n the internet for open ports and services. Version numbers |
| for the exposed application may provide adversaries an abil | | for the exposed application may provide adversaries an abili |
| ity to target specific known vulnerabilities. Exposed contro | | ty to target specific known vulnerabilities. Exposed control |
| l protocol or remote access ports found in Commonly Used Por | | protocol or remote access ports found in Commonly Used Port |
| t may be of interest by adversaries. | | may be of interest by adversaries. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.919000+00:00 | 2022-09-19 14:21:18.045000+00:00 |
| description | Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network. Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility. An adversary may seek to target public-facing applications as they may provide direct access into an ICS environment or the ability to move into the ICS network. Publicly exposed applications may be found through online tools that scan the internet for open ports and services. Version numbers for the exposed application may provide adversaries an ability to target specific known vulnerabilities. Exposed control protocol or remote access ports found in Commonly Used Port may be of interest by adversaries. | Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network. Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility.
An adversary may seek to target public-facing applications as they may provide direct access into an ICS environment or the ability to move into the ICS network. Publicly exposed applications may be found through online tools that scan the internet for open ports and services. Version numbers for the exposed application may provide adversaries an ability to target specific known vulnerabilities. Exposed control protocol or remote access ports found in Commonly Used Port may be of interest by adversaries. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'ICS CERT 14-281', 'description': 'ICS-CERT. (2014, December 10). ICS Alert (ICS-ALERT-14-281-01E) Ongoing Sophisticated Malware Campaign Compromising ICS (Update E). Retrieved October 11, 2019.', 'url': 'https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B'} | |
[T0866] Exploitation of Remote Services
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.922000+00:00 | 2022-09-20 19:23:07.842000+00:00 |
| description | Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service abuse. A common goal for post-compromise exploitation of remote services is for initial access into and lateral movement throughout the ICS environment to enable access to targeted systems. (Citation: Enterprise ATT&CK) ICS asset owners and operators have been affected by ransomware (or disruptive malware masquerading as ransomware) migrating from enterprise IT to ICS environments: WannaCry, NotPetya, and BadRabbit. In each of these cases, self-propagating (wormable) malware initially infected IT networks, but through exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks, producing significant impacts. (Citation: Joe Slowik April 2019) | Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service abuse. A common goal for post-compromise exploitation of remote services is for initial access into and lateral movement throughout the ICS environment to enable access to targeted systems. (Citation: Enterprise ATT&CK)
ICS asset owners and operators have been affected by ransomware (or disruptive malware masquerading as ransomware) migrating from enterprise IT to ICS environments: WannaCry, NotPetya, and BadRabbit. In each of these cases, self-propagating (wormable) malware initially infected IT networks, but through exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks, producing significant impacts. (Citation: Joe Slowik April 2019) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0822] External Remote Services
Current version: 1.0
|
|
|---|
| t | Adversaries may leverage external remote services as a point | t | Adversaries may leverage external remote services as a point |
| of initial access into your network. These services allow u | | of initial access into your network. These services allow u |
| sers to connect to internal network resources from external | | sers to connect to internal network resources from external |
| locations. Examples are VPNs, Citrix, and other access mecha | | locations. Examples are VPNs, Citrix, and other access mecha |
| nisms. Remote service gateways often manage connections and | | nisms. Remote service gateways often manage connections and |
| credential authentication for these services. (Citation: Dan | | credential authentication for these services. (Citation: Dan |
| iel Oakley, Travis Smith, Tripwire) External remote service | | iel Oakley, Travis Smith, Tripwire) External remote service |
| s allow administration of a control system from outside the | | s allow administration of a control system from outside the |
| system. Often, vendors and internal engineering groups have | | system. Often, vendors and internal engineering groups have |
| access to external remote services to control system network | | access to external remote services to control system network |
| s via the corporate network. In some cases, this access is e | | s via the corporate network. In some cases, this access is e |
| nabled directly from the internet. While remote access enabl | | nabled directly from the internet. While remote access enabl |
| es ease of maintenance when a control system is in a remote | | es ease of maintenance when a control system is in a remote |
| area, compromise of remote access solutions is a liability. | | area, compromise of remote access solutions is a liability. |
| The adversary may use these services to gain access to and e | | The adversary may use these services to gain access to and e |
| xecute attacks against a control system network. Access to v | | xecute attacks against a control system network. Access to v |
| alid accounts is often a requirement. As they look for an | | alid accounts is often a requirement. As they look for an |
| entry point into the control system network, adversaries may | | entry point into the control system network, adversaries may |
| begin searching for existing pointtopoint VPN implementatio | | begin searching for existing point-to-point VPN implementat |
| ns at trusted third party networks or through remote support | | ions at trusted third party networks or through remote suppo |
| employee connections where split tunneling is enabled. (Cit | | rt employee connections where split tunneling is enabled. (C |
| ation: Electricity Information Sharing and Analysis Center; | | itation: Electricity Information Sharing and Analysis Center |
| SANS Industrial Control Systems March 2016) In the Maroochy | | ; SANS Industrial Control Systems March 2016) In the Marooc |
| Attack, the adversary was able to gain remote computer acce | | hy Shire attack, the adversary gained remote computer access |
| ss to the system over radio. | | to the system over radio.(Citation: Marshall Abrams July 20 |
| | | 08) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.923000+00:00 | 2022-10-20 18:07:53.764000+00:00 |
| description | Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. (Citation: Daniel Oakley, Travis Smith, Tripwire) External remote services allow administration of a control system from outside the system. Often, vendors and internal engineering groups have access to external remote services to control system networks via the corporate network. In some cases, this access is enabled directly from the internet. While remote access enables ease of maintenance when a control system is in a remote area, compromise of remote access solutions is a liability. The adversary may use these services to gain access to and execute attacks against a control system network. Access to valid accounts is often a requirement. As they look for an entry point into the control system network, adversaries may begin searching for existing pointtopoint VPN implementations at trusted third party networks or through remote support employee connections where split tunneling is enabled. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) In the Maroochy Attack, the adversary was able to gain remote computer access to the system over radio. | Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. (Citation: Daniel Oakley, Travis Smith, Tripwire)
External remote services allow administration of a control system from outside the system. Often, vendors and internal engineering groups have access to external remote services to control system networks via the corporate network. In some cases, this access is enabled directly from the internet. While remote access enables ease of maintenance when a control system is in a remote area, compromise of remote access solutions is a liability. The adversary may use these services to gain access to and execute attacks against a control system network. Access to valid accounts is often a requirement.
As they look for an entry point into the control system network, adversaries may begin searching for existing point-to-point VPN implementations at trusted third party networks or through remote support employee connections where split tunneling is enabled. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)
In the Maroochy Shire attack, the adversary gained remote computer access to the system over radio.(Citation: Marshall Abrams July 2008) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Marshall Abrams July 2008', 'description': 'Marshall Abrams 2008, July 23 Malicious Control System Cyber Security Attack Case Study Maroochy Water Services, Australia Retrieved. 2018/03/27 ', 'url': 'https://web.archive.org/web/20200802103218/https://www.mitre.org/sites/default/files/pdf/08_1145.pdf'} |
[T0872] Indicator Removal on Host
Current version: 1.0
Dropped Detections:
- DS0002: User Account (User Account Authentication)
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.927000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0883] Internet Accessible Device
Current version: 1.0
|
|
|---|
| t | Adversaries may gain access into industrial environments thr | t | Adversaries may gain access into industrial environments thr |
| ough systems exposed directly to the internet for remote acc | | ough systems exposed directly to the internet for remote acc |
| ess rather than through [External Remote Services](https://a | | ess rather than through [External Remote Services](https://a |
| ttack.mitre.org/techniques/T0822). Internet Accessible Devic | | ttack.mitre.org/techniques/T0822). Internet Accessible Devic |
| es are exposed to the internet unintentionally or intentiona | | es are exposed to the internet unintentionally or intentiona |
| lly without adequate protections. This may allow for adversa | | lly without adequate protections. This may allow for adversa |
| ries to move directly into the control system network. Acces | | ries to move directly into the control system network. Acces |
| s onto these devices is accomplished without the use of expl | | s onto these devices is accomplished without the use of expl |
| oits, these would be represented within the [Exploit Public- | | oits, these would be represented within the [Exploit Public- |
| Facing Application](https://attack.mitre.org/techniques/T081 | | Facing Application](https://attack.mitre.org/techniques/T081 |
| 9) technique. Adversaries may leverage built in functions | | 9) technique. Adversaries may leverage built in functions f |
| for remote access which may not be protected or utilize mini | | or remote access which may not be protected or utilize minim |
| mal legacy protections that may be targeted. (Citation: NCCI | | al legacy protections that may be targeted. (Citation: NCCIC |
| C January 2014) These services may be discoverable through t | | January 2014) These services may be discoverable through th |
| he use of online scanning tools. In the case of the Bowman | | e use of online scanning tools. In the case of the Bowman |
| dam incident, adversaries leveraged access to the dam contr | | dam incident, adversaries leveraged access to the dam contro |
| ol network through a cellular modem. Access to the device wa | | l network through a cellular modem. Access to the device was |
| s protected by password authentication, although the applica | | protected by password authentication, although the applicat |
| tion was vulnerable to brute forcing. (Citation: NCCIC Janua | | ion was vulnerable to brute forcing. (Citation: NCCIC Januar |
| ry 2014) (Citation: Danny Yadron December 2015) (Citation: M | | y 2014) (Citation: Danny Yadron December 2015) (Citation: Ma |
| ark Thompson March 2016) In Trend Micros manufacturing dece | | rk Thompson March 2016) In Trend Micros manufacturing decep |
| ption operations adversaries were detected leveraging direct | | tion operations adversaries were detected leveraging direct |
| internet access to an ICS environment through the exposure | | internet access to an ICS environment through the exposure o |
| of operational protocols such as Siemens S7, Omron FINS, and | | f operational protocols such as Siemens S7, Omron FINS, and |
| EtherNet/IP, in addition to misconfigured VNC access. (Cita | | EtherNet/IP, in addition to misconfigured VNC access. (Citat |
| tion: Stephen Hilt, Federico Maggi, Charles Perine, Lord Rem | | ion: Stephen Hilt, Federico Maggi, Charles Perine, Lord Remo |
| orin, Martin Rsler, and Rainer Vosseler) | | rin, Martin Rsler, and Rainer Vosseler) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.930000+00:00 | 2022-09-19 14:34:43.060000+00:00 |
| description | Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through [External Remote Services](https://attack.mitre.org/techniques/T0822). Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T0819) technique. Adversaries may leverage built in functions for remote access which may not be protected or utilize minimal legacy protections that may be targeted. (Citation: NCCIC January 2014) These services may be discoverable through the use of online scanning tools. In the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing. (Citation: NCCIC January 2014) (Citation: Danny Yadron December 2015) (Citation: Mark Thompson March 2016) In Trend Micros manufacturing deception operations adversaries were detected leveraging direct internet access to an ICS environment through the exposure of operational protocols such as Siemens S7, Omron FINS, and EtherNet/IP, in addition to misconfigured VNC access. (Citation: Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler) | Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through [External Remote Services](https://attack.mitre.org/techniques/T0822). Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T0819) technique.
Adversaries may leverage built in functions for remote access which may not be protected or utilize minimal legacy protections that may be targeted. (Citation: NCCIC January 2014) These services may be discoverable through the use of online scanning tools.
In the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing. (Citation: NCCIC January 2014) (Citation: Danny Yadron December 2015) (Citation: Mark Thompson March 2016)
In Trend Micros manufacturing deception operations adversaries were detected leveraging direct internet access to an ICS environment through the exposure of operational protocols such as Siemens S7, Omron FINS, and EtherNet/IP, in addition to misconfigured VNC access. (Citation: Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | NCCIC January 2014 | Danny Yadron December 2015 |
| external_references[1]['description'] | NCCIC 2014, January 1 Internet Accessible Control Systems At Risk Retrieved. 2019/11/07 | Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 |
| external_references[1]['url'] | https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf | https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559 |
| external_references[2]['source_name'] | NCCIC January 2014 | Mark Thompson March 2016 |
| external_references[2]['description'] | NCCIC 2014, January 1 Internet Accessible Control Systems At Risk Retrieved. 2019/11/07 | Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 |
| external_references[2]['url'] | https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf | https://time.com/4270728/iran-cyber-attack-dam-fbi/ |
| external_references[3]['source_name'] | Danny Yadron December 2015 | NCCIC January 2014 |
| external_references[3]['description'] | Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 | NCCIC 2014, January 1 Internet Accessible Control Systems At Risk Retrieved. 2019/11/07 |
| external_references[3]['url'] | https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559 | https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf |
| external_references[4]['source_name'] | Mark Thompson March 2016 | Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler |
| external_references[4]['description'] | Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 | Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats Retrieved. 2021/04/12 |
| external_references[4]['url'] | https://time.com/4270728/iran-cyber-attack-dam-fbi/ | https://documents.trendmicro.com/assets/white_papers/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler', 'description': 'Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats Retrieved. 2021/04/12 ', 'url': 'https://documents.trendmicro.com/assets/white_papers/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf'} | |
[T0826] Loss of Availability
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.934000+00:00 | 2022-09-19 14:36:34.715000+00:00 |
| description | Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) Adversaries may leverage malware to delete or encrypt critical data on HMIs, workstations, or databases. In the 2021 Colonial Pipeline ransomware incident, pipeline operations were temporally halted on May 7th and were not fully restarted until May 12th. (Citation: Colonial Pipeline Company May 2021) | Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
Adversaries may leverage malware to delete or encrypt critical data on HMIs, workstations, or databases.
In the 2021 Colonial Pipeline ransomware incident, pipeline operations were temporally halted on May 7th and were not fully restarted until May 12th. (Citation: Colonial Pipeline Company May 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Corero | Colonial Pipeline Company May 2021 |
| external_references[1]['description'] | Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 | Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 |
| external_references[1]['url'] | https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf | https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption |
| external_references[2]['source_name'] | Michael J. Assante and Robert M. Lee | Corero |
| external_references[2]['description'] | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 | Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 |
| external_references[2]['url'] | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 | https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf |
| external_references[3]['source_name'] | Tyson Macaulay | Michael J. Assante and Robert M. Lee |
| external_references[3]['description'] | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 |
| external_references[3]['url'] | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 |
| external_references[4]['source_name'] | Colonial Pipeline Company May 2021 | Tyson Macaulay |
| external_references[4]['description'] | Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 |
| external_references[4]['url'] | https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false |
[T0827] Loss of Control
Current version: 1.0
|
|
|---|
| t | Adversaries may seek to achieve a sustained loss of control | t | Adversaries may seek to achieve a sustained loss of control |
| or a runaway condition in which operators cannot issue any c | | or a runaway condition in which operators cannot issue any c |
| ommands even if the malicious interference has subsided. (Ci | | ommands even if the malicious interference has subsided. (Ci |
| tation: Corero) (Citation: Michael J. Assante and Robert M. | | tation: Corero) (Citation: Michael J. Assante and Robert M. |
| Lee) (Citation: Tyson Macaulay) The German Federal Office f | | Lee) (Citation: Tyson Macaulay) The German Federal Office f |
| or Information Security (BSI) reported a targeted attack on | | or Information Security (BSI) reported a targeted attack on |
| a steel mill in its 2014 IT Security Report. (Citation: BSI | | a steel mill in its 2014 IT Security Report.(Citation: BSI S |
| State of IT Security 2014) These targeted attacks affected | | tate of IT Security 2014) These targeted attacks affected in |
| industrial operations and resulted in breakdowns of control | | dustrial operations and resulted in breakdowns of control sy |
| system components and even entire installations. As a result | | stem components and even entire installations. As a result o |
| of these breakdowns, massive impact resulted in damage and | | f these breakdowns, massive impact resulted in damage and un |
| unsafe conditions from the uncontrolled shutdown of a blast | | safe conditions from the uncontrolled shutdown of a blast fu |
| furnace. | | rnace. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.936000+00:00 | 2022-09-19 14:38:06.130000+00:00 |
| description | Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill in its 2014 IT Security Report. (Citation: BSI State of IT Security 2014) These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact resulted in damage and unsafe conditions from the uncontrolled shutdown of a blast furnace. | Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
The German Federal Office for Information Security (BSI) reported a targeted attack on a steel mill in its 2014 IT Security Report.(Citation: BSI State of IT Security 2014) These targeted attacks affected industrial operations and resulted in breakdowns of control system components and even entire installations. As a result of these breakdowns, massive impact resulted in damage and unsafe conditions from the uncontrolled shutdown of a blast furnace. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Corero | BSI State of IT Security 2014 |
| external_references[1]['description'] | Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 | Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 |
| external_references[1]['url'] | https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf | https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3 |
| external_references[2]['source_name'] | Michael J. Assante and Robert M. Lee | Corero |
| external_references[2]['description'] | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 | Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 |
| external_references[2]['url'] | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 | https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf |
| external_references[3]['source_name'] | Tyson Macaulay | Michael J. Assante and Robert M. Lee |
| external_references[3]['description'] | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 | Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 |
| external_references[3]['url'] | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false | https://www.sans.org/reading-room/whitepapers/ICS/industrial-control-system-cyber-kill-chain-36297 |
| external_references[4]['source_name'] | BSI State of IT Security 2014 | Tyson Macaulay |
| external_references[4]['description'] | Bundesamt fr Sicherheit in der Informationstechnik (BSI) (German Federal Office for Information Security) 2014 Die Lage der IT-Sicherheit in Deutschland 2014 (The State of IT Security in Germany) Retrieved. 2019/10/30 | Tyson Macaulay Michael J. Assante and Robert M. Lee Corero Industrial Control System (ICS) Security Retrieved. 2019/11/04 The Industrial Control System Cyber Kill Chain Retrieved. 2019/11/04 RIoT Control: Understanding and Managing Risks and the Internet of Things Retrieved. 2019/11/04 |
| external_references[4]['url'] | https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3 | https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false |
[T0828] Loss of Productivity and Revenue
Current version: 1.0
|
|
|---|
| t | Adversaries may cause loss of productivity and revenue throu | t | Adversaries may cause loss of productivity and revenue throu |
| gh disruption and even damage to the availability and integr | | gh disruption and even damage to the availability and integr |
| ity of control system operations, devices, and related proce | | ity of control system operations, devices, and related proce |
| sses. This technique may manifest as a direct effect of an I | | sses. This technique may manifest as a direct effect of an I |
| CS-targeting attack or tangentially, due to an IT-targeting | | CS-targeting attack or tangentially, due to an IT-targeting |
| attack against non-segregated environments. In cases where | | attack against non-segregated environments. In cases where |
| these operations or services are brought to a halt, the los | | these operations or services are brought to a halt, the los |
| s of productivity may eventually present an impact for the e | | s of productivity may eventually present an impact for the e |
| nd-users or consumers of products and services. The disrupte | | nd-users or consumers of products and services. The disrupte |
| d supply-chain may result in supply shortages and increased | | d supply-chain may result in supply shortages and increased |
| prices, among other consequences. A ransomware attack on a | | prices, among other consequences. A ransomware attack on a |
| n Australian beverage company resulted in the shutdown of so | | n Australian beverage company resulted in the shutdown of so |
| me manufacturing sites, including precautionary halts to pro | | me manufacturing sites, including precautionary halts to pro |
| tect key systems. (Citation: Paganini, Pierluigi June 2020) | | tect key systems. (Citation: Paganini, Pierluigi June 2020) |
| The company announced the potential for temporary shortages | | The company announced the potential for temporary shortages |
| of their products following the attack. (Citation: Paganini, | | of their products following the attack. (Citation: Paganini, |
| Pierluigi June 2020) (Citation: Lion Corporation June 2020) | | Pierluigi June 2020) (Citation: Lion Corporation June 2020) |
| In the 2021 Colonial Pipeline ransomware incident, the pip | | In the 2021 Colonial Pipeline ransomware incident, the pi |
| eline was unable to transport approximately 2.5 million barr | | peline was unable to transport approximately 2.5 million bar |
| els of fuel per day to the East Coast. (Citation: Colonial | | rels of fuel per day to the East Coast. (Citation: Colonial |
| Pipeline Company May 2021) | | Pipeline Company May 2021) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.938000+00:00 | 2022-09-20 19:31:11.106000+00:00 |
| description | Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments. In cases where these operations or services are brought to a halt, the loss of productivity may eventually present an impact for the end-users or consumers of products and services. The disrupted supply-chain may result in supply shortages and increased prices, among other consequences. A ransomware attack on an Australian beverage company resulted in the shutdown of some manufacturing sites, including precautionary halts to protect key systems. (Citation: Paganini, Pierluigi June 2020) The company announced the potential for temporary shortages of their products following the attack. (Citation: Paganini, Pierluigi June 2020) (Citation: Lion Corporation June 2020) In the 2021 Colonial Pipeline ransomware incident, the pipeline was unable to transport approximately 2.5 million barrels of fuel per day to the East Coast. (Citation: Colonial Pipeline Company May 2021) | Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments.
In cases where these operations or services are brought to a halt, the loss of productivity may eventually present an impact for the end-users or consumers of products and services. The disrupted supply-chain may result in supply shortages and increased prices, among other consequences.
A ransomware attack on an Australian beverage company resulted in the shutdown of some manufacturing sites, including precautionary halts to protect key systems. (Citation: Paganini, Pierluigi June 2020) The company announced the potential for temporary shortages of their products following the attack. (Citation: Paganini, Pierluigi June 2020) (Citation: Lion Corporation June 2020)
In the 2021 Colonial Pipeline ransomware incident, the pipeline was unable to transport approximately 2.5 million barrels of fuel per day to the East Coast. (Citation: Colonial Pipeline Company May 2021) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Paganini, Pierluigi June 2020 | Colonial Pipeline Company May 2021 |
| external_references[1]['description'] | Paganini, Pierluigi 2020, June 14 Ransomware attack disrupts operations at Australian beverage company Lion Retrieved. 2021/10/08 | Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 |
| external_references[1]['url'] | https://securityaffairs.co/wordpress/104749/cyber-crime/ransomware-attack-hit-lion.html | https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption |
| external_references[2]['source_name'] | Paganini, Pierluigi June 2020 | Lion Corporation June 2020 |
| external_references[2]['description'] | Paganini, Pierluigi 2020, June 14 Ransomware attack disrupts operations at Australian beverage company Lion Retrieved. 2021/10/08 | Lion Corporation 2020, June 26 Lion Cyber incident update: 26 June 2020 Retrieved. 2021/10/08 |
| external_references[2]['url'] | https://securityaffairs.co/wordpress/104749/cyber-crime/ransomware-attack-hit-lion.html | https://lionco.com/2020/06/26/lion-update-re-cyber-issue/ |
| external_references[3]['source_name'] | Lion Corporation June 2020 | Paganini, Pierluigi June 2020 |
| external_references[3]['description'] | Lion Corporation 2020, June 26 Lion Cyber incident update: 26 June 2020 Retrieved. 2021/10/08 | Paganini, Pierluigi 2020, June 14 Ransomware attack disrupts operations at Australian beverage company Lion Retrieved. 2021/10/08 |
| external_references[3]['url'] | https://lionco.com/2020/06/26/lion-update-re-cyber-issue/ | https://securityaffairs.co/wordpress/104749/cyber-crime/ransomware-attack-hit-lion.html |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Colonial Pipeline Company May 2021', 'description': 'Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 ', 'url': 'https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption'} | |
[T0837] Loss of Protection
Current version: 1.0
|
|
|---|
| t | Adversaries may compromise protective system functions desig | t | Adversaries may compromise protective system functions desig |
| ned to prevent the effects of faults and abnormal conditions | | ned to prevent the effects of faults and abnormal conditions |
| . This can result in equipment damage, prolonged process dis | | . This can result in equipment damage, prolonged process dis |
| ruptions and hazards to personnel. Many faults and abnormal | | ruptions and hazards to personnel. Many faults and abnorma |
| conditions in process control happen too quickly for a huma | | l conditions in process control happen too quickly for a hum |
| n operator to react to. Speed is critical in correcting thes | | an operator to react to. Speed is critical in correcting the |
| e conditions to limit serious impacts such as Loss of Contro | | se conditions to limit serious impacts such as Loss of Contr |
| l and Property Damage. Adversaries may target and disable p | | ol and Property Damage. Adversaries may target and disable |
| rotective system functions as a prerequisite to subsequent a | | protective system functions as a prerequisite to subsequent |
| ttack execution or to allow for future faults and abnormal c | | attack execution or to allow for future faults and abnormal |
| onditions to go unchecked. Detection of a Loss of Protection | | conditions to go unchecked. Detection of a Loss of Protecti |
| by operators can result in the shutdown of a process due to | | on by operators can result in the shutdown of a process due |
| strict policies regarding protection systems. This can caus | | to strict policies regarding protection systems. This can ca |
| e a Loss of Productivity and Revenue and may meet the techni | | use a Loss of Productivity and Revenue and may meet the tech |
| cal goals of adversaries seeking to cause process disruption | | nical goals of adversaries seeking to cause process disrupti |
| s. }}" | | ons. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.938000+00:00 | 2022-09-19 14:40:19.570000+00:00 |
| description | Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions. This can result in equipment damage, prolonged process disruptions and hazards to personnel. Many faults and abnormal conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage. Adversaries may target and disable protective system functions as a prerequisite to subsequent attack execution or to allow for future faults and abnormal conditions to go unchecked. Detection of a Loss of Protection by operators can result in the shutdown of a process due to strict policies regarding protection systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions. }}" | Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions. This can result in equipment damage, prolonged process disruptions and hazards to personnel.
Many faults and abnormal conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage.
Adversaries may target and disable protective system functions as a prerequisite to subsequent attack execution or to allow for future faults and abnormal conditions to go unchecked. Detection of a Loss of Protection by operators can result in the shutdown of a process due to strict policies regarding protection systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0880] Loss of Safety
Current version: 1.0
|
|
|---|
| t | Adversaries may compromise safety system functions designed | t | Adversaries may compromise safety system functions designed |
| to maintain safe operation of a process when unacceptable or | | to maintain safe operation of a process when unacceptable or |
| dangerous conditions occur. Safety systems are often compos | | dangerous conditions occur. Safety systems are often compos |
| ed of the same elements as control systems but have the sole | | ed of the same elements as control systems but have the sole |
| purpose of ensuring the process fails in a predetermined sa | | purpose of ensuring the process fails in a predetermined sa |
| fe manner. Many unsafe conditions in process control happen | | fe manner. Many unsafe conditions in process control happe |
| too quickly for a human operator to react to. Speed is crit | | n too quickly for a human operator to react to. Speed is cri |
| ical in correcting these conditions to limit serious impacts | | tical in correcting these conditions to limit serious impact |
| such as Loss of Control and Property Damage. Adversaries m | | s such as Loss of Control and Property Damage. Adversaries |
| ay target and disable safety system functions as a prerequis | | may target and disable safety system functions as a prerequ |
| ite to subsequent attack execution or to allow for future un | | isite to subsequent attack execution or to allow for future |
| safe conditionals to go unchecked. Detection of a Loss of Sa | | unsafe conditionals to go unchecked. Detection of a Loss of |
| fety by operators can result in the shutdown of a process du | | Safety by operators can result in the shutdown of a process |
| e to strict policies regarding safety systems. This can caus | | due to strict policies regarding safety systems. This can ca |
| e a Loss of Productivity and Revenue and may meet the techni | | use a Loss of Productivity and Revenue and may meet the tech |
| cal goals of adversaries seeking to cause process disruption | | nical goals of adversaries seeking to cause process disrupti |
| s. | | ons. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.939000+00:00 | 2022-09-19 14:41:41.466000+00:00 |
| description | Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur. Safety systems are often composed of the same elements as control systems but have the sole purpose of ensuring the process fails in a predetermined safe manner. Many unsafe conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage. Adversaries may target and disable safety system functions as a prerequisite to subsequent attack execution or to allow for future unsafe conditionals to go unchecked. Detection of a Loss of Safety by operators can result in the shutdown of a process due to strict policies regarding safety systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions. | Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur. Safety systems are often composed of the same elements as control systems but have the sole purpose of ensuring the process fails in a predetermined safe manner.
Many unsafe conditions in process control happen too quickly for a human operator to react to. Speed is critical in correcting these conditions to limit serious impacts such as Loss of Control and Property Damage.
Adversaries may target and disable safety system functions as a prerequisite to subsequent attack execution or to allow for future unsafe conditionals to go unchecked. Detection of a Loss of Safety by operators can result in the shutdown of a process due to strict policies regarding safety systems. This can cause a Loss of Productivity and Revenue and may meet the technical goals of adversaries seeking to cause process disruptions. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0829] Loss of View
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.940000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0832] Manipulation of View
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.947000+00:00 | 2022-09-20 19:30:22.792000+00:00 |
| description | Adversaries may attempt to manipulate the information reported back to operators or controllers. This manipulation may be short term or sustained. During this time the process itself could be in a much different state than what is reported. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay) Operators may be fooled into doing something that is harmful to the system in a loss of view situation. With a manipulated view into the systems, operators may issue inappropriate control sequences that introduce faults or catastrophic failures into the system. Business analysis systems can also be provided with inaccurate data leading to bad management decisions. | Adversaries may attempt to manipulate the information reported back to operators or controllers. This manipulation may be short term or sustained. During this time the process itself could be in a much different state than what is reported. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
Operators may be fooled into doing something that is harmful to the system in a loss of view situation. With a manipulated view into the systems, operators may issue inappropriate control sequences that introduce faults or catastrophic failures into the system. Business analysis systems can also be provided with inaccurate data leading to bad management decisions. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0801] Monitor Process State
Current version: 1.0
New Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.955000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0834] Native API
Current version: 1.0
|
|
|---|
| t | Adversaries may directly interact with the native OS applica | t | Adversaries may directly interact with the native OS applica |
| tion programming interface (API) to access system functions. | | tion programming interface (API) to access system functions. |
| Native APIs provide a controlled means of calling low-level | | Native APIs provide a controlled means of calling low-level |
| OS services within the kernel, such as those involving hard | | OS services within the kernel, such as those involving hard |
| ware/devices, memory, and processes. (Citation: The MITRE Co | | ware/devices, memory, and processes. (Citation: The MITRE Co |
| rporation May 2017) These native APIs are leveraged by the O | | rporation May 2017) These native APIs are leveraged by the O |
| S during system boot (when other system components are not y | | S during system boot (when other system components are not y |
| et initialized) as well as carrying out tasks and requests d | | et initialized) as well as carrying out tasks and requests d |
| uring routine operations. Functionality provided by native | | uring routine operations. Functionality provided by native |
| APIs are often also exposed to user-mode applications via in | | APIs are often also exposed to user-mode applications via i |
| terfaces and libraries. For example, functions such as memcp | | nterfaces and libraries. For example, functions such as memc |
| y and direct operations on memory registers can be used to m | | py and direct operations on memory registers can be used to |
| odify user and system memory space. | | modify user and system memory space. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.956000+00:00 | 2022-09-19 14:52:28.584000+00:00 |
| description | Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. (Citation: The MITRE Corporation May 2017) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space. | Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. (Citation: The MITRE Corporation May 2017) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0842] Network Sniffing
Current version: 1.0
|
|
|---|
| t | Network sniffing is the practice of using a network interfac | t | Network sniffing is the practice of using a network interfac |
| e on a computer system to monitor or capture information (Ci | | e on a computer system to monitor or capture information (Ci |
| tation: Enterprise ATT&CK January 2018) regardless of whethe | | tation: Enterprise ATT&CK January 2018) regardless of whethe |
| r it is the specified destination for the information. An | | r it is the specified destination for the information. An |
| adversary may attempt to sniff the traffic to gain informat | | adversary may attempt to sniff the traffic to gain informati |
| ion about the target. This information can vary in the leve | | on about the target. This information can vary in the level |
| l of importance. Relatively unimportant information is gene | | of importance. Relatively unimportant information is general |
| ral communications to and from machines. Relatively importa | | communications to and from machines. Relatively important |
| nt information would be login information. User credentials | | information would be login information. User credentials may |
| may be sent over an unencrypted protocol, such as [https:// | | be sent over an unencrypted protocol, such as Telnet, that |
| tools.ietf.org/html/rfc854 Telnet], that can be captured and | | can be captured and obtained through network packet analysis |
| obtained through network packet analysis. In addition, ARP | | . In addition, ARP and Domain Name Service (DNS) poisoning |
| and Domain Name Service (DNS) poisoning can be used to capt | | can be used to capture credentials to websites, proxies, an |
| ure credentials to websites, proxies, and internal systems b | | d internal systems by redirecting traffic to an adversary. |
| y redirecting traffic to an adversary. | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.958000+00:00 | 2022-09-20 19:22:11.937000+00:00 |
| description | Network sniffing is the practice of using a network interface on a computer system to monitor or capture information (Citation: Enterprise ATT&CK January 2018) regardless of whether it is the specified destination for the information. An adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines. Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as [https://tools.ietf.org/html/rfc854 Telnet], that can be captured and obtained through network packet analysis. In addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. | Network sniffing is the practice of using a network interface on a computer system to monitor or capture information (Citation: Enterprise ATT&CK January 2018) regardless of whether it is the specified destination for the information.
An adversary may attempt to sniff the traffic to gain information about the target. This information can vary in the level of importance. Relatively unimportant information is general communications to and from machines. Relatively important information would be login information. User credentials may be sent over an unencrypted protocol, such as Telnet, that can be captured and obtained through network packet analysis.
In addition, ARP and Domain Name Service (DNS) poisoning can be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0845] Program Upload
Current version: 1.0
New Detections:
- DS0029: Network Traffic (Network Traffic Flow)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.960000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0873] Project File Infection
Current version: 1.0
|
|
|---|
| t | Adversaries may attempt to infect project files with malicio | t | Adversaries may attempt to infect project files with malicio |
| us code. These project files may consist of objects, program | | us code. These project files may consist of objects, program |
| organization units, variables such as tags, documentation, | | organization units, variables such as tags, documentation, |
| and other configurations needed for PLC programs to function | | and other configurations needed for PLC programs to function |
| . (Citation: Beckhoff) Using built in functions of the engin | | . (Citation: Beckhoff) Using built in functions of the engin |
| eering software, adversaries may be able to download an infe | | eering software, adversaries may be able to download an infe |
| cted program to a PLC in the operating environment enabling | | cted program to a PLC in the operating environment enabling |
| further [[execution]] and [[persistence]] techniques. (Citat | | further [execution](http://attacksite.mitre.org/tactics/TA01 |
| ion: PLCdev) Adversaries may export their own code into pro | | 04/) and [persistence](http://attacksite.mitre.org/tactics/T |
| ject files with conditions to execute at specific intervals. | | A0110/) techniques. (Citation: PLCdev) Adversaries may exp |
| (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien Febr | | ort their own code into project files with conditions to exe |
| uary 2011) Malicious programs allow adversaries control of a | | cute at specific intervals. (Citation: Nicolas Falliere, Lia |
| ll aspects of the process enabled by the PLC. Once the proje | | m O Murchu, Eric Chien February 2011) Malicious programs all |
| ct file is downloaded to a PLC the workstation device may be | | ow adversaries control of all aspects of the process enabled |
| disconnected with the infected project file still executing | | by the PLC. Once the project file is downloaded to a PLC th |
| . (Citation: PLCdev) | | e workstation device may be disconnected with the infected p |
| | | roject file still executing. (Citation: PLCdev) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.963000+00:00 | 2022-09-20 18:37:59.276000+00:00 |
| description | Adversaries may attempt to infect project files with malicious code. These project files may consist of objects, program organization units, variables such as tags, documentation, and other configurations needed for PLC programs to function. (Citation: Beckhoff) Using built in functions of the engineering software, adversaries may be able to download an infected program to a PLC in the operating environment enabling further [[execution]] and [[persistence]] techniques. (Citation: PLCdev) Adversaries may export their own code into project files with conditions to execute at specific intervals. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) Malicious programs allow adversaries control of all aspects of the process enabled by the PLC. Once the project file is downloaded to a PLC the workstation device may be disconnected with the infected project file still executing. (Citation: PLCdev) | Adversaries may attempt to infect project files with malicious code. These project files may consist of objects, program organization units, variables such as tags, documentation, and other configurations needed for PLC programs to function. (Citation: Beckhoff) Using built in functions of the engineering software, adversaries may be able to download an infected program to a PLC in the operating environment enabling further [execution](http://attacksite.mitre.org/tactics/TA0104/) and [persistence](http://attacksite.mitre.org/tactics/TA0110/) techniques. (Citation: PLCdev)
Adversaries may export their own code into project files with conditions to execute at specific intervals. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011) Malicious programs allow adversaries control of all aspects of the process enabled by the PLC. Once the project file is downloaded to a PLC the workstation device may be disconnected with the infected project file still executing. (Citation: PLCdev) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[2]['source_name'] | PLCdev | Nicolas Falliere, Liam O Murchu, Eric Chien February 2011 |
| external_references[2]['description'] | PLCdev Beckhoff TwinCAT 3 Source Control: Project Files Retrieved. 2019/11/21 Siemens SIMATIC Step 7 Programmer's Handbook Retrieved. 2019/11/21 | Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 |
| external_references[2]['url'] | http://www.plcdev.com/book/export/html/373 | https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf |
| external_references[3]['source_name'] | Nicolas Falliere, Liam O Murchu, Eric Chien February 2011 | PLCdev |
| external_references[3]['description'] | Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 | PLCdev Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 Siemens SIMATIC Step 7 Programmer's Handbook Retrieved. 2019/11/21 |
| external_references[3]['url'] | https://www.wired.com/images_blogs/threatlevel/2011/02/Symantec-Stuxnet-Update-Feb-2011.pdf | http://www.plcdev.com/book/export/html/373 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'PLCdev', 'description': "PLCdev Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22 Siemens SIMATIC Step 7 Programmer's Handbook Retrieved. 2019/11/21 ", 'url': 'http://www.plcdev.com/book/export/html/373'} | |
[T0847] Replication Through Removable Media
Current version: 1.0
|
|
|---|
| t | Adversaries may move onto systems, such as those separated f | t | Adversaries may move onto systems, such as those separated f |
| rom the enterprise network, by copying malware to removable | | rom the enterprise network, by copying malware to removable |
| media which is inserted into the control systems environment | | media which is inserted into the control systems environment |
| . The adversary may rely on unknowing trusted third parties, | | . The adversary may rely on unknowing trusted third parties, |
| such as suppliers or contractors with access privileges, to | | such as suppliers or contractors with access privileges, to |
| introduce the removable media. This technique enables initi | | introduce the removable media. This technique enables initi |
| al access to target devices that never connect to untrusted | | al access to target devices that never connect to untrusted |
| networks, but are physically accessible. Operators of th | | networks, but are physically accessible. Operators of |
| e German nuclear power plant, Gundremmingen, discovered malw | | the German nuclear power plant, Gundremmingen, discovered ma |
| are on a facility computer not connected to the internet. (C | | lware on a facility computer not connected to the internet. |
| itation: Kernkraftwerk Gundremmingen April 2016) (Citation: | | (Citation: Kernkraftwerk Gundremmingen April 2016) (Citation |
| Trend Micro April 2016) The malware included Conficker and W | | : Trend Micro April 2016) The malware included Conficker and |
| 32.Ramnit, which were also found on eighteen removable disk | | W32.Ramnit, which were also found on eighteen removable dis |
| drives in the facility. (Citation: Christoph Steitz, Eric Au | | k drives in the facility. (Citation: Christoph Steitz, Eric |
| chard April 2016) (Citation: Catalin Cimpanu April 2016) (Ci | | Auchard April 2016) (Citation: Catalin Cimpanu April 2016) ( |
| tation: Peter Dockrill April 2016) (Citation: Lee Mathews Ap | | Citation: Peter Dockrill April 2016) (Citation: Lee Mathews |
| ril 2016) (Citation: Sean Gallagher April 2016) (Citation: D | | April 2016) (Citation: Sean Gallagher April 2016) (Citation: |
| ark Reading Staff April 2016) The plant has since checked fo | | Dark Reading Staff April 2016) The plant has since checked |
| r infection and cleaned up more than 1,000 computers. (Citat | | for infection and cleaned up more than 1,000 computers. (Cit |
| ion: BBC April 2016) An ESET researcher commented that inter | | ation: BBC April 2016) An ESET researcher commented that int |
| net disconnection does not guarantee system safety from infe | | ernet disconnection does not guarantee system safety from in |
| ction or payload execution. (Citation: ESET April 2016) | | fection or payload execution. (Citation: ESET April 2016) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.973000+00:00 | 2022-09-20 19:18:25.490000+00:00 |
| description | Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment. The adversary may rely on unknowing trusted third parties, such as suppliers or contractors with access privileges, to introduce the removable media. This technique enables initial access to target devices that never connect to untrusted networks, but are physically accessible. Operators of the German nuclear power plant, Gundremmingen, discovered malware on a facility computer not connected to the internet. (Citation: Kernkraftwerk Gundremmingen April 2016) (Citation: Trend Micro April 2016) The malware included Conficker and W32.Ramnit, which were also found on eighteen removable disk drives in the facility. (Citation: Christoph Steitz, Eric Auchard April 2016) (Citation: Catalin Cimpanu April 2016) (Citation: Peter Dockrill April 2016) (Citation: Lee Mathews April 2016) (Citation: Sean Gallagher April 2016) (Citation: Dark Reading Staff April 2016) The plant has since checked for infection and cleaned up more than 1,000 computers. (Citation: BBC April 2016) An ESET researcher commented that internet disconnection does not guarantee system safety from infection or payload execution. (Citation: ESET April 2016) | Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment. The adversary may rely on unknowing trusted third parties, such as suppliers or contractors with access privileges, to introduce the removable media. This technique enables initial access to target devices that never connect to untrusted networks, but are physically accessible.
Operators of the German nuclear power plant, Gundremmingen, discovered malware on a facility computer not connected to the internet. (Citation: Kernkraftwerk Gundremmingen April 2016) (Citation: Trend Micro April 2016) The malware included Conficker and W32.Ramnit, which were also found on eighteen removable disk drives in the facility. (Citation: Christoph Steitz, Eric Auchard April 2016) (Citation: Catalin Cimpanu April 2016) (Citation: Peter Dockrill April 2016) (Citation: Lee Mathews April 2016) (Citation: Sean Gallagher April 2016) (Citation: Dark Reading Staff April 2016) The plant has since checked for infection and cleaned up more than 1,000 computers. (Citation: BBC April 2016) An ESET researcher commented that internet disconnection does not guarantee system safety from infection or payload execution. (Citation: ESET April 2016) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[1]['source_name'] | Kernkraftwerk Gundremmingen April 2016 | BBC April 2016 |
| external_references[1]['description'] | Kernkraftwerk Gundremmingen 2016, April 25 Detektion von Bro-Schadsoftware an mehreren Rechnern Retrieved. 2019/10/14 | BBC 2016, April 28 German nuclear plant hit by computer viruses Retrieved. 2019/10/14 |
| external_references[1]['url'] | https://www.kkw-gundremmingen.de/presse.php?id=571 | https://www.bbc.com/news/technology-36158606 |
| external_references[2]['source_name'] | Trend Micro April 2016 | Catalin Cimpanu April 2016 |
| external_references[2]['description'] | Trend Micro 2016, April 27 Malware Discovered in German Nuclear Power Plant Retrieved. 2019/10/14 | Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 |
| external_references[2]['url'] | https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/malware-discovered-in-german-nuclear-power-plant | https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml |
| external_references[4]['source_name'] | Catalin Cimpanu April 2016 | Dark Reading Staff April 2016 |
| external_references[4]['description'] | Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 | Dark Reading Staff 2016, April 28 German Nuclear Power Plant Infected With Malware Retrieved. 2019/10/14 |
| external_references[4]['url'] | https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml | https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298 |
| external_references[5]['source_name'] | Peter Dockrill April 2016 | ESET April 2016 |
| external_references[5]['description'] | Peter Dockrill 2016, April 28 Multiple Computer Viruses Have Been Discovered in This German Nuclear Plant Retrieved. 2019/10/14 | ESET 2016, April 28 Malware found at a German nuclear power plant Retrieved. 2019/10/14 |
| external_references[5]['url'] | https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant | https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/ |
| external_references[6]['source_name'] | Lee Mathews April 2016 | Kernkraftwerk Gundremmingen April 2016 |
| external_references[6]['description'] | Lee Mathews 2016, April 27 German nuclear plant found riddled with Conficker, other viruses Retrieved. 2019/10/14 | Kernkraftwerk Gundremmingen 2016, April 25 Detektion von Bro-Schadsoftware an mehreren Rechnern Retrieved. 2019/10/14 |
| external_references[6]['url'] | https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/ | https://www.kkw-gundremmingen.de/presse.php?id=571 |
| external_references[7]['source_name'] | Sean Gallagher April 2016 | Lee Mathews April 2016 |
| external_references[7]['description'] | Sean Gallagher 2016, April 27 German nuclear plants fuel rod system swarming with old malware Retrieved. 2019/10/14 | Lee Mathews 2016, April 27 German nuclear plant found riddled with Conficker, other viruses Retrieved. 2019/10/14 |
| external_references[7]['url'] | https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/ | https://www.geek.com/apps/german-nuclear-plant-found-riddled-with-conficker-other-viruses-1653415/ |
| external_references[8]['source_name'] | Dark Reading Staff April 2016 | Peter Dockrill April 2016 |
| external_references[8]['description'] | Dark Reading Staff 2016, April 28 German Nuclear Power Plant Infected With Malware Retrieved. 2019/10/14 | Peter Dockrill 2016, April 28 Multiple Computer Viruses Have Been Discovered in This German Nuclear Plant Retrieved. 2019/10/14 |
| external_references[8]['url'] | https://www.darkreading.com/endpoint/german-nuclear-power-plant-infected-with-malware/d/d-id/1325298 | https://www.sciencealert.com/multiple-computer-viruses-have-been-discovered-in-this-german-nuclear-plant |
| external_references[9]['source_name'] | BBC April 2016 | Sean Gallagher April 2016 |
| external_references[9]['description'] | BBC 2016, April 28 German nuclear plant hit by computer viruses Retrieved. 2019/10/14 | Sean Gallagher 2016, April 27 German nuclear plants fuel rod system swarming with old malware Retrieved. 2019/10/14 |
| external_references[9]['url'] | https://www.bbc.com/news/technology-36158606 | https://arstechnica.com/information-technology/2016/04/german-nuclear-plants-fuel-rod-system-swarming-with-old-malware/ |
| external_references[10]['source_name'] | ESET April 2016 | Trend Micro April 2016 |
| external_references[10]['description'] | ESET 2016, April 28 Malware found at a German nuclear power plant Retrieved. 2019/10/14 | Trend Micro 2016, April 27 Malware Discovered in German Nuclear Power Plant Retrieved. 2019/10/14 |
| external_references[10]['url'] | https://www.welivesecurity.com/2016/04/28/malware-found-german-nuclear-power-plant/ | https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/malware-discovered-in-german-nuclear-power-plant |
[T0852] Screen Capture
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.976000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0853] Scripting
Current version: 1.0
|
|
|---|
| t | Adversaries may use scripting languages to execute arbitrary | t | Adversaries may use scripting languages to execute arbitrary |
| code in the form of a pre-written script or in the form of | | code in the form of a pre-written script or in the form of |
| user-supplied code to an interpreter. Scripting languages ar | | user-supplied code to an interpreter. Scripting languages ar |
| e programming languages that differ from compiled languages, | | e programming languages that differ from compiled languages, |
| in that scripting languages use an interpreter, instead of | | in that scripting languages use an interpreter, instead of |
| a compiler. These interpreters read and compile part of the | | a compiler. These interpreters read and compile part of the |
| source code just before it is executed, as opposed to compil | | source code just before it is executed, as opposed to compil |
| ers, which compile each and every line of code to an executa | | ers, which compile each and every line of code to an executa |
| ble file. Scripting allows software developers to run their | | ble file. Scripting allows software developers to run their |
| code on any system where the interpreter exists. This way, t | | code on any system where the interpreter exists. This way, t |
| hey can distribute one package, instead of precompiling exec | | hey can distribute one package, instead of precompiling exec |
| utables for many different systems. Scripting languages, suc | | utables for many different systems. Scripting languages, suc |
| h as Python, have their interpreters shipped as a default wi | | h as Python, have their interpreters shipped as a default wi |
| th many Linux distributions. In addition to being a usefu | | th many Linux distributions. In addition to being a useful |
| l tool for developers and administrators, scripting language | | tool for developers and administrators, scripting language |
| interpreters may be abused by the adversary to execute code | | interpreters may be abused by the adversary to execute code |
| in the target environment. Due to the nature of scripting l | | in the target environment. Due to the nature of scripting la |
| anguages, this allows for weaponized code to be deployed to | | nguages, this allows for weaponized code to be deployed to a |
| a target easily, and leaves open the possibility of on-the-f | | target easily, and leaves open the possibility of on-the-fl |
| ly scripting to perform a task. | | y scripting to perform a task. |
New Detections:
- DS0009: Process (Process Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_detection | | |
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.977000+00:00 | 2022-09-20 18:18:34.807000+00:00 |
| description | Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions. In addition to being a useful tool for developers and administrators, scripting language interpreters may be abused by the adversary to execute code in the target environment. Due to the nature of scripting languages, this allows for weaponized code to be deployed to a target easily, and leaves open the possibility of on-the-fly scripting to perform a task. | Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions.
In addition to being a useful tool for developers and administrators, scripting language interpreters may be abused by the adversary to execute code in the target environment. Due to the nature of scripting languages, this allows for weaponized code to be deployed to a target easily, and leaves open the possibility of on-the-fly scripting to perform a task. |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0881] Service Stop
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.978000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0869] Standard Application Layer Protocol
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.981000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[T0882] Theft of Operational Information
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_is_subtechnique | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:23.985000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
Software
enterprise-attack
New Software
[S1028] Action RAT
Current version: 1.0
Description: [Action RAT](https://attack.mitre.org/software/S1028) is a remote access tool written in Delphi that has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 against Indian and Afghani government personnel.(Citation: MalwareBytes SideCopy Dec 2021)
[S1025] Amadey
Current version: 1.0
Description: [Amadey](https://attack.mitre.org/software/S1025) is a Trojan bot that has been used since at least October 2018.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)
[S1029] AuTo Stealer
Current version: 1.0
Description: [AuTo Stealer](https://attack.mitre.org/software/S1029) is malware written in C++ has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 to target government agencies and personnel in India and Afghanistan.(Citation: MalwareBytes SideCopy Dec 2021)
[S1039] Bumblebee
Current version: 1.0
Description: [Bumblebee](https://attack.mitre.org/software/S1039) is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since at least March 2022. [Bumblebee](https://attack.mitre.org/software/S1039) has been linked to ransomware operations including [Conti](https://attack.mitre.org/software/S0575), Quantum, and Mountlocker and derived its name from the appearance of "bumblebee" in the user-agent.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)
[S1041] Chinoxy
Current version: 1.0
Description: [Chinoxy](https://attack.mitre.org/software/S1041) is a backdoor that has been used since at least November 2018, during the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign, to gain persistence and drop additional payloads. According to security researchers, [Chinoxy](https://attack.mitre.org/software/S1041) has been used by Chinese-speaking threat actors.(Citation: Bitdefender FunnyDream Campaign November 2020)
[S1023] CreepyDrive
Current version: 1.0
Description: [CreepyDrive](https://attack.mitre.org/software/S1023) is a custom implant has been used by [POLONIUM](https://attack.mitre.org/groups/G1005) since at least early 2022 for C2 with and exfiltration to actor-controlled OneDrive accounts.(Citation: Microsoft POLONIUM June 2022)
[POLONIUM](https://attack.mitre.org/groups/G1005) has used a similar implant called CreepyBox that relies on actor-controlled DropBox accounts.(Citation: Microsoft POLONIUM June 2022)
[S1024] CreepySnail
Current version: 1.0
Description: [CreepySnail](https://attack.mitre.org/software/S1024) is a custom PowerShell implant that has been used by [POLONIUM](https://attack.mitre.org/groups/G1005) since at least 2022.(Citation: Microsoft POLONIUM June 2022)
[S1033] DCSrv
Current version: 1.0
Description: [DCSrv](https://attack.mitre.org/software/S1033) is destructive malware that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021. Though [DCSrv](https://attack.mitre.org/software/S1033) has ransomware-like capabilities, [Moses Staff](https://attack.mitre.org/groups/G1009) does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)
[S1014] DanBot
Current version: 1.0
Description: [DanBot](https://attack.mitre.org/software/S1014) is a first-stage remote access Trojan written in C# that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least 2018.(Citation: SecureWorks August 2019)
[S1021] DnsSystem
Current version: 1.0
Description: [DnsSystem](https://attack.mitre.org/software/S1021) is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2022.(Citation: Zscaler Lyceum DnsSystem June 2022)
[S1044] FunnyDream
Current version: 1.0
Description: [FunnyDream](https://attack.mitre.org/software/S1044) is a backdoor with multiple components that was used during the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign since at least 2019, primarily for execution and exfiltration.(Citation: Bitdefender FunnyDream Campaign November 2020)
[S1027] Heyoka Backdoor
Current version: 1.0
Description: [Heyoka Backdoor](https://attack.mitre.org/software/S1027) is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by [Aoqin Dragon](https://attack.mitre.org/groups/G1007) since at least 2013.(Citation: SentinelOne Aoqin Dragon June 2022)(Citation: Sourceforge Heyoka 2022)
[S1022] IceApple
Current version: 1.0
Description: [IceApple](https://attack.mitre.org/software/S1022) is a modular Internet Information Services (IIS) post-exploitation framework, that has been used since at least 2021 against the technology, academic, and government sectors.(Citation: CrowdStrike IceApple May 2022)
[S1020] Kevin
Current version: 1.0
Description: [Kevin](https://attack.mitre.org/software/S1020) is a backdoor implant written in C++ that has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2020, including in operations against organizations in Tunisia.(Citation: Kaspersky Lyceum October 2021)
[S1016] MacMa
Current version: 1.0
Description: [MacMa](https://attack.mitre.org/software/S1016) is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. [MacMa](https://attack.mitre.org/software/S1016) has been observed in the wild since November 2021.(Citation: ESET DazzleSpy Jan 2022)
[S1015] Milan
Current version: 1.0
Description: [Milan](https://attack.mitre.org/software/S1015) is a backdoor implant based on [DanBot](https://attack.mitre.org/software/S1014) that was written in Visual C++ and .NET. [Milan](https://attack.mitre.org/software/S1015) has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least June 2020.(Citation: ClearSky Siamesekitten August 2021)(Citation: Kaspersky Lyceum October 2021)
[S1026] Mongall
Current version: 1.0
Description: [Mongall](https://attack.mitre.org/software/S1026) is a backdoor that has been used since at least 2013, including by [Aoqin Dragon](https://attack.mitre.org/groups/G1007).(Citation: SentinelOne Aoqin Dragon June 2022)
[S1047] Mori
Current version: 1.0
Description: [Mori](https://attack.mitre.org/software/S1047) is a backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)
[S1017] OutSteel
Current version: 1.0
Description: [OutSteel](https://attack.mitre.org/software/S1017) is a file uploader and document stealer developed with the scripting language AutoIT that has been used by [Ember Bear](https://attack.mitre.org/groups/G1003) since at least March 2021.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
[S1050] PcShare
Current version: 1.0
Description: [PcShare](https://attack.mitre.org/software/S1050) is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: GitHub PcShare 2014)
[S1031] PingPull
Current version: 1.0
Description: [PingPull](https://attack.mitre.org/software/S1031) is a remote access Trojan (RAT) written in Visual C++ that has been used by [GALLIUM](https://attack.mitre.org/groups/G0093) since at least June 2022. [PingPull](https://attack.mitre.org/software/S1031) has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.(Citation: Unit 42 PingPull Jun 2022)
[S1046] PowGoop
Current version: 1.0
Description: [PowGoop](https://attack.mitre.org/software/S1046) is a loader that consists of a DLL loader and a PowerShell-based downloader; it has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) as their main loader.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)
[S1012] PowerLess
Current version: 1.0
Description: [PowerLess](https://attack.mitre.org/software/S1012) is a PowerShell-based modular backdoor that has been used by [Magic Hound](https://attack.mitre.org/groups/G0059) since at least 2022.(Citation: Cybereason PowerLess February 2022)
[S1032] PyDCrypt
Current version: 1.0
Description: [PyDCrypt](https://attack.mitre.org/software/S1032) is malware written in Python designed to deliver [DCSrv](https://attack.mitre.org/software/S1033). It has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021, with each sample tailored for its intended victim organization.(Citation: Checkpoint MosesStaff Nov 2021)
[S1040] Rclone
Current version: 1.0
Description: [Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in a number of ransomware campaigns, including those associated with the [Conti](https://attack.mitre.org/software/S0575) and DarkSide Ransomware-as-a-Service operations.(Citation: Rclone)(Citation: Rclone Wars)(Citation: Detecting Rclone)(Citation: DarkSide Ransomware Gang)(Citation: DFIR Conti Bazar Nov 2021)
[S1037] STARWHALE
Current version: 1.0
Description: [STARWHALE](https://attack.mitre.org/software/S1037) is Windows Script File (WSF) backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069), possibly since at least November 2021; there is also a [STARWHALE](https://attack.mitre.org/software/S1037) variant written in Golang with similar capabilities. Security researchers have also noted the use of [STARWHALE](https://attack.mitre.org/software/S1037) by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)
[S1042] SUGARDUMP
Current version: 1.0
Description: [SUGARDUMP](https://attack.mitre.org/software/S1042) is a proprietary browser credential harvesting tool that was used by UNC3890 during the [C0010](https://attack.mitre.org/campaigns/C0010) campaign. The first known [SUGARDUMP](https://attack.mitre.org/software/S1042) version was used since at least early 2021, a second SMTP C2 version was used from late 2021-early 2022, and a third HTTP C2 variant was used since at least April 2022.(Citation: Mandiant UNC3890 Aug 2022)
[S1049] SUGARUSH
Current version: 1.0
Description: [SUGARUSH](https://attack.mitre.org/software/S1049) is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. [SUGARUSH](https://attack.mitre.org/software/S1049) was first identified during analysis of UNC3890's [C0010](https://attack.mitre.org/campaigns/C0010) campaign targeting Israeli companies, which began in late 2020.(Citation: Mandiant UNC3890 Aug 2022)
[S1018] Saint Bot
Current version: 1.0
Description: [Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Ember Bear](https://attack.mitre.org/groups/G1003) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
[S1019] Shark
Current version: 1.0
Description: [Shark](https://attack.mitre.org/software/S1019) is a backdoor malware written in C# and .NET that is an updated version of [Milan](https://attack.mitre.org/software/S1015); it has been used by [HEXANE](https://attack.mitre.org/groups/G1001) since at least July 2021.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
[S1035] Small Sieve
Current version: 1.0
Description: [Small Sieve](https://attack.mitre.org/software/S1035) is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptable Install System (NSIS) Installer; it has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: NCSC GCHQ Small Sieve Jan 2022)
Security researchers have also noted [Small Sieve](https://attack.mitre.org/software/S1035)'s use by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)
[S1030] Squirrelwaffle
Current version: 1.0
Description: [Squirrelwaffle](https://attack.mitre.org/software/S1030) is a loader that was first seen in September 2021. It has been used in spam email campaigns to deliver additional malware such as [Cobalt Strike](https://attack.mitre.org/software/S0154) and the [QakBot](https://attack.mitre.org/software/S0650) banking trojan.(Citation: ZScaler Squirrelwaffle Sep 2021)(Citation: Netskope Squirrelwaffle Oct 2021)
[S1034] StrifeWater
Current version: 1.0
Description: [StrifeWater](https://attack.mitre.org/software/S1034) is a remote-access tool that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) in the initial stages of their attacks since at least November 2021.(Citation: Cybereason StrifeWater Feb 2022)
[S1011] Tarrask
Current version: 1.0
Description: [Tarrask](https://attack.mitre.org/software/S1011) is malware that has been used by [HAFNIUM](https://attack.mitre.org/groups/G0125) since at least August 2021. [Tarrask](https://attack.mitre.org/software/S1011) was designed to evade digital defenses and maintain persistence by generating concealed scheduled tasks.(Citation: Tarrask scheduled task)
[S1013] ZxxZ
Current version: 1.0
Description: [ZxxZ](https://attack.mitre.org/software/S1013) is a trojan written in Visual C++ that has been used by [BITTER](https://attack.mitre.org/groups/G1002) since at least August 2021, including against Bangladeshi government personnel.(Citation: Cisco Talos Bitter Bangladesh May 2022)
[S1043] ccf32
Current version: 1.0
Description: [ccf32](https://attack.mitre.org/software/S1043) is data collection malware that has been used since at least February 2019, most notably during the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign; there is also a similar x64 version.(Citation: Bitdefender FunnyDream Campaign November 2020)
[S1048] macOS.OSAMiner
Current version: 1.0
Description: [macOS.OSAMiner](https://attack.mitre.org/software/S1048) is a Monero mining trojan that was first observed in 2018; security researchers assessed [macOS.OSAMiner](https://attack.mitre.org/software/S1048) may have been circulating since at least 2015. [macOS.OSAMiner](https://attack.mitre.org/software/S1048) is known for embedding one run-only AppleScript into another, which helped the malware evade full analysis for five years due to a lack of Apple event (AEVT) analysis tools.(Citation: SentinelLabs reversing run-only applescripts 2021)(Citation: VMRay OSAMiner dynamic analysis 2021)
Major Version Changes
[S0262] QuasarRAT
Current version: 2.0
Version changed from: 1.3 → 2.0
|
|
|---|
| t | [QuasarRAT](https://attack.mitre.org/software/S0262) is an o | t | [QuasarRAT](https://attack.mitre.org/software/S0262) is an o |
| pen-source, remote access tool that is publicly available on | | pen-source, remote access tool that has been publicly availa |
| GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262 | | ble on GitHub since at least 2014. [QuasarRAT](https://attac |
| ) is developed in the C# language. (Citation: GitHub QuasarR | | k.mitre.org/software/S0262) is developed in the C# language. |
| AT) (Citation: Volexity Patchwork June 2018) | | (Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork Ju |
| | | ne 2018) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Kyaw Pyiyt Htet, @KyawPyiytHtet'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 19:52:07.165000+00:00 | 2022-08-02 15:36:30.238000+00:00 |
| description | [QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that is publicly available on GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language. (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018) | [QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018) |
| x_mitre_version | 1.3 | 2.0 |
[S0448] Rising Sun
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | [Rising Sun](https://attack.mitre.org/software/S0448) is a m | t | [Rising Sun](https://attack.mitre.org/software/S0448) is a m |
| odular backdoor malware used extensively in Operation [Sharp | | odular backdoor that was used extensively in [Operation Shar |
| shooter](https://attack.mitre.org/groups/G0104). The malware | | pshooter](https://attack.mitre.org/campaigns/C0013) between |
| has been observed targeting nuclear, defense, energy, and f | | 2017 and 2019. [Rising Sun](https://attack.mitre.org/softwar |
| inancial services companies across the world. [Rising Sun](h | | e/S0448) infected at least 87 organizations around the world |
| ttps://attack.mitre.org/software/S0448) uses source code fro | | , including nuclear, defense, energy, and financial service |
| m [Lazarus Group](https://attack.mitre.org/groups/G0032)'s T | | companies. Security researchers assessed [Rising Sun](https: |
| rojan Duuzer.(Citation: McAfee Sharpshooter December 2018) | | //attack.mitre.org/software/S0448) included some source code |
| | | from [Lazarus Group](https://attack.mitre.org/groups/G0032) |
| | | 's Trojan Duuzer.(Citation: McAfee Sharpshooter December 201 |
| | | 8) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-30 03:13:38.515000+00:00 | 2022-10-13 15:46:29.677000+00:00 |
| description | [Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor malware used extensively in Operation [Sharpshooter](https://attack.mitre.org/groups/G0104). The malware has been observed targeting nuclear, defense, energy, and financial services companies across the world. [Rising Sun](https://attack.mitre.org/software/S0448) uses source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018) | [Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor that was used extensively in [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) between 2017 and 2019. [Rising Sun](https://attack.mitre.org/software/S0448) infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed [Rising Sun](https://attack.mitre.org/software/S0448) included some source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018) |
| x_mitre_version | 1.0 | 2.0 |
[S0350] zwShell
Current version: 2.0
Version changed from: 1.1 → 2.0
|
|
|---|
| t | [zwShell](https://attack.mitre.org/software/S0350) is a remo | t | [zwShell](https://attack.mitre.org/software/S0350) is a remo |
| te access tool (RAT) written in Delphi that has been used by | | te access tool (RAT) written in Delphi that has been seen in |
| [Night Dragon](https://attack.mitre.org/groups/G0014).(Cita | | the wild since the spring of 2010 and used by threat actors |
| tion: McAfee Night Dragon) | | during [Night Dragon](https://attack.mitre.org/campaigns/C0 |
| | | 002).(Citation: McAfee Night Dragon) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-16 15:50:05.015000+00:00 | 2022-09-22 00:38:34.857000+00:00 |
| description | [zwShell](https://attack.mitre.org/software/S0350) is a remote access tool (RAT) written in Delphi that has been used by [Night Dragon](https://attack.mitre.org/groups/G0014).(Citation: McAfee Night Dragon) | [zwShell](https://attack.mitre.org/software/S0350) is a remote access tool (RAT) written in Delphi that has been seen in the wild since the spring of 2010 and used by threat actors during [Night Dragon](https://attack.mitre.org/campaigns/C0002).(Citation: McAfee Night Dragon) |
| x_mitre_version | 1.1 | 2.0 |
Minor Version Changes
[S0677] AADInternals
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-13 14:17:59.626000+00:00 | 2022-08-03 15:01:46.965000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0073] ASPXSpy
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 14:48:21.994000+00:00 | 2022-09-22 20:56:06.265000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0552] AdFind
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 17:07:10.931000+00:00 | 2022-09-29 20:40:24.739000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0584] AppleJeus
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-27 20:49:10.831000+00:00 | 2022-09-28 17:46:18.677000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0344] Azorult
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 14:56:50.733000+00:00 | 2022-10-13 17:42:52.174000+00:00 |
| external_references[2]['source_name'] | Unit42 Azorult Nov 2018 | Proofpoint Azorult July 2018 |
| external_references[2]['description'] | Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. | Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018. |
| external_references[2]['url'] | https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/ | https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside |
| external_references[3]['source_name'] | Proofpoint Azorult July 2018 | Unit42 Azorult Nov 2018 |
| external_references[3]['description'] | Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018. | Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018. |
| external_references[3]['url'] | https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside | https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/ |
| x_mitre_version | 1.2 | 1.3 |
[S0190] BITSAdmin
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-20 18:09:11.516000+00:00 | 2022-10-13 18:56:28.568000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0534] Bazar
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-18 19:43:00.355000+00:00 | 2022-09-29 20:41:20.065000+00:00 |
| external_references[1]['source_name'] | KEGTAP | Team9 |
| external_references[1]['description'] | (Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: CrowdStrike Wizard Spider October 2020) | (Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020) |
| external_references[2]['source_name'] | Team9 | KEGTAP |
| external_references[2]['description'] | (Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020) | (Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: CrowdStrike Wizard Spider October 2020) |
| external_references[5]['source_name'] | CrowdStrike Wizard Spider October 2020 | NCC Group Team9 June 2020 |
| external_references[5]['description'] | Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021. | Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. |
| external_references[5]['url'] | https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ | https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ |
| external_references[6]['source_name'] | NCC Group Team9 June 2020 | CrowdStrike Wizard Spider October 2020 |
| external_references[6]['description'] | Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. | Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021. |
| external_references[6]['url'] | https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ | https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ |
| x_mitre_version | 1.1 | 1.2 |
[S0521] BloodHound
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 19:58:05.109000+00:00 | 2022-09-27 18:19:01.118000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0154] Cobalt Strike
Current version: 1.9
Version changed from: 1.8 → 1.9
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-25 18:58:15.220000+00:00 | 2022-10-12 23:24:12.980000+00:00 |
| x_mitre_version | 1.8 | 1.9 |
[S0126] ComRAT
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-12-23 19:34:12.017000+00:00 | 2022-10-18 21:58:12.936000+00:00 |
| external_references[1]['source_name'] | Symantec Waterbug | ESET ComRAT May 2020 |
| external_references[1]['description'] | Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015. | Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. |
| external_references[1]['url'] | https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1 | https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf |
| external_references[3]['source_name'] | ESET ComRAT May 2020 | Symantec Waterbug |
| external_references[3]['description'] | Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020. | Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015. |
| external_references[3]['url'] | https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf | https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1 |
| x_mitre_version | 1.2 | 1.3 |
[S0575] Conti
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-16 21:43:53.793000+00:00 | 2022-09-29 16:45:13.038000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
[S0614] CostaBricks
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 23:10:53.785000+00:00 | 2022-10-05 16:34:18.865000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0115] Crimson
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 18:54:53.268000+00:00 | 2022-09-22 18:16:11.378000+00:00 |
| external_references[2]['source_name'] | Proofpoint Operation Transparent Tribe March 2016 | Kaspersky Transparent Tribe August 2020 |
| external_references[2]['description'] | Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. | Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. |
| external_references[2]['url'] | https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf | https://securelist.com/transparent-tribe-part-1/98127/ |
| external_references[3]['source_name'] | Kaspersky Transparent Tribe August 2020 | Proofpoint Operation Transparent Tribe March 2016 |
| external_references[3]['description'] | Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021. | Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. |
| external_references[3]['url'] | https://securelist.com/transparent-tribe-part-1/98127/ | https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf |
| x_mitre_version | 1.2 | 1.3 |
[S0567] Dtrack
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-27 00:05:45.283000+00:00 | 2022-10-18 22:01:45.646000+00:00 |
| external_references[1]['source_name'] | Kaspersky Dtrack | ZDNet Dtrack |
| external_references[1]['description'] | Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021. | Catalin Cimpanu. (2019, October 30). Confirmed: North Korean malware found on Indian nuclear plant's network. Retrieved January 20, 2021. |
| external_references[1]['url'] | https://usa.kaspersky.com/about/press-releases/2019_dtrack-previously-unknown-spy-tool-hits-financial-institutions-and-research-centers | https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/ |
| external_references[2]['source_name'] | Securelist Dtrack | Dragos WASSONITE |
| external_references[2]['description'] | Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021. | Dragos. (n.d.). WASSONITE. Retrieved January 20, 2021. |
| external_references[2]['url'] | https://securelist.com/my-name-is-dtrack/93338/ | https://www.dragos.com/threat/wassonite/ |
| external_references[3]['source_name'] | Dragos WASSONITE | CyberBit Dtrack |
| external_references[3]['description'] | Dragos. (n.d.). WASSONITE. Retrieved January 20, 2021. | Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021. |
| external_references[3]['url'] | https://www.dragos.com/threat/wassonite/ | https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/ |
| external_references[4]['source_name'] | CyberBit Dtrack | Kaspersky Dtrack |
| external_references[4]['description'] | Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021. | Kaspersky Global Research and Analysis Team. (2019, September 23). DTrack: previously unknown spy-tool by Lazarus hits financial institutions and research centers. Retrieved January 20, 2021. |
| external_references[4]['url'] | https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/ | https://usa.kaspersky.com/about/press-releases/2019_dtrack-previously-unknown-spy-tool-hits-financial-institutions-and-research-centers |
| external_references[5]['source_name'] | ZDNet Dtrack | Securelist Dtrack |
| external_references[5]['description'] | Catalin Cimpanu. (2019, October 30). Confirmed: North Korean malware found on Indian nuclear plant's network. Retrieved January 20, 2021. | Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021. |
| external_references[5]['url'] | https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/ | https://securelist.com/my-name-is-dtrack/93338/ |
| x_mitre_version | 1.0 | 1.1 |
[S0363] Empire
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 20:33:43.881000+00:00 | 2022-06-03 17:55:43.889000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
[S0381] FlawedAmmyy
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-20 23:52:23.647000+00:00 | 2022-07-18 15:59:26.387000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0477] Goopy
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-29 21:37:55.776000+00:00 | 2022-07-11 20:35:28.082000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0632] GrimAgent
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 16:15:20.371000+00:00 | 2022-07-29 19:44:21.016000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0357] Impacket
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-07 16:02:38.320000+00:00 | 2022-09-27 18:20:48.473000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0604] Industroyer
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:22:34.355000+00:00 | 2022-10-20 20:37:50.556000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0231] Invoke-PSImage
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Invoke-PSImage'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2022-10-18 22:02:48.228000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0669] KOCTOPUS
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 20:00:06.667000+00:00 | 2022-07-29 19:46:14.547000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0500] MCMD
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-08-20 14:52:23.369000+00:00 | 2022-07-29 19:48:28.725000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0002] Mimikatz
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-12 18:59:55.116000+00:00 | 2022-08-03 15:07:11.534000+00:00 |
| x_mitre_version | 1.5 | 1.6 |
[S0084] Mis-Type
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | [Mis-Type](https://attack.mitre.org/software/S0084) is a bac | t | [Mis-Type](https://attack.mitre.org/software/S0084) is a bac |
| kdoor hybrid that was used by [Dust Storm](https://attack.mi | | kdoor hybrid that was used in [Operation Dust Storm](https:/ |
| tre.org/groups/G0031) in 2012. (Citation: Cylance Dust Storm | | /attack.mitre.org/campaigns/C0016) by 2012.(Citation: Cylanc |
| ) | | e Dust Storm) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-19 21:19:03.367000+00:00 | 2022-09-30 20:04:42.419000+00:00 |
| description | [Mis-Type](https://attack.mitre.org/software/S0084) is a backdoor hybrid that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) in 2012. (Citation: Cylance Dust Storm) | [Mis-Type](https://attack.mitre.org/software/S0084) is a backdoor hybrid that was used in [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) by 2012.(Citation: Cylance Dust Storm) |
| x_mitre_version | 1.1 | 1.2 |
[S0083] Misdat
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | [Misdat](https://attack.mitre.org/software/S0083) is a backd | t | [Misdat](https://attack.mitre.org/software/S0083) is a backd |
| oor that was used by [Dust Storm](https://attack.mitre.org/g | | oor that was used in [Operation Dust Storm](https://attack.m |
| roups/G0031) from 2010 to 2011. (Citation: Cylance Dust Stor | | itre.org/campaigns/C0016) from 2010 to 2011.(Citation: Cylan |
| m) | | ce Dust Storm) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-19 21:19:03.598000+00:00 | 2022-09-30 21:01:41.137000+00:00 |
| description | [Misdat](https://attack.mitre.org/software/S0083) is a backdoor that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2010 to 2011. (Citation: Cylance Dust Storm) | [Misdat](https://attack.mitre.org/software/S0083) is a backdoor that was used in [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) from 2010 to 2011.(Citation: Cylance Dust Storm) |
| x_mitre_version | 1.1 | 1.2 |
[S0402] OSX/Shlayer
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 20:44:20.719000+00:00 | 2022-10-19 16:35:18.493000+00:00 |
| external_references[2]['source_name'] | Zshlayer | Crossrider |
| external_references[2]['description'] | (Citation: sentinelone shlayer to zshlayer) | (Citation: Intego Shlayer Apr 2018)(Citation: Malwarebytes Crossrider Apr 2018) |
| external_references[3]['source_name'] | Crossrider | Zshlayer |
| external_references[3]['description'] | (Citation: Intego Shlayer Apr 2018)(Citation: Malwarebytes Crossrider Apr 2018) | (Citation: sentinelone shlayer to zshlayer) |
| external_references[4]['url'] | https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/ | https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html |
| external_references[7]['source_name'] | Intego Shlayer Apr 2018 | Malwarebytes Crossrider Apr 2018 |
| external_references[7]['description'] | Vrijenhoek, Jay. (2018, April 24). New OSX/Shlayer Malware Variant Found Using a Dirty New Trick. Retrieved September 6, 2019. | Reed, Thomas. (2018, April 24). New Crossrider variant installs configuration profiles on Macs. Retrieved September 6, 2019. |
| external_references[7]['url'] | https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/ | https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/ |
| external_references[8]['source_name'] | Malwarebytes Crossrider Apr 2018 | Intego Shlayer Apr 2018 |
| external_references[8]['description'] | Reed, Thomas. (2018, April 24). New Crossrider variant installs configuration profiles on Macs. Retrieved September 6, 2019. | Vrijenhoek, Jay. (2018, April 24). New OSX/Shlayer Malware Variant Found Using a Dirty New Trick. Retrieved September 6, 2019. |
| external_references[8]['url'] | https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/ | https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/ |
| x_mitre_version | 1.2 | 1.3 |
[S0223] POWERSTATS
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-23 20:16:28.982000+00:00 | 2022-10-12 19:06:51.405000+00:00 |
| external_references[1]['source_name'] | POWERSTATS | Powermud |
| external_references[1]['description'] | (Citation: Unit 42 MuddyWater Nov 2017)(Citation: ClearSky MuddyWater Nov 2018) | (Citation: Symantec MuddyWater Dec 2018) |
| external_references[2]['source_name'] | Powermud | POWERSTATS |
| external_references[2]['description'] | (Citation: Symantec MuddyWater Dec 2018) | (Citation: Unit 42 MuddyWater Nov 2017)(Citation: ClearSky MuddyWater Nov 2018) |
| external_references[3]['source_name'] | Unit 42 MuddyWater Nov 2017 | ClearSky MuddyWater Nov 2018 |
| external_references[3]['description'] | Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018. | ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. |
| external_references[3]['url'] | https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ | https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf |
| external_references[4]['source_name'] | ClearSky MuddyWater Nov 2018 | Unit 42 MuddyWater Nov 2017 |
| external_references[4]['description'] | ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. | Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018. |
| external_references[4]['url'] | https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf | https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ |
| x_mitre_version | 2.1 | 2.2 |
[S0613] PS1
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 12:58:20.120000+00:00 | 2022-10-05 16:04:51.193000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | PS1 | |
[S0587] Penquin
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-09 17:35:29.546000+00:00 | 2022-10-20 04:12:29.037000+00:00 |
| external_references[4]['url'] | https://www.leonardocompany.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf | https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf |
| x_mitre_version | 1.0 | 1.1 |
[S0517] Pillowmint
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-06 17:25:07.301000+00:00 | 2022-07-29 19:50:27.063000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0097] Ping
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Ping'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-15 14:14:26.239000+00:00 | 2022-10-13 18:56:52.195000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0012] PoisonIvy
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-15 15:23:57.525000+00:00 | 2022-09-30 21:02:39.862000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
[S0378] PoshC2
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-02-09 13:59:23.129000+00:00 | 2022-06-03 17:45:36.186000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0194] PowerSploit
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-05 01:24:41.497000+00:00 | 2022-09-27 18:18:15.392000+00:00 |
| external_references[1]['source_name'] | GitHub PowerSploit May 2012 | PowerShellMagazine PowerSploit July 2014 |
| external_references[1]['description'] | PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. | Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018. |
| external_references[1]['url'] | https://github.com/PowerShellMafia/PowerSploit | http://www.powershellmagazine.com/2014/07/08/powersploit/ |
| external_references[2]['source_name'] | PowerShellMagazine PowerSploit July 2014 | GitHub PowerSploit May 2012 |
| external_references[2]['description'] | Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018. | PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018. |
| external_references[2]['url'] | http://www.powershellmagazine.com/2014/07/08/powersploit/ | https://github.com/PowerShellMafia/PowerSploit |
| x_mitre_version | 1.4 | 1.5 |
[S0029] PsExec
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-24 13:47:24.660000+00:00 | 2022-09-28 14:47:20.421000+00:00 |
| external_references[1]['source_name'] | Russinovich Sysinternals | SANS PsExec |
| external_references[1]['description'] | Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015. | Pilkington, M.. (2012, December 17). Protecting Privileged Domain Accounts: PsExec Deep-Dive. Retrieved August 17, 2016. |
| external_references[1]['url'] | https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx | https://digital-forensics.sans.org/blog/2012/12/17/protecting-privileged-domain-accounts-psexec-deep-dive |
| external_references[2]['source_name'] | SANS PsExec | Russinovich Sysinternals |
| external_references[2]['description'] | Pilkington, M.. (2012, December 17). Protecting Privileged Domain Accounts: PsExec Deep-Dive. Retrieved August 17, 2016. | Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015. |
| external_references[2]['url'] | https://digital-forensics.sans.org/blog/2012/12/17/protecting-privileged-domain-accounts-psexec-deep-dive | https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx |
| x_mitre_version | 1.2 | 1.3 |
[S0147] Pteranodon
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-24 21:03:18.159000+00:00 | 2022-08-23 15:25:11.145000+00:00 |
| external_references[3]['source_name'] | Symantec Shuckworm January 2022 | Secureworks IRON TILDEN Profile |
| external_references[3]['description'] | Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022. | Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022. |
| external_references[3]['url'] | https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine | https://www.secureworks.com/research/threat-profiles/iron-tilden |
| external_references[4]['source_name'] | Secureworks IRON TILDEN Profile | Symantec Shuckworm January 2022 |
| external_references[4]['description'] | Secureworks CTU. (n.d.). IRON TILDEN. Retrieved February 24, 2022. | Symantec. (2022, January 31). Shuckworm Continues Cyber-Espionage Attacks Against Ukraine. Retrieved February 17, 2022. |
| external_references[4]['url'] | https://www.secureworks.com/research/threat-profiles/iron-tilden | https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine |
| x_mitre_version | 2.0 | 2.1 |
[S0148] RTM
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-03 22:22:05.857000+00:00 | 2022-07-29 19:51:00.660000+00:00 |
| external_references[2]['source_name'] | ESET RTM Feb 2017 | Unit42 Redaman January 2019 |
| external_references[2]['description'] | Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. | Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. |
| external_references[2]['url'] | https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf | https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/ |
| external_references[3]['source_name'] | Unit42 Redaman January 2019 | ESET RTM Feb 2017 |
| external_references[3]['description'] | Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020. | Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017. |
| external_references[3]['url'] | https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/ | https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf |
| x_mitre_version | 1.1 | 1.2 |
[S0075] Reg
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-23 20:25:18.606000+00:00 | 2022-10-13 20:23:35.333000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0332] Remcos
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 19:52:50.199000+00:00 | 2022-09-16 15:40:41.093000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0085] S-Type
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | [S-Type](https://attack.mitre.org/software/S0085) is a backd | t | [S-Type](https://attack.mitre.org/software/S0085) is a backd |
| oor that was used by [Dust Storm](https://attack.mitre.org/g | | oor that was used in [Operation Dust Storm](https://attack.m |
| roups/G0031) from 2013 to 2014. (Citation: Cylance Dust Stor | | itre.org/campaigns/C0016) since at least 2013.(Citation: Cyl |
| m) | | ance Dust Storm) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-19 21:15:21.430000+00:00 | 2022-09-30 20:10:08.347000+00:00 |
| description | [S-Type](https://attack.mitre.org/software/S0085) is a backdoor that was used by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2013 to 2014. (Citation: Cylance Dust Storm) | [S-Type](https://attack.mitre.org/software/S0085) is a backdoor that was used in [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) since at least 2013.(Citation: Cylance Dust Storm) |
| x_mitre_version | 1.1 | 1.2 |
[S0461] SDBbot
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-29 20:35:47.468000+00:00 | 2022-07-18 16:01:14.539000+00:00 |
| external_references[1]['source_name'] | Proofpoint TA505 October 2019 | IBM TA505 April 2020 |
| external_references[1]['description'] | Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020. | Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. |
| external_references[1]['url'] | https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader | https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ |
| external_references[2]['source_name'] | IBM TA505 April 2020 | Proofpoint TA505 October 2019 |
| external_references[2]['description'] | Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. | Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020. |
| external_references[2]['url'] | https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ | https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader |
| x_mitre_version | 2.0 | 2.1 |
[S0649] SMOKEDHAM
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-14 20:12:16.269000+00:00 | 2022-10-18 22:07:23.251000+00:00 |
| external_references[2]['source_name'] | FireEye Shining A Light on DARKSIDE May 2021 | FireEye SMOKEDHAM June 2021 |
| external_references[2]['description'] | FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021. | FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html | https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html |
| external_references[3]['source_name'] | FireEye SMOKEDHAM June 2021 | FireEye Shining A Light on DARKSIDE May 2021 |
| external_references[3]['description'] | FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021. | FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021. |
| external_references[3]['url'] | https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html | https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html |
| x_mitre_version | 1.0 | 1.1 |
[S0559] SUNBURST
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 01:53:52.241000+00:00 | 2022-07-29 19:52:40.476000+00:00 |
| x_mitre_version | 2.2 | 2.3 |
[S0464] SYSCON
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-15 15:17:10.012000+00:00 | 2022-10-21 15:16:57.038000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0596] ShadowPad
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-26 13:14:35.741000+00:00 | 2022-10-17 19:31:36.083000+00:00 |
| external_references[2]['source_name'] | Recorded Future RedEcho Feb 2021 | FireEye APT41 Aug 2019 |
| external_references[2]['description'] | Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021. | Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. |
| external_references[2]['url'] | https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf | https://content.fireeye.com/apt-41/rpt-apt41 |
| external_references[4]['source_name'] | Kaspersky ShadowPad Aug 2017 | Recorded Future RedEcho Feb 2021 |
| external_references[4]['description'] | Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021. | Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021. |
| external_references[4]['url'] | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf | https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf |
| external_references[5]['source_name'] | FireEye APT41 Aug 2019 | Kaspersky ShadowPad Aug 2017 |
| external_references[5]['description'] | Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. | Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021. |
| external_references[5]['url'] | https://content.fireeye.com/apt-41/rpt-apt41 | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf |
| x_mitre_version | 1.0 | 1.1 |
[S0615] SombRAT
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | [SombRAT](https://attack.mitre.org/software/S0615) is a modu | t | [SombRAT](https://attack.mitre.org/software/S0615) is a modu |
| lar backdoor written in C++ that has been in use since at le | | lar backdoor written in C++ that has been used since at leas |
| ast 2019. [SombRAT](https://attack.mitre.org/software/S0615) | | t 2019 to download and execute malicious payloads, including |
| has been used to download and execute malicious payloads, i | | [FIVEHANDS](https://attack.mitre.org/software/S0618) ransom |
| ncluding [FIVEHANDS](https://attack.mitre.org/software/S0618 | | ware.(Citation: BlackBerry CostaRicto November 2020)(Citatio |
| ) ransomware.(Citation: BlackBerry CostaRicto November 2020) | | n: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FI |
| (Citation: FireEye FiveHands April 2021)(Citation: CISA AR21 | | VEHANDS May 2021) |
| -126A FIVEHANDS May 2021) | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-11-19 23:35:06.266000+00:00 | 2022-10-05 16:33:54.170000+00:00 |
| description | [SombRAT](https://attack.mitre.org/software/S0615) is a modular backdoor written in C++ that has been in use since at least 2019. [SombRAT](https://attack.mitre.org/software/S0615) has been used to download and execute malicious payloads, including [FIVEHANDS](https://attack.mitre.org/software/S0618) ransomware.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021) | [SombRAT](https://attack.mitre.org/software/S0615) is a modular backdoor written in C++ that has been used since at least 2019 to download and execute malicious payloads, including [FIVEHANDS](https://attack.mitre.org/software/S0618) ransomware.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021) |
| external_references[1]['source_name'] | BlackBerry CostaRicto November 2020 | CISA AR21-126A FIVEHANDS May 2021 |
| external_references[1]['description'] | The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. | CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. |
| external_references[1]['url'] | https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced | https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a |
| external_references[3]['source_name'] | CISA AR21-126A FIVEHANDS May 2021 | BlackBerry CostaRicto November 2020 |
| external_references[3]['description'] | CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. | The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021. |
| external_references[3]['url'] | https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a | https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced |
| x_mitre_version | 1.1 | 1.2 |
[S0603] Stuxnet
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 16:22:32.608000+00:00 | 2022-10-20 20:31:32.664000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0096] Systeminfo
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Systeminfo'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2022-10-12 21:29:48.567000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0057] Tasklist
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Tasklist'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2022-10-12 21:30:23.536000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0183] Tor
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-05-13 22:59:15.727000+00:00 | 2022-10-05 16:37:49.999000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0645] Wevtutil
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-21 18:03:13.205000+00:00 | 2022-10-13 17:45:16.377000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0658] XCSSET
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 21:03:39.123000+00:00 | 2022-10-18 20:40:59.749000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0086] ZLib
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | [ZLib](https://attack.mitre.org/software/S0086) is a full-fe | t | [ZLib](https://attack.mitre.org/software/S0086) is a full-fe |
| atured backdoor that was used as a second-stage implant by [ | | atured backdoor that was used as a second-stage implant duri |
| Dust Storm](https://attack.mitre.org/groups/G0031) from 2014 | | ng [Operation Dust Storm](https://attack.mitre.org/campaigns |
| to 2015. It is malware and should not be confused with the | | /C0016) since at least 2014. [ZLib](https://attack.mitre.org |
| compression library from which its name is derived. (Citatio | | /software/S0086) is malware and should not be confused with |
| n: Cylance Dust Storm) | | the legitimate compression library from which its name is de |
| | | rived.(Citation: Cylance Dust Storm) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-19 21:19:03.738000+00:00 | 2022-09-30 20:52:00.462000+00:00 |
| description | [ZLib](https://attack.mitre.org/software/S0086) is a full-featured backdoor that was used as a second-stage implant by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2014 to 2015. It is malware and should not be confused with the compression library from which its name is derived. (Citation: Cylance Dust Storm) | [ZLib](https://attack.mitre.org/software/S0086) is a full-featured backdoor that was used as a second-stage implant during [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) since at least 2014. [ZLib](https://attack.mitre.org/software/S0086) is malware and should not be confused with the legitimate compression library from which its name is derived.(Citation: Cylance Dust Storm) |
| x_mitre_version | 1.1 | 1.2 |
[S0110] at
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 20:02:41.550000+00:00 | 2022-09-22 20:56:56.049000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0106] cmd
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-20 18:38:23.242000+00:00 | 2022-10-13 20:24:11.194000+00:00 |
| external_references[2]['source_name'] | TechNet Dir | TechNet Copy |
| external_references[2]['description'] | Microsoft. (n.d.). Dir. Retrieved April 18, 2016. | Microsoft. (n.d.). Copy. Retrieved April 26, 2016. |
| external_references[2]['url'] | https://technet.microsoft.com/en-us/library/cc755121.aspx | https://technet.microsoft.com/en-us/library/bb490886.aspx |
| external_references[4]['source_name'] | TechNet Copy | TechNet Dir |
| external_references[4]['description'] | Microsoft. (n.d.). Copy. Retrieved April 26, 2016. | Microsoft. (n.d.). Dir. Retrieved April 18, 2016. |
| external_references[4]['url'] | https://technet.microsoft.com/en-us/library/bb490886.aspx | https://technet.microsoft.com/en-us/library/cc755121.aspx |
| x_mitre_version | 1.1 | 1.2 |
[S0105] dsquery
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-18 20:01:55.739000+00:00 | 2022-10-13 13:34:53.355000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0032] gh0st RAT
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-15 21:09:32.843000+00:00 | 2022-09-30 21:03:21.873000+00:00 |
| x_mitre_version | 3.0 | 3.1 |
[S0008] gsecdump
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 18:35:48.851000+00:00 | 2022-09-22 20:55:32.937000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0100] ipconfig
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['ipconfig'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2022-10-12 21:28:49.335000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0104] netstat
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['netstat'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2022-10-12 21:29:16.407000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0385] njRAT
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 19:50:59.368000+00:00 | 2022-09-16 19:33:56.130000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
Patches
[S0093] Backdoor.Oldrea
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-11 14:00:00.188000+00:00 | 2022-10-12 17:18:25.971000+00:00 |
[S0606] Bad Rabbit
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:29:57.200000+00:00 |
| external_references[1]['source_name'] | Secure List Bad Rabbit | ESET Bad Rabbit |
| external_references[1]['description'] | Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. | M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. |
| external_references[1]['url'] | https://securelist.com/bad-rabbit-ransomware/82851/ | https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/ |
| external_references[2]['source_name'] | ESET Bad Rabbit | Secure List Bad Rabbit |
| external_references[2]['description'] | M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. | Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. |
| external_references[2]['url'] | https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/ | https://securelist.com/bad-rabbit-ransomware/82851/ |
[S0089] BlackEnergy
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:33:00.482000+00:00 |
[S0527] CSPY Downloader
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-22 13:48:19.728000+00:00 | 2022-10-18 23:14:56.867000+00:00 |
[S0673] DarkWatchman
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-09 20:12:54.255000+00:00 | 2022-10-18 23:16:37.724000+00:00 |
[S0064] ELMER
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 16:21:32.420000+00:00 | 2022-07-26 23:33:26.355000+00:00 |
| external_references[1]['description'] | Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. | Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. |
| external_references[1]['url'] | https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html | https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
[S0143] Flame
Current version: 1.1
|
|
|---|
| t | Flame is a sophisticated toolkit that has been used to colle | t | [Flame](https://attack.mitre.org/software/S0143) is a sophis |
| ct information since at least 2010, largely targeting Middle | | ticated toolkit that has been used to collect information si |
| East countries. (Citation: Kaspersky Flame) | | nce at least 2010, largely targeting Middle East countries. |
| | | (Citation: Kaspersky Flame) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:51:18.408000+00:00 |
| description | Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame) | [Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame) |
| external_references[2]['source_name'] | Flamer | sKyWIper |
| external_references[2]['description'] | (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice) | (Citation: Kaspersky Flame) (Citation: Crysys Skywiper) |
| external_references[3]['source_name'] | sKyWIper | Flamer |
| external_references[3]['description'] | (Citation: Kaspersky Flame) (Citation: Crysys Skywiper) | (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice) |
| external_references[5]['source_name'] | Symantec Beetlejuice | Crysys Skywiper |
| external_references[5]['description'] | Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017. | sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018. |
| external_references[5]['url'] | https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache | https://www.crysys.hu/publications/files/skywiper.pdf |
| external_references[6]['source_name'] | Crysys Skywiper | Symantec Beetlejuice |
| external_references[6]['description'] | sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018. | Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017. |
| external_references[6]['url'] | https://www.crysys.hu/publications/files/skywiper.pdf | https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache |
[S0531] Grandoreiro
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-12-22 21:22:34.174000+00:00 | 2022-10-19 22:11:10.040000+00:00 |
| external_references[1]['source_name'] | Securelist Brazilian Banking Malware July 2020 | ESET Grandoreiro April 2020 |
| external_references[1]['description'] | GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. | ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. |
| external_references[1]['url'] | https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ | https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/ |
| external_references[2]['source_name'] | ESET Grandoreiro April 2020 | Securelist Brazilian Banking Malware July 2020 |
| external_references[2]['description'] | ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. | GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020. |
| external_references[2]['url'] | https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/ | https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ |
[S0697] HermeticWiper
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-17 12:40:05.078000+00:00 | 2022-10-18 23:19:38.268000+00:00 |
[S0455] Metamorfo
Current version: 2.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-27 19:32:33.491000+00:00 | 2022-10-18 23:23:55.295000+00:00 |
| external_references[1]['source_name'] | Metamorfo | Casbaneiro |
| external_references[1]['description'] | (Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019) | (Citation: ESET Casbaneiro Oct 2019) |
| external_references[2]['source_name'] | Casbaneiro | Metamorfo |
| external_references[2]['description'] | (Citation: ESET Casbaneiro Oct 2019) | (Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019) |
[S0280] MirageFox
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 17:05:26.798000+00:00 | 2022-07-22 18:52:32.764000+00:00 |
| external_references[2]['url'] | https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ | https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
[S0080] Mivast
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 16:03:26.871000+00:00 | 2022-07-20 20:09:46.802000+00:00 |
| external_references[2]['url'] | http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf | https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf |
[S0056] Net Crawler
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-21 16:41:34.225000+00:00 | 2022-07-22 18:37:22.182000+00:00 |
| external_references[1]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
[S0145] POWERSOURCE
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 17:17:35.369000+00:00 | 2022-07-20 20:06:44.707000+00:00 |
| external_references[3]['source_name'] | FireEye FIN7 March 2017 | Cisco DNSMessenger March 2017 |
| external_references[3]['description'] | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. | Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017. |
| external_references[3]['url'] | https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html | http://blog.talosintelligence.com/2017/03/dnsmessenger.html |
| external_references[4]['source_name'] | Cisco DNSMessenger March 2017 | FireEye FIN7 March 2017 |
| external_references[4]['description'] | Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017. | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. |
| external_references[4]['url'] | http://blog.talosintelligence.com/2017/03/dnsmessenger.html | https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
[S0496] REvil
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-21 01:01:16.684000+00:00 | 2022-05-24 21:09:01.019000+00:00 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[S0364] RawDisk
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-04-19 19:04:55.892000+00:00 | 2022-07-28 18:55:35.991000+00:00 |
| external_references[2]['url'] | https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf |
[S0446] Ryuk
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-26 13:13:19.978000+00:00 | 2022-05-24 21:10:44.381000+00:00 |
| external_references[2]['source_name'] | CrowdStrike Ryuk January 2019 | Bleeping Computer - Ryuk WoL |
| external_references[2]['description'] | Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. | Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021. |
| external_references[2]['url'] | https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ | https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ |
| external_references[4]['source_name'] | FireEye FIN6 Apr 2019 | CrowdStrike Ryuk January 2019 |
| external_references[4]['description'] | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. | Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020. |
| external_references[4]['url'] | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html | https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ |
| external_references[5]['source_name'] | Bleeping Computer - Ryuk WoL | FireEye FIN6 Apr 2019 |
| external_references[5]['description'] | Abrams, L. (2021, January 14). Ryuk Ransomware Uses Wake-on-Lan To Encrypt Offline Devices. Retrieved February 11, 2021. | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. |
| external_references[5]['url'] | https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/ | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[S0589] Sibot
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 22:30:19.071000+00:00 | 2022-10-18 23:33:55.403000+00:00 |
[S0146] TEXTMATE
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 18:19:25.928000+00:00 | 2022-07-20 20:06:44.708000+00:00 |
| external_references[3]['source_name'] | FireEye FIN7 March 2017 | Cisco DNSMessenger March 2017 |
| external_references[3]['description'] | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. | Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017. |
| external_references[3]['url'] | https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html | http://blog.talosintelligence.com/2017/03/dnsmessenger.html |
| external_references[4]['source_name'] | Cisco DNSMessenger March 2017 | FireEye FIN7 March 2017 |
| external_references[4]['description'] | Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017. | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. |
| external_references[4]['url'] | http://blog.talosintelligence.com/2017/03/dnsmessenger.html | https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
[S0004] TinyZBot
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-21 16:41:34.655000+00:00 | 2022-07-22 18:37:22.180000+00:00 |
| external_references[1]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
mobile-attack
Patches
[S0310] ANDROIDOS_ANSERVER.A
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-15 19:55:04.407000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0309] Adups
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0319] Allwinner
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0292] AndroRAT
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0304] Android/Chuli.A
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-15 20:31:25.864000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0323] Charger
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-09 14:51:42.697000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0301] Dendroid
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-29 13:24:14.934000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0300] DressCode
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0315] DualToy
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0290] Gooligan
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-10 15:18:50.693000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0322] HummingBad
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0321] HummingWhale
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0325] Judy
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0288] KeyRaider
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0317] Marcher
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0303] MazarBOT
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0299] NotCompatible
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0286] OBAD
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0285] OldBoot
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0291] PJApps
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0316] Pegasus for Android
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-08-09 17:52:31.636000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0289] Pegasus for iOS
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-01-24 13:55:33.492000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0295] RCSAndroid
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-10 15:22:52.282000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0326] RedDrop
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-15 19:56:13.028000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0313] RuMMS
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0294] ShiftyBug
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0327] Skygofree
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-15 19:33:42.064000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0324] SpyDealer
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-15 19:37:21.120000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0305] SpyNote RAT
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-10 15:24:08.969000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0328] Stealth Mango
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-11 15:55:43.283000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0329] Tangelo
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-10-10 15:27:21.781000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0307] Trojan-SMS.AndroidOS.Agent.ao
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0306] Trojan-SMS.AndroidOS.FakeInst.a
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0308] Trojan-SMS.AndroidOS.OpFake.a
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0302] Twitoor
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-30 13:19:59.692000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0312] WireLurker
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0314] X-Agent for Android
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0318] XLoader for Android
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-16 01:46:53.625000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0298] Xbot
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0297] XcodeGhost
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0311] YiSpecter
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
[S0287] ZergHelper
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-12-11 20:40:31.461000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-mobile-attack | mitre-attack |
ics-attack
New Software
[S1045] INCONTROLLER
Current version: 1.0
Description: [INCONTROLLER](https://attack.mitre.org/software/S1045) is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. [INCONTROLLER](https://attack.mitre.org/software/S1045) has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed [INCONTROLLER](https://attack.mitre.org/software/S1045) was developed by CHERNOVITE.(Citation: CISA-AA22-103A)(Citation: Brubaker-Incontroller)(Citation: Dragos-Pipedream)(Citation: Schneider-Incontroller)(Citation: Wylie-22)
Minor Version Changes
[S0604] Industroyer
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:22:34.355000+00:00 | 2022-10-20 20:37:50.556000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[S0603] Stuxnet
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-20 16:22:32.608000+00:00 | 2022-10-20 20:31:32.664000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
Patches
[S1000] ACAD/Medre.A
Current version: 1.0
|
|
|---|
| t | [ACAD/Medre.A](https://attack.mitre.org/software/S0018) is a | t | [ACAD/Medre.A](https://attack.mitre.org/software/S1000) is a |
| worm that steals operational information. The worm collects | | worm that steals operational information. The worm collects |
| AutoCAD files with drawings. [ACAD/Medre.A](https://attack. | | AutoCAD files with drawings. [ACAD/Medre.A](https://attack. |
| mitre.org/software/S0018) has the capability to be used for | | mitre.org/software/S1000) has the capability to be used for |
| industrial espionage. (Citation: ESET) | | industrial espionage.(Citation: ESET) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['ACAD/Medre.A'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.008000+00:00 | 2022-10-12 17:15:44.068000+00:00 |
| description | [ACAD/Medre.A](https://attack.mitre.org/software/S0018) is a worm that steals operational information. The worm collects AutoCAD files with drawings. [ACAD/Medre.A](https://attack.mitre.org/software/S0018) has the capability to be used for industrial espionage. (Citation: ESET) | [ACAD/Medre.A](https://attack.mitre.org/software/S1000) is a worm that steals operational information. The worm collects AutoCAD files with drawings. [ACAD/Medre.A](https://attack.mitre.org/software/S1000) has the capability to be used for industrial espionage.(Citation: ESET) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[0]['url'] | https://attack.mitre.org/software/S0018 | https://attack.mitre.org/software/S1000 |
[S0093] Backdoor.Oldrea
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-11 14:00:00.188000+00:00 | 2022-10-12 17:18:25.971000+00:00 |
[S0606] Bad Rabbit
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:29:57.200000+00:00 |
| external_references[1]['source_name'] | Secure List Bad Rabbit | ESET Bad Rabbit |
| external_references[1]['description'] | Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. | M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. |
| external_references[1]['url'] | https://securelist.com/bad-rabbit-ransomware/82851/ | https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/ |
| external_references[2]['source_name'] | ESET Bad Rabbit | Secure List Bad Rabbit |
| external_references[2]['description'] | M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021. | Mamedov, O. Sinitsyn, F. Ivanov, A.. (2017, October 24). Bad Rabbit ransomware. Retrieved January 28, 2021. |
| external_references[2]['url'] | https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/ | https://securelist.com/bad-rabbit-ransomware/82851/ |
[S0089] BlackEnergy
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:33:00.482000+00:00 |
[S0143] Flame
Current version: 1.1
|
|
|---|
| t | Flame is a sophisticated toolkit that has been used to colle | t | [Flame](https://attack.mitre.org/software/S0143) is a sophis |
| ct information since at least 2010, largely targeting Middle | | ticated toolkit that has been used to collect information si |
| East countries. (Citation: Kaspersky Flame) | | nce at least 2010, largely targeting Middle East countries. |
| | | (Citation: Kaspersky Flame) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 14:00:00.188000+00:00 | 2022-10-12 17:51:18.408000+00:00 |
| description | Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame) | [Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame) |
| external_references[2]['source_name'] | Flamer | sKyWIper |
| external_references[2]['description'] | (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice) | (Citation: Kaspersky Flame) (Citation: Crysys Skywiper) |
| external_references[3]['source_name'] | sKyWIper | Flamer |
| external_references[3]['description'] | (Citation: Kaspersky Flame) (Citation: Crysys Skywiper) | (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice) |
| external_references[5]['source_name'] | Symantec Beetlejuice | Crysys Skywiper |
| external_references[5]['description'] | Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017. | sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018. |
| external_references[5]['url'] | https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache | https://www.crysys.hu/publications/files/skywiper.pdf |
| external_references[6]['source_name'] | Crysys Skywiper | Symantec Beetlejuice |
| external_references[6]['description'] | sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018. | Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017. |
| external_references[6]['url'] | https://www.crysys.hu/publications/files/skywiper.pdf | https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache |
[S1006] PLC-Blaster
Current version: 1.0
|
|
|---|
| t | [PLC-Blaster](https://attack.mitre.org/software/S0009) is a | t | [PLC-Blaster](https://attack.mitre.org/software/S1006) is a |
| piece of proof-of-concept malware that runs on Siemens S7 PL | | piece of proof-of-concept malware that runs on Siemens S7 PL |
| Cs. This worm locates other Siemens S7 PLCs on the network a | | Cs. This worm locates other Siemens S7 PLCs on the network a |
| nd attempts to infect them. Once this worm has infected its | | nd attempts to infect them. Once this worm has infected its |
| target and attempted to infect other devices on the network | | target and attempted to infect other devices on the network |
| , the worm can then run one of many modules. (Citation: Spen | | , the worm can then run one of many modules. (Citation: Spen |
| neberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 20 | | neberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 20 |
| 16) (Citation: Spenneberg, Ralf 2016) | | 16) (Citation: Spenneberg, Ralf 2016) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['PLC-Blaster'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.022000+00:00 | 2022-10-12 17:59:55.276000+00:00 |
| description | [PLC-Blaster](https://attack.mitre.org/software/S0009) is a piece of proof-of-concept malware that runs on Siemens S7 PLCs. This worm locates other Siemens S7 PLCs on the network and attempts to infect them. Once this worm has infected its target and attempted to infect other devices on the network, the worm can then run one of many modules. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016) (Citation: Spenneberg, Ralf 2016) | [PLC-Blaster](https://attack.mitre.org/software/S1006) is a piece of proof-of-concept malware that runs on Siemens S7 PLCs. This worm locates other Siemens S7 PLCs on the network and attempts to infect them. Once this worm has infected its target and attempted to infect other devices on the network, the worm can then run one of many modules. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016) (Citation: Spenneberg, Ralf 2016) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[0]['url'] | https://attack.mitre.org/software/S0009 | https://attack.mitre.org/software/S1006 |
| external_references[1]['source_name'] | Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016 | Spenneberg, Ralf 2016 |
| external_references[1]['description'] | Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 | Spenneberg, Ralf 2016 PLC-Blaster Retrieved. 2019/06/06 |
| external_references[1]['url'] | https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf | https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf |
| external_references[2]['source_name'] | Spenneberg, Ralf 2016 | Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016 |
| external_references[2]['description'] | Spenneberg, Ralf 2016 PLC-Blaster Retrieved. 2019/06/06 | Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 |
| external_references[2]['url'] | https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf | https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf |
[S1009] Triton
Current version: 1.0
|
|
|---|
| t | [Triton](https://attack.mitre.org/software/S0013) is an atta | t | [Triton](https://attack.mitre.org/software/S1009) is an atta |
| ck framework built to interact with Triconex Safety Instrume | | ck framework built to interact with Triconex Safety Instrume |
| nted System (SIS) controllers. (Citation: Blake Johnson, Dan | | nted System (SIS) controllers. (Citation: Blake Johnson, Dan |
| Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christo | | Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christo |
| pher Glyer December 2017) (Citation: Dragos December 2017) ( | | pher Glyer December 2017) (Citation: Dragos December 2017) ( |
| Citation: DHS CISA February 2019) (Citation: Schneider Elect | | Citation: DHS CISA February 2019) (Citation: Schneider Elect |
| ric January 2018) (Citation: Julian Gutmanis March 2019) (Ci | | ric January 2018) (Citation: Julian Gutmanis March 2019) (Ci |
| tation: Schneider December 2018) (Citation: Jos Wetzels Janu | | tation: Schneider December 2018) (Citation: Jos Wetzels Janu |
| ary 2018) | | ary 2018) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.030000+00:00 | 2022-10-12 18:29:38.831000+00:00 |
| description | [Triton](https://attack.mitre.org/software/S0013) is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: DHS CISA February 2019) (Citation: Schneider Electric January 2018) (Citation: Julian Gutmanis March 2019) (Citation: Schneider December 2018) (Citation: Jos Wetzels January 2018) | [Triton](https://attack.mitre.org/software/S1009) is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: DHS CISA February 2019) (Citation: Schneider Electric January 2018) (Citation: Julian Gutmanis March 2019) (Citation: Schneider December 2018) (Citation: Jos Wetzels January 2018) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[0]['url'] | https://attack.mitre.org/software/S0013 | https://attack.mitre.org/software/S1009 |
| external_references[2]['source_name'] | Dragos December 2017 | DHS CISA February 2019 |
| external_references[2]['description'] | Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 | DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 |
| external_references[2]['url'] | https://dragos.com/blog/trisis/TRISIS-01.pdf | https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf |
| external_references[3]['source_name'] | DHS CISA February 2019 | Dragos December 2017 |
| external_references[3]['description'] | DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 | Dragos 2017, December 13 TRISIS Malware Analysis of Safety System Targeted Malware Retrieved. 2018/01/12 |
| external_references[3]['url'] | https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf | https://dragos.com/blog/trisis/TRISIS-01.pdf |
| external_references[4]['source_name'] | Schneider Electric January 2018 | Jos Wetzels January 2018 |
| external_references[4]['description'] | Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 | Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 |
| external_references[4]['url'] | https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s | https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware |
| external_references[7]['source_name'] | Schneider Electric December 2018 | Schneider Electric January 2018 |
| external_references[7]['description'] | Schneider Electric 2018, December 14 Security Notification - EcoStruxure Triconex Tricon V3 Retrieved. 2019/08/26 | Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 |
| external_references[7]['url'] | https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2017-347-01+Triconex+V3.pdf&p_Doc_Ref=SEVD-2017-347-01 | https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | Triton |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Jos Wetzels January 2018', 'description': 'Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ', 'url': 'https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware'} | |
[S1010] VPNFilter
Current version: 1.0
|
|
|---|
| t | [VPNFilter](https://attack.mitre.org/software/S0002) is a mu | t | [VPNFilter](https://attack.mitre.org/software/S1010) is a mu |
| lti-stage, modular platform with versatile capabilities to s | | lti-stage, modular platform with versatile capabilities to s |
| upport both intelligence-collection and destructive cyber at | | upport both intelligence-collection and destructive cyber at |
| tack operations. [VPNFilter](https://attack.mitre.org/softwa | | tack operations. [VPNFilter](https://attack.mitre.org/softwa |
| re/S0002) modules such as its packet sniffer ('ps') can coll | | re/S1010) modules such as its packet sniffer ('ps') can coll |
| ect traffic that passes through an infected device, allowing | | ect traffic that passes through an infected device, allowing |
| the theft of website credentials and monitoring of Modbus S | | the theft of website credentials and monitoring of Modbus S |
| CADA protocols. (Citation: William Largent June 2018) (Citat | | CADA protocols. (Citation: William Largent June 2018) (Citat |
| ion: Carl Hurd March 2019) | | ion: Carl Hurd March 2019) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['VPNFilter'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.032000+00:00 | 2022-10-12 18:30:51.174000+00:00 |
| description | [VPNFilter](https://attack.mitre.org/software/S0002) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S0002) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) | [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
| external_references[0]['url'] | https://attack.mitre.org/software/S0002 | https://attack.mitre.org/software/S1010 |
| external_references[1]['source_name'] | William Largent June 2018 | Carl Hurd March 2019 |
| external_references[1]['description'] | William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 | Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 |
| external_references[1]['url'] | https://blog.talosintelligence.com/2018/06/vpnfilter-update.html | https://www.youtube.com/watch?v=yuZazP22rpI |
| external_references[2]['source_name'] | Carl Hurd March 2019 | William Largent June 2018 |
| external_references[2]['description'] | Carl Hurd 2019, March 26 VPNFilter Deep Dive Retrieved. 2019/03/28 | William Largent 2018, June 06 VPNFilter Update - VPNFilter exploits endpoints, targets new devices Retrieved. 2019/03/28 |
| external_references[2]['url'] | https://www.youtube.com/watch?v=yuZazP22rpI | https://blog.talosintelligence.com/2018/06/vpnfilter-update.html |
Groups
enterprise-attack
New Groups
[G1007] Aoqin Dragon
Current version: 1.0
Description: [Aoqin Dragon](https://attack.mitre.org/groups/G1007) is a suspected Chinese cyber espionage threat group that has been active since at least 2013. [Aoqin Dragon](https://attack.mitre.org/groups/G1007) has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between [Aoqin Dragon](https://attack.mitre.org/groups/G1007) and UNC94, based on malware, infrastructure, and targets.(Citation: SentinelOne Aoqin Dragon June 2022)
[G1002] BITTER
Current version: 1.0
Description: [BITTER](https://attack.mitre.org/groups/G1002) is a suspected South Asian cyber espionage threat group that has been active since at least 2013. [BITTER](https://attack.mitre.org/groups/G1002) has primarily targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)
[G1011] EXOTIC LILY
Current version: 1.0
Description: [EXOTIC LILY](https://attack.mitre.org/groups/G1011) is a financially motivated group that has been closely linked with [Wizard Spider](https://attack.mitre.org/groups/G0102) and the deployment of ransomware including [Conti](https://attack.mitre.org/software/S0575) and [Diavol](https://attack.mitre.org/software/S0659). [EXOTIC LILY](https://attack.mitre.org/groups/G1011) may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)
[G1006] Earth Lusca
Current version: 1.0
Description: [Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)
[Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)
[G1003] Ember Bear
Current version: 1.0
Description: [Ember Bear](https://attack.mitre.org/groups/G1003) is a suspected Russian state-sponsored cyber espionage group that has been active since at least March 2021. [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused their operations against Ukraine and Georgia, but has also targeted Western European and North American foreign ministries, pharmaceutical companies, and financial sector organizations. Security researchers assess [Ember Bear](https://attack.mitre.org/groups/G1003) likely conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
[G1001] HEXANE
Current version: 2.0
Description: [HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)
[G1004] LAPSUS$
Current version: 1.0
Description: [LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)
[G1009] Moses Staff
Current version: 1.0
Description: [Moses Staff](https://attack.mitre.org/groups/G1009) is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. [Moses Staff](https://attack.mitre.org/groups/G1009) openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021)
Security researchers assess [Moses Staff](https://attack.mitre.org/groups/G1009) is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)
[G1005] POLONIUM
Current version: 1.0
Description: [POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://attack.mitre.org/groups/G1005) has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)
[G1008] SideCopy
Current version: 1.0
Description: [SideCopy](https://attack.mitre.org/groups/G1008) is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. [SideCopy](https://attack.mitre.org/groups/G1008)'s name comes from its infection chain that tries to mimic that of [Sidewinder](https://attack.mitre.org/groups/G0121), a suspected Indian threat group.(Citation: MalwareBytes SideCopy Dec 2021)
Major Version Changes
[G0093] GALLIUM
Current version: 3.0
Version changed from: 2.0 → 3.0
|
|
|---|
| t | [GALLIUM](https://attack.mitre.org/groups/G0093) is a group | t | [GALLIUM](https://attack.mitre.org/groups/G0093) is a cybere |
| that has been active since at least 2012, primarily targetin | | spionage group that has been active since at least 2012, pri |
| g high-profile telecommunications networks. [GALLIUM](https: | | marily targeting telecommunications companies, financial ins |
| //attack.mitre.org/groups/G0093) has been identified in some | | titutions, and government entities in Afghanistan, Australia |
| reporting as likely a Chinese state-sponsored group, based | | , Belgium, Cambodia, Malaysia, Mozambique, the Philippines, |
| in part on tools used and TTPs commonly associated with Chin | | Russia, and Vietnam. Security researchers have identified [G |
| ese threat actors.(Citation: Cybereason Soft Cell June 2019) | | ALLIUM](https://attack.mitre.org/groups/G0093) as a likely C |
| (Citation: Microsoft GALLIUM December 2019) | | hinese state-sponsored group, based in part on tools used an |
| | | d TTPs commonly associated with Chinese threat actors.(Citat |
| | | ion: Cybereason Soft Cell June 2019)(Citation: Microsoft GAL |
| | | LIUM December 2019)(Citation: Unit 42 PingPull Jun 2022) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-23 01:32:21.874000+00:00 | 2022-08-12 21:26:22.303000+00:00 |
| description | [GALLIUM](https://attack.mitre.org/groups/G0093) is a group that has been active since at least 2012, primarily targeting high-profile telecommunications networks. [GALLIUM](https://attack.mitre.org/groups/G0093) has been identified in some reporting as likely a Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019) | [GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022) |
| external_references[1]['source_name'] | GALLIUM | Operation Soft Cell |
| external_references[1]['description'] | (Citation: Microsoft GALLIUM December 2019) | (Citation: Cybereason Soft Cell June 2019) |
| external_references[2]['source_name'] | Operation Soft Cell | GALLIUM |
| external_references[2]['description'] | (Citation: Cybereason Soft Cell June 2019) | (Citation: Microsoft GALLIUM December 2019) |
| x_mitre_version | 2.0 | 3.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Unit 42 PingPull Jun 2022', 'description': 'Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.', 'url': 'https://unit42.paloaltonetworks.com/pingpull-gallium/'} |
[G0059] Magic Hound
Current version: 5.0
Version changed from: 4.1 → 5.0
|
|
|---|
| t | [Magic Hound](https://attack.mitre.org/groups/G0059) is an I | t | [Magic Hound](https://attack.mitre.org/groups/G0059) is an I |
| ranian-sponsored threat group that conducts long term, resou | | ranian-sponsored threat group that conducts long term, resou |
| rce-intensive cyber espionage operations, likely on behalf o | | rce-intensive cyber espionage operations, likely on behalf o |
| f the Islamic Revolutionary Guard Corps. They have targeted | | f the Islamic Revolutionary Guard Corps. They have targeted |
| U.S. and Middle Eastern government and military personnel, a | | European, U.S., and Middle Eastern government and military p |
| cademics, journalists, and organizations such as the World H | | ersonnel, academics, journalists, and organizations such as |
| ealth Organization (WHO), via complex social engineering cam | | the World Health Organization (WHO), via complex social engi |
| paigns since at least 2014.(Citation: FireEye APT35 2018)(Ci | | neering campaigns since at least 2014.(Citation: FireEye APT |
| tation: ClearSky Kittens Back 3 August 2020)(Citation: Certf | | 35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Cita |
| a Charming Kitten January 2021)(Citation: Secureworks COBALT | | tion: Certfa Charming Kitten January 2021)(Citation: Securew |
| ILLUSION Threat Profile)(Citation: Proofpoint TA453 July202 | | orks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA |
| 1) | | 453 July2021) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-17 13:09:12.889000+00:00 | 2022-06-03 13:20:02.945000+00:00 |
| description | [Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted U.S. and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021) | [Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021) |
| x_mitre_version | 4.1 | 5.0 |
[G0069] MuddyWater
Current version: 4.0
Version changed from: 3.0 → 4.0
|
|
|---|
| t | [MuddyWater](https://attack.mitre.org/groups/G0069) is an Ir | t | [MuddyWater](https://attack.mitre.org/groups/G0069) is a cyb |
| anian threat group that has primarily targeted Middle Easter | | er espionage group assessed to be a subordinate element with |
| n nations, and has also targeted European and North American | | in Iran's Ministry of Intelligence and Security (MOIS).(Cita |
| nations. The group's victims are mainly in the telecommunic | | tion: CYBERCOM Iranian Intel Cyber January 2022) Since at le |
| ations, government (IT services), and oil sectors. Activity | | ast 2017, [MuddyWater](https://attack.mitre.org/groups/G0069 |
| from this group was previously linked to [FIN7](https://atta | | ) has targeted a range of government and private organizatio |
| ck.mitre.org/groups/G0046), but the group is believed to be | | ns across sectors, including telecommunications, local gover |
| a distinct group possibly motivated by espionage.(Citation: | | nment, defense, and oil and natural gas organizations, in th |
| Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater D | | e Middle East, Asia, Africa, Europe, and North America.(Cita |
| ec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: C | | tion: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyW |
| learSky MuddyWater June 2019)(Citation: Reaqta MuddyWater No | | ater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citat |
| vember 2017) | | ion: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWa |
| | | ter November 2017)(Citation: DHS CISA AA22-055A MuddyWater F |
| | | ebruary 2022)(Citation: Talos MuddyWater Jan 2022) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_contributors | | ['Ozer Sarilar, @ozersarilar, STM', 'Daniyal Naeem, BT Security'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-26 22:30:05.308000+00:00 | 2022-10-17 12:43:55.847000+00:00 |
| description | [MuddyWater](https://attack.mitre.org/groups/G0069) is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group's victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to [FIN7](https://attack.mitre.org/groups/G0046), but the group is believed to be a distinct group possibly motivated by espionage.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017) | [MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022) |
| aliases[1] | Earth Vetala | Earth Vetala |
| external_references[1]['source_name'] | MuddyWater | MERCURY |
| external_references[1]['description'] | (Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018) | (Citation: Anomali Static Kitten February 2021) |
| external_references[2]['source_name'] | Earth Vetala | Static Kitten |
| external_references[2]['description'] | (Citation: Trend Micro Muddy Water March 2021) | (Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) |
| external_references[3]['source_name'] | MERCURY | TEMP.Zagros |
| external_references[3]['description'] | (Citation: Anomali Static Kitten February 2021) | (Citation: FireEye MuddyWater Mar 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) |
| external_references[4]['source_name'] | Static Kitten | Seedworm |
| external_references[4]['description'] | (Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) | (Citation: Symantec MuddyWater Dec 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) |
| external_references[5]['source_name'] | Seedworm | Earth Vetala |
| external_references[5]['description'] | (Citation: Symantec MuddyWater Dec 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) | (Citation: Trend Micro Muddy Water March 2021) |
| external_references[6]['source_name'] | TEMP.Zagros | MuddyWater |
| external_references[6]['description'] | (Citation: FireEye MuddyWater Mar 2018)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021) | (Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018) |
| external_references[7]['source_name'] | Unit 42 MuddyWater Nov 2017 | ClearSky MuddyWater Nov 2018 |
| external_references[7]['description'] | Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018. | ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. |
| external_references[7]['url'] | https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ | https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf |
| external_references[8]['source_name'] | Symantec MuddyWater Dec 2018 | ClearSky MuddyWater June 2019 |
| external_references[8]['description'] | Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018. | ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020. |
| external_references[8]['url'] | https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group | https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf |
| external_references[9]['source_name'] | ClearSky MuddyWater Nov 2018 | CYBERCOM Iranian Intel Cyber January 2022 |
| external_references[9]['description'] | ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018. | Cyber National Mission Force. (2022, January 12). Iranian intel cyber suite of malware uses open source tools. Retrieved September 30, 2022. |
| external_references[9]['url'] | https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf | https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ |
| external_references[10]['source_name'] | ClearSky MuddyWater June 2019 | DHS CISA AA22-055A MuddyWater February 2022 |
| external_references[10]['description'] | ClearSky. (2019, June). Iranian APT group ‘MuddyWater’ Adds Exploits to Their Arsenal. Retrieved May 14, 2020. | FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022. |
| external_references[10]['url'] | https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf | https://www.cisa.gov/uscert/ncas/alerts/aa22-055a |
| external_references[11]['source_name'] | Reaqta MuddyWater November 2017 | Unit 42 MuddyWater Nov 2017 |
| external_references[11]['description'] | Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020. | Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018. |
| external_references[11]['url'] | https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ | https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ |
| external_references[12]['source_name'] | Trend Micro Muddy Water March 2021 | Talos MuddyWater Jan 2022 |
| external_references[12]['description'] | Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. | Malhortra, A and Ventura, V. (2022, January 31). Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables. Retrieved June 22, 2022. |
| external_references[12]['url'] | https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html | https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html |
| external_references[14]['source_name'] | FireEye MuddyWater Mar 2018 | Trend Micro Muddy Water March 2021 |
| external_references[14]['description'] | Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018. | Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021. |
| external_references[14]['url'] | https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html | https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html |
| x_mitre_version | 3.0 | 4.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Reaqta MuddyWater November 2017', 'description': 'Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.', 'url': 'https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/'} |
| external_references | | {'source_name': 'FireEye MuddyWater Mar 2018', 'description': 'Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.', 'url': 'https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html'} |
| external_references | | {'source_name': 'Symantec MuddyWater Dec 2018', 'description': 'Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.', 'url': 'https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group'} |
[G0092] TA505
Current version: 2.0
Version changed from: 1.3 → 2.0
|
|
|---|
| t | [TA505](https://attack.mitre.org/groups/G0092) is a financia | t | [TA505](https://attack.mitre.org/groups/G0092) is a cyber cr |
| lly motivated threat group that has been active since at lea | | iminal group that has been active since at least 2014. [TA50 |
| st 2014. The group is known for frequently changing malware | | 5](https://attack.mitre.org/groups/G0092) is known for frequ |
| and driving global trends in criminal malware distribution.( | | ently changing malware, driving global trends in criminal ma |
| Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA | | lware distribution, and ransomware campaigns involving [Clop |
| 505 June 2018)(Citation: Proofpoint TA505 Jan 2019) | | ](https://attack.mitre.org/software/S0611).(Citation: Proofp |
| | | oint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(C |
| | | itation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA50 |
| | | 5)(Citation: Korean FSI TA505 2020) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-12-01 23:27:44.104000+00:00 | 2022-10-13 16:17:20.601000+00:00 |
| description | [TA505](https://attack.mitre.org/groups/G0092) is a financially motivated threat group that has been active since at least 2014. The group is known for frequently changing malware and driving global trends in criminal malware distribution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019) | [TA505](https://attack.mitre.org/groups/G0092) is a cyber criminal group that has been active since at least 2014. [TA505](https://attack.mitre.org/groups/G0092) is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving [Clop](https://attack.mitre.org/software/S0611).(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020) |
| external_references[2]['source_name'] | Proofpoint TA505 Sep 2017 | Korean FSI TA505 2020 |
| external_references[2]['description'] | Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. | Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022. |
| external_references[2]['url'] | https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter | https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory= |
| external_references[3]['source_name'] | Proofpoint TA505 June 2018 | IBM TA505 April 2020 |
| external_references[3]['description'] | Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019. | Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. |
| external_references[3]['url'] | https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times | https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ |
| external_references[4]['source_name'] | Proofpoint TA505 Jan 2019 | Proofpoint TA505 Sep 2017 |
| external_references[4]['description'] | Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019. | Proofpoint Staff. (2017, September 27). Threat Actor Profile: TA505, From Dridex to GlobeImposter. Retrieved May 28, 2019. |
| external_references[4]['url'] | https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505 | https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter |
| external_references[5]['source_name'] | IBM TA505 April 2020 | Proofpoint TA505 June 2018 |
| external_references[5]['description'] | Frydrych, M. (2020, April 14). TA505 Continues to Infect Networks With SDBbot RAT. Retrieved May 29, 2020. | Proofpoint Staff. (2018, June 8). TA505 shifts with the times. Retrieved May 28, 2019. |
| external_references[5]['url'] | https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/ | https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times |
| x_mitre_version | 1.3 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Proofpoint TA505 Jan 2019', 'description': 'Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.', 'url': 'https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505'} |
| external_references | | {'source_name': 'NCC Group TA505', 'description': 'Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.', 'url': 'https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/'} |
Minor Version Changes
[G0016] APT29
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-14 17:14:25.162000+00:00 | 2022-07-11 20:34:55.717000+00:00 |
| x_mitre_version | 3.0 | 3.1 |
[G0052] CopyKittens
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | [CopyKittens](https://attack.mitre.org/groups/G0052) is an I | t | [CopyKittens](https://attack.mitre.org/groups/G0052) is an I |
| ranian cyber espionage group that has been operating since a | | ranian cyber espionage group that has been operating since a |
| t least 2013. It has targeted countries including Israel, Sa | | t least 2013. It has targeted countries including Israel, Sa |
| udi Arabia, Turkey, the U.S., Jordan, and Germany. The group | | udi Arabia, Turkey, the U.S., Jordan, and Germany. The group |
| is responsible for the campaign known as Operation Wilted T | | is responsible for the campaign known as Operation Wilted T |
| ulip. (Citation: ClearSky CopyKittens March 2017) (Citation: | | ulip.(Citation: ClearSky CopyKittens March 2017)(Citation: C |
| ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov | | learSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 20 |
| 2015) | | 15) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-05-26 12:32:58.912000+00:00 | 2022-08-08 21:29:36.462000+00:00 |
| description | [CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip. (Citation: ClearSky CopyKittens March 2017) (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015) | [CopyKittens](https://attack.mitre.org/groups/G0052) is an Iranian cyber espionage group that has been operating since at least 2013. It has targeted countries including Israel, Saudi Arabia, Turkey, the U.S., Jordan, and Germany. The group is responsible for the campaign known as Operation Wilted Tulip.(Citation: ClearSky CopyKittens March 2017)(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015) |
| external_references[2]['source_name'] | ClearSky CopyKittens March 2017 | ClearSky Wilted Tulip July 2017 |
| external_references[2]['description'] | ClearSky Cyber Security. (2017, March 30). Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten. Retrieved August 21, 2017. | ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017. |
| external_references[2]['url'] | http://www.clearskysec.com/copykitten-jpost/ | http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf |
| external_references[3]['source_name'] | ClearSky Wilted Tulip July 2017 | ClearSky CopyKittens March 2017 |
| external_references[3]['description'] | ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017. | ClearSky Cyber Security. (2017, March 30). Jerusalem Post and other Israeli websites compromised by Iranian threat agent CopyKitten. Retrieved August 21, 2017. |
| external_references[3]['url'] | http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf | http://www.clearskysec.com/copykitten-jpost/ |
| x_mitre_version | 1.5 | 1.6 |
[G0012] Darkhotel
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-22 17:37:58.136000+00:00 | 2022-10-19 22:07:30.243000+00:00 |
| external_references[3]['source_name'] | Kaspersky Darkhotel | Securelist Darkhotel Aug 2015 |
| external_references[3]['description'] | Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014. | Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018. |
| external_references[3]['url'] | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf | https://securelist.com/darkhotels-attacks-in-2015/71713/ |
| external_references[4]['source_name'] | Securelist Darkhotel Aug 2015 | Kaspersky Darkhotel |
| external_references[4]['description'] | Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018. | Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014. |
| external_references[4]['url'] | https://securelist.com/darkhotels-attacks-in-2015/71713/ | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf |
| external_references[6]['source_name'] | Microsoft DUBNIUM June 2016 | Microsoft DUBNIUM July 2016 |
| external_references[6]['description'] | Microsoft. (2016, June 9). Reverse-engineering DUBNIUM. Retrieved March 31, 2021. | Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021. |
| external_references[6]['url'] | https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/ | https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/ |
| external_references[8]['source_name'] | Microsoft DUBNIUM July 2016 | Microsoft DUBNIUM June 2016 |
| external_references[8]['description'] | Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021. | Microsoft. (2016, June 9). Reverse-engineering DUBNIUM. Retrieved March 31, 2021. |
| external_references[8]['url'] | https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/ | https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/ |
| x_mitre_version | 2.0 | 2.1 |
[G0035] Dragonfly
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 19:21:16.242000+00:00 | 2022-10-19 22:09:02.443000+00:00 |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[G0125] HAFNIUM
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-16 19:14:24.599000+00:00 | 2022-07-06 20:05:26.079000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[G0032] Lazarus Group
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:20:57.634000+00:00 | 2022-08-23 15:30:44.196000+00:00 |
| external_references[7]['url'] | https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf | https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[G0139] TeamTNT
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-14 21:03:35.440000+00:00 | 2022-10-19 21:35:03.147000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Darin Smith, Cisco |
[G0134] Transparent Tribe
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-25 17:19:00.720000+00:00 | 2022-09-22 20:27:21.053000+00:00 |
| external_references[1]['source_name'] | COPPER FIELDSTONE | Mythic Leopard |
| external_references[1]['description'] | (Citation: Secureworks COPPER FIELDSTONE Profile) | (Citation: Crowdstrike Mythic Leopard Profile)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021) |
| external_references[2]['source_name'] | APT36 | COPPER FIELDSTONE |
| external_references[2]['description'] | (Citation: Talos Transparent Tribe May 2021) | (Citation: Secureworks COPPER FIELDSTONE Profile) |
| external_references[3]['source_name'] | Mythic Leopard | APT36 |
| external_references[3]['description'] | (Citation: Crowdstrike Mythic Leopard Profile)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021) | (Citation: Talos Transparent Tribe May 2021) |
| external_references[5]['source_name'] | Proofpoint Operation Transparent Tribe March 2016 | Crowdstrike Mythic Leopard Profile |
| external_references[5]['description'] | Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. | Crowdstrike. (n.d.). Mythic Leopard. Retrieved October 6, 2021. |
| external_references[5]['url'] | https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf | https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/ |
| external_references[7]['source_name'] | Talos Transparent Tribe May 2021 | Unit 42 ProjectM March 2016 |
| external_references[7]['description'] | Malhotra, A. et al. (2021, May 13). Transparent Tribe APT expands its Windows malware arsenal. Retrieved September 2, 2021. | Falcone, R. and Conant S. (2016, March 25). ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe. Retrieved September 2, 2021. |
| external_references[7]['url'] | https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html | https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/ |
| external_references[8]['source_name'] | Secureworks COPPER FIELDSTONE Profile | Proofpoint Operation Transparent Tribe March 2016 |
| external_references[8]['description'] | Secureworks. (n.d.). COPPER FIELDSTONE. Retrieved October 6, 2021. | Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016. |
| external_references[8]['url'] | https://www.secureworks.com/research/threat-profiles/copper-fieldstone | https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf |
| external_references[9]['source_name'] | Crowdstrike Mythic Leopard Profile | Talos Transparent Tribe May 2021 |
| external_references[9]['description'] | Crowdstrike. (n.d.). Mythic Leopard. Retrieved October 6, 2021. | Malhotra, A. et al. (2021, May 13). Transparent Tribe APT expands its Windows malware arsenal. Retrieved September 2, 2021. |
| external_references[9]['url'] | https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/ | https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html |
| external_references[10]['source_name'] | Unit 42 ProjectM March 2016 | Secureworks COPPER FIELDSTONE Profile |
| external_references[10]['description'] | Falcone, R. and Conant S. (2016, March 25). ProjectM: Link Found Between Pakistani Actor and Operation Transparent Tribe. Retrieved September 2, 2021. | Secureworks. (n.d.). COPPER FIELDSTONE. Retrieved October 6, 2021. |
| external_references[10]['url'] | https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/ | https://www.secureworks.com/research/threat-profiles/copper-fieldstone |
| x_mitre_version | 1.0 | 1.1 |
Patches
[G0023] APT16
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-12 19:54:58.537000+00:00 | 2022-07-26 23:33:26.354000+00:00 |
| external_references[2]['description'] | Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. | Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html | https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html |
[G0087] APT39
Current version: 3.1
|
|
|---|
| t | [APT39](https://attack.mitre.org/groups/G0087) is one of sev | t | [APT39](https://attack.mitre.org/groups/G0087) is one of sev |
| eral names for cyberespionage activity conducted by the Iran | | eral names for cyber espionage activity conducted by the Ira |
| ian Ministry of Intelligence and Security (MOIS) through the | | nian Ministry of Intelligence and Security (MOIS) through th |
| front company Rana Intelligence Computing since at least 20 | | e front company Rana Intelligence Computing since at least 2 |
| 14. [APT39](https://attack.mitre.org/groups/G0087) has prima | | 014. [APT39](https://attack.mitre.org/groups/G0087) has prim |
| rily targeted the travel, hospitality, academic, and telecom | | arily targeted the travel, hospitality, academic, and teleco |
| munications industries in Iran and across Asia, Africa, Euro | | mmunications industries in Iran and across Asia, Africa, Eur |
| pe, and North America to track individuals and entities cons | | ope, and North America to track individuals and entities con |
| idered to be a threat by the MOIS.(Citation: FireEye APT39 J | | sidered to be a threat by the MOIS.(Citation: FireEye APT39 |
| an 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI F | | Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI |
| LASH APT39 September 2020)(Citation: Dept. of Treasury Iran | | FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran |
| Sanctions September 2020)(Citation: DOJ Iran Indictments Sep | | Sanctions September 2020)(Citation: DOJ Iran Indictments Se |
| tember 2020) | | ptember 2020) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-12 23:08:30.844000+00:00 | 2022-09-02 18:03:29.024000+00:00 |
| description | [APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyberespionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) | [APT39](https://attack.mitre.org/groups/G0087) is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. [APT39](https://attack.mitre.org/groups/G0087) has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) |
| external_references[1]['source_name'] | APT39 | Remix Kitten |
| external_references[1]['description'] | (Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) | (Citation: Crowdstrike GTR2020 Mar 2020) |
| external_references[2]['source_name'] | REMIX KITTEN | ITG07 |
| external_references[2]['description'] | (Citation: Crowdstrike GTR2020 Mar 2020) | (Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) |
| external_references[3]['source_name'] | ITG07 | APT39 |
| external_references[3]['description'] | (Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) | (Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020) |
| external_references[5]['source_name'] | FireEye APT39 Jan 2019 | Crowdstrike GTR2020 Mar 2020 |
| external_references[5]['description'] | Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. |
| external_references[5]['url'] | https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf |
| external_references[6]['source_name'] | Symantec Chafer Dec 2015 | Dept. of Treasury Iran Sanctions September 2020 |
| external_references[6]['description'] | Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019. | Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020. |
| external_references[6]['url'] | https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets | https://home.treasury.gov/news/press-releases/sm1127 |
| external_references[7]['source_name'] | FBI FLASH APT39 September 2020 | DOJ Iran Indictments September 2020 |
| external_references[7]['description'] | FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. | DOJ. (2020, September 17). Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community. Retrieved December 10, 2020. |
| external_references[7]['url'] | https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf | https://www.justice.gov/opa/pr/department-justice-and-partner-departments-and-agencies-conduct-coordinated-actions-disrupt |
| external_references[8]['source_name'] | Dept. of Treasury Iran Sanctions September 2020 | FBI FLASH APT39 September 2020 |
| external_references[8]['description'] | Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020. | FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. |
| external_references[8]['url'] | https://home.treasury.gov/news/press-releases/sm1127 | https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf |
| external_references[9]['source_name'] | DOJ Iran Indictments September 2020 | FireEye APT39 Jan 2019 |
| external_references[9]['description'] | DOJ. (2020, September 17). Department of Justice and Partner Departments and Agencies Conduct Coordinated Actions to Disrupt and Deter Iranian Malicious Cyber Activities Targeting the United States and the Broader International Community. Retrieved December 10, 2020. | Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. |
| external_references[9]['url'] | https://www.justice.gov/opa/pr/department-justice-and-partner-departments-and-agencies-conduct-coordinated-actions-disrupt | https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html |
| external_references[10]['source_name'] | Crowdstrike GTR2020 Mar 2020 | Dark Reading APT39 JAN 2019 |
| external_references[10]['description'] | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. | Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020. |
| external_references[10]['url'] | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf | https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764 |
| external_references[11]['source_name'] | Dark Reading APT39 JAN 2019 | Symantec Chafer Dec 2015 |
| external_references[11]['description'] | Higgins, K. (2019, January 30). Iran Ups its Traditional Cyber Espionage Tradecraft. Retrieved May 22, 2020. | Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019. |
| external_references[11]['url'] | https://www.darkreading.com/attacks-breaches/iran-ups-its-traditional-cyber-espionage-tradecraft/d/d-id/1333764 | https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | Remix Kitten |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| aliases | REMIX KITTEN | |
[G0096] APT41
Current version: 3.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 00:28:08.413000+00:00 | 2022-06-02 20:09:29.475000+00:00 |
| aliases[1] | WICKED PANDA | Wicked Panda |
| external_references[1]['source_name'] | APT41 | Wicked Panda |
| external_references[1]['description'] | (Citation: FireEye APT41 2019) | (Citation: Crowdstrike GTR2020 Mar 2020) |
| external_references[2]['source_name'] | WICKED PANDA | APT41 |
| external_references[2]['description'] | (Citation: Crowdstrike GTR2020 Mar 2020) | (Citation: FireEye APT41 2019) |
| external_references[3]['source_name'] | FireEye APT41 Aug 2019 | Crowdstrike GTR2020 Mar 2020 |
| external_references[3]['description'] | Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. |
| external_references[3]['url'] | https://content.fireeye.com/apt-41/rpt-apt41 | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf |
| external_references[4]['source_name'] | Group IB APT 41 June 2021 | FireEye APT41 2019 |
| external_references[4]['description'] | Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021. | FireEye. (2019). Double DragonAPT41, a dual espionage andcyber crime operationAPT41. Retrieved September 23, 2019. |
| external_references[4]['url'] | https://blog.group-ib.com/colunmtk_apt41 | https://content.fireeye.com/apt-41/rpt-apt41 |
| external_references[5]['source_name'] | Crowdstrike GTR2020 Mar 2020 | FireEye APT41 Aug 2019 |
| external_references[5]['description'] | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. | Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. |
| external_references[5]['url'] | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf | https://content.fireeye.com/apt-41/rpt-apt41 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Group IB APT 41 June 2021', 'description': 'Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.', 'url': 'https://blog.group-ib.com/colunmtk_apt41'} |
[G0143] Aquatic Panda
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| aliases | ['AQUATIC PANDA'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-21 16:10:22.156000+00:00 | 2022-06-29 20:28:29.913000+00:00 |
[G0003] Cleaver
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-12 19:34:36.092000+00:00 | 2022-07-22 18:37:22.178000+00:00 |
| external_references[4]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
[G0142] Confucius
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-07 22:30:12.220000+00:00 | 2022-06-30 20:15:32.697000+00:00 |
| external_references[3]['url'] | https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat | https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | Confucius |
[G0009] Deep Panda
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-02-09 13:49:09.605000+00:00 | 2022-07-20 20:10:29.593000+00:00 |
| external_references[7]['url'] | https://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/ | https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/ |
| external_references[8]['source_name'] | ThreatConnect Anthem | Symantec Black Vine |
| external_references[8]['description'] | ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016. | DiMaggio, J.. (2015, August 6). The Black Vine cyberespionage group. Retrieved January 26, 2016. |
| external_references[8]['url'] | https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/ | https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf |
| external_references[10]['source_name'] | Symantec Black Vine | ICIT China's Espionage Jul 2016 |
| external_references[10]['description'] | DiMaggio, J.. (2015, August 6). The Black Vine cyberespionage group. Retrieved January 26, 2016. | Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018. |
| external_references[10]['url'] | http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf | https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/ |
| external_references[11]['source_name'] | ICIT China's Espionage Jul 2016 | ThreatConnect Anthem |
| external_references[11]['description'] | Scott, J. and Spaniel, D. (2016, July 28). ICIT Brief - China’s Espionage Dynasty: Economic Death by a Thousand Cuts. Retrieved June 7, 2018. | ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016. |
| external_references[11]['url'] | https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/ | https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/ |
[G0037] FIN6
Current version: 3.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-14 17:23:58.316000+00:00 | 2022-06-02 20:11:01.957000+00:00 |
| aliases[2] | SKELETON SPIDER | ITG08 |
| aliases[3] | ITG08 | Skeleton Spider |
| external_references[1]['source_name'] | FIN6 | Skeleton Spider |
| external_references[1]['description'] | (Citation: FireEye FIN6 April 2016) | (Citation: Crowdstrike Global Threat Report Feb 2018) |
| external_references[2]['source_name'] | Magecart Group 6 | FIN6 |
| external_references[2]['description'] | (Citation: Security Intelligence ITG08 April 2020) | (Citation: FireEye FIN6 April 2016) |
| external_references[3]['source_name'] | SKELETON SPIDER | Magecart Group 6 |
| external_references[3]['description'] | (Citation: Crowdstrike Global Threat Report Feb 2018) | (Citation: Security Intelligence ITG08 April 2020) |
| external_references[5]['source_name'] | FireEye FIN6 April 2016 | Crowdstrike Global Threat Report Feb 2018 |
| external_references[5]['description'] | FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. | CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. |
| external_references[5]['url'] | https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf | https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report |
| external_references[6]['source_name'] | FireEye FIN6 Apr 2019 | FireEye FIN6 April 2016 |
| external_references[6]['description'] | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. | FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. |
| external_references[6]['url'] | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html | https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf |
| external_references[7]['source_name'] | Security Intelligence ITG08 April 2020 | FireEye FIN6 Apr 2019 |
| external_references[7]['description'] | Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020. | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. |
| external_references[7]['url'] | https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html |
| external_references[8]['source_name'] | Crowdstrike Global Threat Report Feb 2018 | Security Intelligence ITG08 April 2020 |
| external_references[8]['description'] | CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. | Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020. |
| external_references[8]['url'] | https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report | https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[G0046] FIN7
Current version: 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | http://blog.morphisec.com/fin7-attacks-restaurant-industry | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-02 21:32:06.214000+00:00 | 2022-07-20 20:06:44.706000+00:00 |
| external_references[1]['source_name'] | FIN7 | Carbon Spider |
| external_references[1]['description'] | (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018) | (Citation: CrowdStrike Carbon Spider August 2021) |
| external_references[2]['source_name'] | GOLD NIAGARA | FIN7 |
| external_references[2]['description'] | (Citation: Secureworks GOLD NIAGARA Threat Profile) | (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018) |
| external_references[3]['source_name'] | ITG14 | GOLD NIAGARA |
| external_references[3]['description'] | ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020) | (Citation: Secureworks GOLD NIAGARA Threat Profile) |
| external_references[4]['source_name'] | Carbon Spider | FireEye CARBANAK June 2017 |
| external_references[4]['description'] | (Citation: CrowdStrike Carbon Spider August 2021) | Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. |
| external_references[5]['source_name'] | FireEye FIN7 March 2017 | FireEye FIN7 April 2017 |
| external_references[5]['description'] | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. | Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. |
| external_references[5]['url'] | https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html | https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html |
| external_references[6]['source_name'] | FireEye FIN7 April 2017 | FireEye FIN7 Aug 2018 |
| external_references[6]['description'] | Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. | Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. |
| external_references[6]['url'] | https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html | https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html |
| external_references[7]['source_name'] | FireEye CARBANAK June 2017 | Secureworks GOLD NIAGARA Threat Profile |
| external_references[7]['description'] | Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. | CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021. |
| external_references[7]['url'] | https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html | https://www.secureworks.com/research/threat-profiles/gold-niagara |
| external_references[8]['source_name'] | FireEye FIN7 Aug 2018 | FireEye FIN7 Shim Databases |
| external_references[8]['description'] | Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. | Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017. |
| external_references[8]['url'] | https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html | https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html |
| external_references[9]['source_name'] | CrowdStrike Carbon Spider August 2021 | Morphisec FIN7 June 2017 |
| external_references[9]['description'] | Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. | Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017. |
| external_references[9]['url'] | https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ | http://blog.morphisec.com/fin7-attacks-restaurant-industry |
| external_references[10]['source_name'] | Morphisec FIN7 June 2017 | ITG14 |
| external_references[10]['description'] | Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017. | ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020) |
| external_references[11]['source_name'] | FireEye FIN7 Shim Databases | CrowdStrike Carbon Spider August 2021 |
| external_references[11]['description'] | Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017. | Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. |
| external_references[11]['url'] | https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html | https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ |
| external_references[12]['source_name'] | Secureworks GOLD NIAGARA Threat Profile | FireEye FIN7 March 2017 |
| external_references[12]['description'] | CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021. | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. |
| external_references[12]['url'] | https://www.secureworks.com/research/threat-profiles/gold-niagara | https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[G0117] Fox Kitten
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 22:02:30.995000+00:00 | 2022-06-02 20:12:00.458000+00:00 |
| aliases[2] | PIONEER KITTEN | Parisite |
| aliases[3] | Parisite | Pioneer Kitten |
| external_references[2]['source_name'] | PIONEER KITTEN | Pioneer Kitten |
| external_references[4]['source_name'] | ClearkSky Fox Kitten February 2020 | CISA AA20-259A Iran-Based Actor September 2020 |
| external_references[4]['description'] | ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020. | CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. |
| external_references[4]['url'] | https://www.clearskysec.com/fox-kitten/ | https://us-cert.cisa.gov/ncas/alerts/aa20-259a |
| external_references[5]['source_name'] | CrowdStrike PIONEER KITTEN August 2020 | ClearSky Pay2Kitten December 2020 |
| external_references[5]['description'] | Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020. | ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020. |
| external_references[5]['url'] | https://www.crowdstrike.com/blog/who-is-pioneer-kitten/ | https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf |
| external_references[6]['source_name'] | Dragos PARISITE | ClearkSky Fox Kitten February 2020 |
| external_references[6]['description'] | Dragos. (n.d.). PARISITE. Retrieved December 21, 2020. | ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020. |
| external_references[6]['url'] | https://www.dragos.com/threat/parisite/ | https://www.clearskysec.com/fox-kitten/ |
| external_references[7]['source_name'] | ClearSky Pay2Kitten December 2020 | Dragos PARISITE |
| external_references[7]['description'] | ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020. | Dragos. (n.d.). PARISITE. Retrieved December 21, 2020. |
| external_references[7]['url'] | https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf | https://www.dragos.com/threat/parisite/ |
| external_references[8]['source_name'] | CISA AA20-259A Iran-Based Actor September 2020 | CrowdStrike PIONEER KITTEN August 2020 |
| external_references[8]['description'] | CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. | Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020. |
| external_references[8]['url'] | https://us-cert.cisa.gov/ncas/alerts/aa20-259a | https://www.crowdstrike.com/blog/who-is-pioneer-kitten/ |
[G0119] Indrik Spider
Current version: 2.1
|
|
|---|
| t | [Indrik Spider](https://attack.mitre.org/groups/G0119) is a | t | [Indrik Spider](https://attack.mitre.org/groups/G0119) is a |
| Russia-based cybercriminal group that as been active since a | | Russia-based cybercriminal group that has been active since |
| t least 2014. [Indrik Spider](https://attack.mitre.org/group | | at least 2014. [Indrik Spider](https://attack.mitre.org/grou |
| s/G0119) initially started with the [Dridex](https://attack. | | ps/G0119) initially started with the [Dridex](https://attack |
| mitre.org/software/S0384) banking Trojan, and then by 2017 t | | .mitre.org/software/S0384) banking Trojan, and then by 2017 |
| hey began running ransomware operations using [BitPaymer](ht | | they began running ransomware operations using [BitPaymer](h |
| tps://attack.mitre.org/software/S0570), [WastedLocker](https | | ttps://attack.mitre.org/software/S0570), [WastedLocker](http |
| ://attack.mitre.org/software/S0612), and Hades ransomware.(C | | s://attack.mitre.org/software/S0612), and Hades ransomware.( |
| itation: Crowdstrike Indrik November 2018)(Citation: Crowdst | | Citation: Crowdstrike Indrik November 2018)(Citation: Crowds |
| rike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 20 | | trike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2 |
| 19) | | 019) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 14:22:00.122000+00:00 | 2022-09-15 19:49:18.799000+00:00 |
| description | [Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that as been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019) | [Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019) |
[G0004] Ke3chang
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-13 12:17:09.479000+00:00 | 2022-07-22 18:52:32.762000+00:00 |
| external_references[10]['url'] | https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ | https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ |
[G0133] Nomadic Octopus
Current version: 1.0
|
|
|---|
| t | [Nomadic Octopus](https://attack.mitre.org/groups/G0133) is | t | [Nomadic Octopus](https://attack.mitre.org/groups/G0133) is |
| a Russian-speaking cyberespionage threat group that has pri | | a Russian-speaking cyber espionage threat group that has pr |
| marily targeted Central Asia, including local governments, d | | imarily targeted Central Asia, including local governments, |
| iplomatic missions, and individuals, since at least 2014. [N | | diplomatic missions, and individuals, since at least 2014. [ |
| omadic Octopus](https://attack.mitre.org/groups/G0133) has b | | Nomadic Octopus](https://attack.mitre.org/groups/G0133) has |
| een observed conducting campaigns involving Android and Wind | | been observed conducting campaigns involving Android and Win |
| ows malware, mainly using the Delphi programming language, a | | dows malware, mainly using the Delphi programming language, |
| nd building custom variants.(Citation: Security Affairs Dust | | and building custom variants.(Citation: Security Affairs Dus |
| Squad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citat | | tSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Cita |
| ion: ESET Nomadic Octopus 2018) | | tion: ESET Nomadic Octopus 2018) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-14 15:22:52.708000+00:00 | 2022-09-02 18:03:55.294000+00:00 |
| description |
[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyberespionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018) |
[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018) |
| external_references[1]['source_name'] | Nomadic Octopus | DustSquad |
| external_references[1]['description'] | (Citation: SecurityWeek Nomadic Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018) | (Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: SecurityWeek Nomadic Octopus Oct 2018) |
| external_references[2]['source_name'] | DustSquad | Nomadic Octopus |
| external_references[2]['description'] | (Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: SecurityWeek Nomadic Octopus Oct 2018) | (Citation: SecurityWeek Nomadic Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018) |
| external_references[3]['source_name'] | Security Affairs DustSquad Oct 2018 | ESET Nomadic Octopus 2018 |
| external_references[3]['description'] | Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021. | Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021. |
| external_references[3]['url'] | https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html | https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf |
| external_references[5]['source_name'] | ESET Nomadic Octopus 2018 | SecurityWeek Nomadic Octopus Oct 2018 |
| external_references[5]['description'] | Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021. | Kovacs, E. (2018, October 18). Russia-Linked Hackers Target Diplomatic Entities in Central Asia. Retrieved October 13, 2021. |
| external_references[5]['url'] | https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf | https://www.securityweek.com/russia-linked-hackers-target-diplomatic-entities-central-asia |
| external_references[6]['source_name'] | SecurityWeek Nomadic Octopus Oct 2018 | Security Affairs DustSquad Oct 2018 |
| external_references[6]['description'] | Kovacs, E. (2018, October 18). Russia-Linked Hackers Target Diplomatic Entities in Central Asia. Retrieved October 13, 2021. | Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021. |
| external_references[6]['url'] | https://www.securityweek.com/russia-linked-hackers-target-diplomatic-entities-central-asia | https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html |
[G0049] OilRig
Current version: 3.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:20:37.658000+00:00 | 2022-06-02 20:18:52.733000+00:00 |
| aliases[3] | HELIX KITTEN | APT34 |
| aliases[4] | APT34 | Helix Kitten |
| external_references[4]['source_name'] | HELIX KITTEN | Helix Kitten |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
[G0040] Patchwork
Current version: 1.4
|
|
|---|
| t | [Patchwork](https://attack.mitre.org/groups/G0040) is a cybe | t | [Patchwork](https://attack.mitre.org/groups/G0040) is a cybe |
| respionage group that was first observed in December 2015. W | | r espionage group that was first observed in December 2015. |
| hile the group has not been definitively attributed, circums | | While the group has not been definitively attributed, circum |
| tantial evidence suggests the group may be a pro-Indian or I | | stantial evidence suggests the group may be a pro-Indian or |
| ndian entity. [Patchwork](https://attack.mitre.org/groups/G0 | | Indian entity. [Patchwork](https://attack.mitre.org/groups/G |
| 040) has been seen targeting industries related to diplomati | | 0040) has been seen targeting industries related to diplomat |
| c and government agencies. Much of the code used by this gro | | ic and government agencies. Much of the code used by this gr |
| up was copied and pasted from online forums. [Patchwork](htt | | oup was copied and pasted from online forums. [Patchwork](ht |
| ps://attack.mitre.org/groups/G0040) was also seen operating | | tps://attack.mitre.org/groups/G0040) was also seen operating |
| spearphishing campaigns targeting U.S. think tank groups in | | spearphishing campaigns targeting U.S. think tank groups in |
| March and April of 2018. (Citation: Cymmetria Patchwork) (Ci | | March and April of 2018.(Citation: Cymmetria Patchwork) (Ci |
| tation: Symantec Patchwork) (Citation: TrendMicro Patchwork | | tation: Symantec Patchwork)(Citation: TrendMicro Patchwork D |
| Dec 2017) (Citation: Volexity Patchwork June 2018) | | ec 2017)(Citation: Volexity Patchwork June 2018) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | https://web.archive.org/web/20180825085952/https://s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf |
| external_references | | http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf | |
| external_references | https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-11-02 21:07:07.755000+00:00 | 2022-09-02 18:04:32.246000+00:00 |
| description | [Patchwork](https://attack.mitre.org/groups/G0040) is a cyberespionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018. (Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork) (Citation: TrendMicro Patchwork Dec 2017) (Citation: Volexity Patchwork June 2018) | [Patchwork](https://attack.mitre.org/groups/G0040) is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. [Patchwork](https://attack.mitre.org/groups/G0040) has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. [Patchwork](https://attack.mitre.org/groups/G0040) was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018) |
| external_references[2]['source_name'] | Hangover Group | Chinastrats |
| external_references[2]['description'] | [Patchwork](https://attack.mitre.org/groups/G0040) and the Hangover Group have both been referenced as aliases for the threat group associated with Operation Monsoon.(Citation: PaloAlto Patchwork Mar 2018)(Citation: Unit 42 BackConfig May 2020)(Citation: Forcepoint Monsoon) | (Citation: Securelist Dropping Elephant) |
| external_references[4]['source_name'] | Chinastrats | Hangover Group |
| external_references[4]['description'] | (Citation: Securelist Dropping Elephant) | [Patchwork](https://attack.mitre.org/groups/G0040) and the Hangover Group have both been referenced as aliases for the threat group associated with Operation Monsoon.(Citation: PaloAlto Patchwork Mar 2018)(Citation: Unit 42 BackConfig May 2020)(Citation: Forcepoint Monsoon) |
| external_references[5]['source_name'] | MONSOON | Cymmetria Patchwork |
| external_references[5]['description'] | MONSOON is the name of an espionage campaign; we use it here to refer to the actor group behind the campaign. (Citation: Forcepoint Monsoon) (Citation: PaloAlto Patchwork Mar 2018) | Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016. |
| external_references[6]['source_name'] | Operation Hangover | Operation Hangover May 2013 |
| external_references[6]['description'] | It is believed that the actors behind [Patchwork](https://attack.mitre.org/groups/G0040) are the same actors behind Operation Hangover. (Citation: Forcepoint Monsoon) (Citation: Operation Hangover May 2013) | Fagerland, S., et al. (2013, May). Operation Hangover: Unveiling an Indian Cyberattack Infrastructure. Retrieved September 26, 2016. |
| external_references[7]['source_name'] | Cymmetria Patchwork | Symantec Patchwork |
| external_references[7]['description'] | Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved August 3, 2016. | Hamada, J.. (2016, July 25). Patchwork cyberespionage group expands targets from governments to wide range of industries. Retrieved August 17, 2016. |
| external_references[7]['url'] | https://web.archive.org/web/20180825085952/https://s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf | http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries |
| external_references[8]['source_name'] | Symantec Patchwork | Unit 42 BackConfig May 2020 |
| external_references[8]['description'] | Hamada, J.. (2016, July 25). Patchwork cyberespionage group expands targets from governments to wide range of industries. Retrieved August 17, 2016. | Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020. |
| external_references[8]['url'] | http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries | https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/ |
| external_references[9]['source_name'] | TrendMicro Patchwork Dec 2017 | Operation Hangover |
| external_references[9]['description'] | Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. | It is believed that the actors behind [Patchwork](https://attack.mitre.org/groups/G0040) are the same actors behind Operation Hangover. (Citation: Forcepoint Monsoon) (Citation: Operation Hangover May 2013) |
| external_references[10]['source_name'] | Volexity Patchwork June 2018 | Securelist Dropping Elephant |
| external_references[10]['description'] | Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. | Kaspersky Lab's Global Research & Analysis Team. (2016, July 8). The Dropping Elephant – aggressive cyber-espionage in the Asian region. Retrieved August 3, 2016. |
| external_references[10]['url'] | https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/ | https://securelist.com/the-dropping-elephant-actor/75328/ |
| external_references[11]['source_name'] | Securelist Dropping Elephant | PaloAlto Patchwork Mar 2018 |
| external_references[11]['description'] | Kaspersky Lab's Global Research & Analysis Team. (2016, July 8). The Dropping Elephant – aggressive cyber-espionage in the Asian region. Retrieved August 3, 2016. | Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018. |
| external_references[11]['url'] | https://securelist.com/the-dropping-elephant-actor/75328/ | https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/ |
| external_references[12]['source_name'] | PaloAlto Patchwork Mar 2018 | TrendMicro Patchwork Dec 2017 |
| external_references[12]['description'] | Levene, B. et al.. (2018, March 7). Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent. Retrieved March 31, 2018. | Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. |
| external_references[12]['url'] | https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/ | https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf |
| external_references[13]['source_name'] | Unit 42 BackConfig May 2020 | Volexity Patchwork June 2018 |
| external_references[13]['description'] | Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020. | Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. |
| external_references[13]['url'] | https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/ | https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/ |
| external_references[14]['source_name'] | Forcepoint Monsoon | MONSOON |
| external_references[14]['description'] | Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. | MONSOON is the name of an espionage campaign; we use it here to refer to the actor group behind the campaign. (Citation: Forcepoint Monsoon) (Citation: PaloAlto Patchwork Mar 2018) |
| external_references[15]['source_name'] | Operation Hangover May 2013 | Forcepoint Monsoon |
| external_references[15]['description'] | Fagerland, S., et al. (2013, May). Operation Hangover: Unveiling an Indian Cyberattack Infrastructure. Retrieved September 26, 2016. | Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016. |
| external_references[15]['url'] | http://enterprise-manage.norman.c.bitbit.net/resources/files/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf | https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf |
[G0034] Sandworm Team
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:21:17.572000+00:00 | 2022-10-12 20:11:40.313000+00:00 |
| aliases[6] | VOODOO BEAR | Voodoo Bear |
| external_references[1]['source_name'] | VOODOO BEAR | Voodoo Bear |
| x_mitre_contributors[0] | Dragos Threat Intelligence | Dragos Threat Intelligence |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | ics-attack |
| x_mitre_domains | | mobile-attack |
[G0091] Silence
Current version: 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-05-26 19:54:55.580000+00:00 | 2022-06-02 20:13:56.605000+00:00 |
| aliases[1] | WHISPER SPIDER | Whisper Spider |
| external_references[1]['source_name'] | Silence | Whisper Spider |
| external_references[1]['description'] | (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) | (Citation: Crowdstrike GTR2020 Mar 2020) |
| external_references[2]['source_name'] | WHISPER SPIDER | Silence |
| external_references[2]['description'] | (Citation: Crowdstrike GTR2020 Mar 2020) | (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017) |
| external_references[3]['source_name'] | Cyber Forensicator Silence Jan 2019 | Crowdstrike GTR2020 Mar 2020 |
| external_references[3]['description'] | Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019. | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. |
| external_references[3]['url'] | https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf |
| external_references[5]['source_name'] | Crowdstrike GTR2020 Mar 2020 | Cyber Forensicator Silence Jan 2019 |
| external_references[5]['description'] | Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020. | Skulkin, O.. (2019, January 20). Silence: Dissecting Malicious CHM Files and Performing Forensic Analysis. Retrieved May 24, 2019. |
| external_references[5]['url'] | https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf | https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/ |
[G0010] Turla
Current version: 3.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-09 23:34:47.461000+00:00 | 2022-09-28 21:27:07.133000+00:00 |
| external_references[1]['source_name'] | Turla | Belugasturgeon |
| external_references[1]['description'] | (Citation: Kaspersky Turla) | (Citation: Accenture HyperStack October 2020) |
| external_references[2]['source_name'] | IRON HUNTER | Krypton |
| external_references[2]['description'] | (Citation: Secureworks IRON HUNTER Profile) | (Citation: CrowdStrike VENOMOUS BEAR) |
| external_references[3]['source_name'] | Group 88 | Snake |
| external_references[3]['description'] | (Citation: Leonardo Turla Penquin May 2020) | (Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla PowerShell May 2019)(Citation: Talos TinyTurla September 2021) |
| external_references[4]['source_name'] | Belugasturgeon | Venomous Bear |
| external_references[4]['description'] | (Citation: Accenture HyperStack October 2020) | (Citation: CrowdStrike VENOMOUS BEAR)(Citation: Talos TinyTurla September 2021) |
| external_references[5]['source_name'] | Waterbug | Turla |
| external_references[5]['description'] | Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.(Citation: Symantec Waterbug) | (Citation: Kaspersky Turla) |
| external_references[6]['source_name'] | WhiteBear | Group 88 |
| external_references[6]['description'] | WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.(Citation: Securelist WhiteBear Aug 2017)(Citation: Talos TinyTurla September 2021) | (Citation: Leonardo Turla Penquin May 2020) |
| external_references[7]['source_name'] | VENOMOUS BEAR | IRON HUNTER |
| external_references[7]['description'] | (Citation: CrowdStrike VENOMOUS BEAR)(Citation: Talos TinyTurla September 2021) | (Citation: Secureworks IRON HUNTER Profile) |
| external_references[8]['source_name'] | Snake | Accenture HyperStack October 2020 |
| external_references[8]['description'] | (Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla PowerShell May 2019)(Citation: Talos TinyTurla September 2021) | Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. |
| external_references[9]['source_name'] | Krypton | Waterbug |
| external_references[9]['description'] | (Citation: CrowdStrike VENOMOUS BEAR) | Based similarity in TTPs and malware used, Turla and Waterbug appear to be the same group.(Citation: Symantec Waterbug) |
| external_references[10]['source_name'] | Kaspersky Turla | Talos TinyTurla September 2021 |
| external_references[10]['description'] | Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. | Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. |
| external_references[10]['url'] | https://securelist.com/the-epic-turla-operation/65545/ | https://blog.talosintelligence.com/2021/09/tinyturla.html |
| external_references[11]['source_name'] | ESET Gazer Aug 2017 | ESET Turla Mosquito Jan 2018 |
| external_references[11]['description'] | ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017. | ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. |
| external_references[11]['url'] | https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf | https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf |
| external_references[12]['source_name'] | CrowdStrike VENOMOUS BEAR | ESET Gazer Aug 2017 |
| external_references[12]['description'] | Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018. | ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017. |
| external_references[12]['url'] | https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/ | https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf |
| external_references[13]['source_name'] | ESET Turla Mosquito Jan 2018 | ESET Turla PowerShell May 2019 |
| external_references[13]['description'] | ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018. | Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. |
| external_references[13]['url'] | https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf | https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ |
| external_references[14]['source_name'] | Secureworks IRON HUNTER Profile | Securelist WhiteBear Aug 2017 |
| external_references[14]['description'] | Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022. | Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017. |
| external_references[14]['url'] | http://www.secureworks.com/research/threat-profiles/iron-hunter | https://securelist.com/introducing-whitebear/81638/ |
| external_references[15]['source_name'] | Leonardo Turla Penquin May 2020 | Kaspersky Turla |
| external_references[15]['description'] | Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021. | Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014. |
| external_references[15]['url'] | https://www.leonardocompany.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf | https://securelist.com/the-epic-turla-operation/65545/ |
| external_references[16]['source_name'] | Accenture HyperStack October 2020 | Leonardo Turla Penquin May 2020 |
| external_references[16]['description'] | Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. | Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021. |
| external_references[16]['url'] | https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity | https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf |
| external_references[17]['source_name'] | Symantec Waterbug | CrowdStrike VENOMOUS BEAR |
| external_references[17]['description'] | Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015. | Meyers, A. (2018, March 12). Meet CrowdStrike’s Adversary of the Month for March: VENOMOUS BEAR. Retrieved May 16, 2018. |
| external_references[17]['url'] | https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1 | https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/ |
| external_references[18]['source_name'] | Securelist WhiteBear Aug 2017 | Secureworks IRON HUNTER Profile |
| external_references[18]['description'] | Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017. | Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022. |
| external_references[18]['url'] | https://securelist.com/introducing-whitebear/81638/ | http://www.secureworks.com/research/threat-profiles/iron-hunter |
| external_references[19]['source_name'] | Talos TinyTurla September 2021 | Symantec Waterbug |
| external_references[19]['description'] | Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. | Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015. |
| external_references[19]['url'] | https://blog.talosintelligence.com/2021/09/tinyturla.html | https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1 |
| external_references[20]['source_name'] | ESET Turla PowerShell May 2019 | WhiteBear |
| external_references[20]['description'] | Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. | WhiteBear is a designation used by Securelist to describe a cluster of activity that has overlaps with activity described by others as Turla, but appears to have a separate focus.(Citation: Securelist WhiteBear Aug 2017)(Citation: Talos TinyTurla September 2021) |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | Venomous Bear |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| aliases | VENOMOUS BEAR | |
[G0045] menuPass
Current version: 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-11 14:01:44.538000+00:00 | 2022-07-20 20:07:40.169000+00:00 |
| external_references[1]['source_name'] | menuPass | HOGFISH |
| external_references[1]['description'] | (Citation: Palo Alto menuPass Feb 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) | (Citation: Accenture Hogfish April 2018) |
| external_references[2]['source_name'] | Cicada | POTASSIUM |
| external_references[2]['description'] | (Citation: Symantec Cicada November 2020) | (Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) |
| external_references[3]['source_name'] | POTASSIUM | Stone Panda |
| external_references[3]['description'] | (Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) | (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Symantec Cicada November 2020) |
| external_references[4]['source_name'] | Stone Panda | APT10 |
| external_references[4]['description'] | (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Symantec Cicada November 2020) | (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020) |
| external_references[5]['source_name'] | APT10 | menuPass |
| external_references[5]['description'] | (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020) | (Citation: Palo Alto menuPass Feb 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) |
| external_references[8]['source_name'] | HOGFISH | Cicada |
| external_references[8]['description'] | (Citation: Accenture Hogfish April 2018) | (Citation: Symantec Cicada November 2020) |
| external_references[9]['source_name'] | DOJ APT10 Dec 2018 | Accenture Hogfish April 2018 |
| external_references[9]['description'] | United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019. | Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018. |
| external_references[9]['url'] | https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion | https://www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf |
| external_references[10]['source_name'] | District Court of NY APT10 Indictment December 2018 | Crowdstrike CrowdCast Oct 2013 |
| external_references[10]['description'] | US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020. | Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem. Retrieved March 1, 2017. |
| external_references[10]['url'] | https://www.justice.gov/opa/page/file/1122671/download | https://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem |
| external_references[11]['source_name'] | Palo Alto menuPass Feb 2017 | FireEye APT10 April 2017 |
| external_references[11]['description'] | Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017. | FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017. |
| external_references[11]['url'] | http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/ | https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html |
| external_references[12]['source_name'] | Crowdstrike CrowdCast Oct 2013 | FireEye Poison Ivy |
| external_references[12]['description'] | Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem. Retrieved March 1, 2017. | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014. |
| external_references[12]['url'] | https://www.slideshare.net/CrowdStrike/crowd-casts-monthly-you-have-an-adversary-problem | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf |
| external_references[13]['source_name'] | FireEye Poison Ivy | FireEye APT10 Sept 2018 |
| external_references[13]['description'] | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014. | Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018. |
| external_references[13]['url'] | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf | https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html |
| external_references[14]['source_name'] | PWC Cloud Hopper April 2017 | Palo Alto menuPass Feb 2017 |
| external_references[14]['description'] | PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. | Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017. |
| external_references[14]['url'] | https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf | http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/ |
| external_references[15]['source_name'] | FireEye APT10 April 2017 | PWC Cloud Hopper April 2017 |
| external_references[15]['description'] | FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017. | PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. |
| external_references[15]['url'] | https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html | https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf |
| external_references[17]['source_name'] | Accenture Hogfish April 2018 | DOJ APT10 Dec 2018 |
| external_references[17]['description'] | Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018. | United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019. |
| external_references[17]['url'] | https://www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf | https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion |
| external_references[18]['source_name'] | FireEye APT10 Sept 2018 | District Court of NY APT10 Indictment December 2018 |
| external_references[18]['description'] | Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018. | US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020. |
| external_references[18]['url'] | https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html | https://www.justice.gov/opa/page/file/1122671/download |
Deprecations
[G0132] CostaRicto
Current version: 1.0
Description: [CostaRicto](https://attack.mitre.org/groups/G0132) is a suspected hacker-for-hire cyber espionage campaign that has targeted multiple industries worldwide since at least 2019. [CostaRicto](https://attack.mitre.org/groups/G0132)'s targets, a large portion of which are financial institutions, are scattered across Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia.(Citation: BlackBerry CostaRicto November 2020)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 20:41:50.305000+00:00 | 2022-10-12 19:18:38.430000+00:00 |
[G0031] Dust Storm
Current version: 1.0
Description: [Dust Storm](https://attack.mitre.org/groups/G0031) is a threat group that has targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. (Citation: Cylance Dust Storm)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-01-19 18:25:05.148000+00:00 | 2022-09-29 21:28:39.974000+00:00 |
[G0101] Frankenstein
Current version: 1.1
Description: [Frankenstein](https://attack.mitre.org/groups/G0101) is a campaign carried out between January and April 2019 by unknown threat actors. The campaign name comes from the actors' ability to piece together several unrelated components.(Citation: Talos Frankenstein June 2019)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-05-26 19:57:42.132000+00:00 | 2022-09-19 21:44:20.477000+00:00 |
[G0072] Honeybee
Current version: 1.1
Description: [Honeybee](https://attack.mitre.org/groups/G0072) is a campaign led by an unknown actor that targets humanitarian aid organizations and has been active in Vietnam, Singapore, Argentina, Japan, Indonesia, and Canada. It has been an active operation since August of 2017 and as recently as February 2018. (Citation: McAfee Honeybee)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-23 19:48:35.981000+00:00 | 2022-09-19 20:08:40.243000+00:00 |
[G0014] Night Dragon
Current version: 1.4
Description: [Night Dragon](https://attack.mitre.org/groups/G0014) is a campaign name for activity involving a threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-12 22:12:11.717000+00:00 | 2022-09-22 20:54:08.611000+00:00 |
[G0116] Operation Wocao
Current version: 1.0
Description: [Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espionage adversary. [Operation Wocao](https://attack.mitre.org/groups/G0116) targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. [Operation Wocao](https://attack.mitre.org/groups/G0116) used similar TTPs and tools to APT20, suggesting a possible overlap.(Citation: FoxIT Wocao December 2019)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 13:18:53.793000+00:00 | 2022-10-12 19:17:31.924000+00:00 |
[G0104] Sharpshooter
Current version: 1.0
Description: Operation [Sharpshooter](https://attack.mitre.org/groups/G0104) is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [Lazarus Group](https://attack.mitre.org/groups/G0032) have been noted, definitive links have not been established.(Citation: McAfee Sharpshooter December 2018)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-30 03:08:44.808000+00:00 | 2022-09-26 22:11:36.315000+00:00 |
mobile-attack
New Groups
[G1006] Earth Lusca
Current version: 1.0
Description: [Earth Lusca](https://attack.mitre.org/groups/G1006) is a suspected China-based cyber espionage group that has been active since at least April 2019. [Earth Lusca](https://attack.mitre.org/groups/G1006) has targeted organizations in Australia, China, Hong Kong, Mongolia, Nepal, the Philippines, Taiwan, Thailand, Vietnam, the United Arab Emirates, Nigeria, Germany, France, and the United States. Targets included government institutions, news media outlets, gambling companies, educational institutions, COVID-19 research organizations, telecommunications companies, religious movements banned in China, and cryptocurrency trading platforms; security researchers assess some [Earth Lusca](https://attack.mitre.org/groups/G1006) operations may be financially motivated.(Citation: TrendMicro EarthLusca 2022)
[Earth Lusca](https://attack.mitre.org/groups/G1006) has used malware commonly used by other Chinese threat groups, including [APT41](https://attack.mitre.org/groups/G0096) and the [Winnti Group](https://attack.mitre.org/groups/G0044) cluster, however security researchers assess [Earth Lusca](https://attack.mitre.org/groups/G1006)'s techniques and infrastructure are separate.(Citation: TrendMicro EarthLusca 2022)
Patches
[G0034] Sandworm Team
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:21:17.572000+00:00 | 2022-10-12 20:11:40.313000+00:00 |
| aliases[6] | VOODOO BEAR | Voodoo Bear |
| external_references[1]['source_name'] | VOODOO BEAR | Voodoo Bear |
| x_mitre_contributors[0] | Dragos Threat Intelligence | Dragos Threat Intelligence |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
| x_mitre_domains | | ics-attack |
ics-attack
Major Version Changes
[G1001] HEXANE
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | [HEXANE](https://attack.mitre.org/groups/G1001) is a threat | t | [HEXANE](https://attack.mitre.org/groups/G1001) is a cyber e |
| group that has targeted ICS organization within the oil & ga | | spionage threat group that has targeted oil & gas, telecommu |
| s, and telecommunications sectors. Many of the targeted orga | | nications, aviation, and internet service provider organizat |
| nizations have been located in the Middle East including Kuw | | ions since at least 2017. Targeted companies have been locat |
| ait. [HEXANE](https://attack.mitre.org/groups/G1001)'s targe | | ed in the Middle East and Africa, including Israel, Saudi Ar |
| ting of telecommunications has been speculated to be part of | | abia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack. |
| an effort to establish man-in-the-middle capabilities throu | | mitre.org/groups/G1001)'s TTPs appear similar to [APT33](htt |
| ghout the region. [HEXANE](https://attack.mitre.org/groups/G | | ps://attack.mitre.org/groups/G0064) and [OilRig](https://att |
| 1001)'s TTPs appear similar to [APT33](https://attack.mitre. | | ack.mitre.org/groups/G0049) but due to differences in victim |
| org/groups/G0064) and [OilRig](https://attack.mitre.org/grou | | s and tools it is tracked as a separate entity.(Citation: Dr |
| ps/G0049) but due to differences in victims and tools it is | | agos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citati |
| tracked as a separate entity. (Citation: Dragos) | | on: ClearSky Siamesekitten August 2021)(Citation: Accenture |
| | | Lyceum Targets November 2021) |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | https://dragos.com/resource/hexane/ | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 19:27:30.581000+00:00 | 2022-08-31 22:16:30.454000+00:00 |
| description | [HEXANE](https://attack.mitre.org/groups/G1001) is a threat group that has targeted ICS organization within the oil & gas, and telecommunications sectors. Many of the targeted organizations have been located in the Middle East including Kuwait. [HEXANE](https://attack.mitre.org/groups/G1001)'s targeting of telecommunications has been speculated to be part of an effort to establish man-in-the-middle capabilities throughout the region. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity. (Citation: Dragos) | [HEXANE](https://attack.mitre.org/groups/G1001) is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. [HEXANE](https://attack.mitre.org/groups/G1001)'s TTPs appear similar to [APT33](https://attack.mitre.org/groups/G0064) and [OilRig](https://attack.mitre.org/groups/G0049) but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021) |
| external_references[1]['source_name'] | Dragos | Spirlin |
| external_references[1]['description'] | Dragos Hexane Retrieved. 2019/10/27 | (Citation: Accenture Lyceum Targets November 2021) |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | HEXANE |
| aliases | | Siamesekitten |
| aliases | | Spirlin |
| external_references | | {'source_name': 'Siamesekitten', 'description': '(Citation: ClearSky Siamesekitten August 2021)'} |
| external_references | | {'source_name': 'Lyceum', 'description': '(Citation: SecureWorks August 2019)'} |
| external_references | | {'source_name': 'Accenture Lyceum Targets November 2021', 'description': 'Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.', 'url': 'https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns'} |
| external_references | | {'source_name': 'ClearSky Siamesekitten August 2021', 'description': 'ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.', 'url': 'https://www.clearskysec.com/siamesekitten/'} |
| external_references | | {'source_name': 'Dragos Hexane', 'description': 'Dragos. (n.d.). Hexane. Retrieved October 27, 2019.', 'url': 'https://dragos.com/resource/hexane/'} |
| external_references | | {'source_name': 'Kaspersky Lyceum October 2021', 'description': 'Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.', 'url': 'https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf'} |
| external_references | | {'source_name': 'SecureWorks August 2019', 'description': 'SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19 ', 'url': 'https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign'} |
| x_mitre_contributors | | Mindaugas Gudzis, BT Security |
| x_mitre_domains | | enterprise-attack |
Minor Version Changes
[G0035] Dragonfly
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-24 19:21:16.242000+00:00 | 2022-10-19 22:09:02.443000+00:00 |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
[G0032] Lazarus Group
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:20:57.634000+00:00 | 2022-08-23 15:30:44.196000+00:00 |
| external_references[7]['url'] | https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf | https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
Patches
[G0037] FIN6
Current version: 3.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-14 17:23:58.316000+00:00 | 2022-06-02 20:11:01.957000+00:00 |
| aliases[2] | SKELETON SPIDER | ITG08 |
| aliases[3] | ITG08 | Skeleton Spider |
| external_references[1]['source_name'] | FIN6 | Skeleton Spider |
| external_references[1]['description'] | (Citation: FireEye FIN6 April 2016) | (Citation: Crowdstrike Global Threat Report Feb 2018) |
| external_references[2]['source_name'] | Magecart Group 6 | FIN6 |
| external_references[2]['description'] | (Citation: Security Intelligence ITG08 April 2020) | (Citation: FireEye FIN6 April 2016) |
| external_references[3]['source_name'] | SKELETON SPIDER | Magecart Group 6 |
| external_references[3]['description'] | (Citation: Crowdstrike Global Threat Report Feb 2018) | (Citation: Security Intelligence ITG08 April 2020) |
| external_references[5]['source_name'] | FireEye FIN6 April 2016 | Crowdstrike Global Threat Report Feb 2018 |
| external_references[5]['description'] | FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. | CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. |
| external_references[5]['url'] | https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf | https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report |
| external_references[6]['source_name'] | FireEye FIN6 Apr 2019 | FireEye FIN6 April 2016 |
| external_references[6]['description'] | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. | FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved June 1, 2016. |
| external_references[6]['url'] | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html | https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf |
| external_references[7]['source_name'] | Security Intelligence ITG08 April 2020 | FireEye FIN6 Apr 2019 |
| external_references[7]['description'] | Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020. | McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019. |
| external_references[7]['url'] | https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ | https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html |
| external_references[8]['source_name'] | Crowdstrike Global Threat Report Feb 2018 | Security Intelligence ITG08 April 2020 |
| external_references[8]['description'] | CrowdStrike. (2018, February 26). CrowdStrike 2018 Global Threat Report. Retrieved October 10, 2018. | Villadsen, O. (2020, April 7). ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework. Retrieved October 8, 2020. |
| external_references[8]['url'] | https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report | https://securityintelligence.com/posts/itg08-aka-fin6-partners-with-trickbot-gang-uses-anchor-framework/ |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
[G0046] FIN7
Current version: 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
| external_references | | https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | http://blog.morphisec.com/fin7-attacks-restaurant-industry | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-02 21:32:06.214000+00:00 | 2022-07-20 20:06:44.706000+00:00 |
| external_references[1]['source_name'] | FIN7 | Carbon Spider |
| external_references[1]['description'] | (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018) | (Citation: CrowdStrike Carbon Spider August 2021) |
| external_references[2]['source_name'] | GOLD NIAGARA | FIN7 |
| external_references[2]['description'] | (Citation: Secureworks GOLD NIAGARA Threat Profile) | (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: Morphisec FIN7 June 2017) (Citation: FireEye FIN7 Shim Databases) (Citation: FireEye FIN7 Aug 2018) |
| external_references[3]['source_name'] | ITG14 | GOLD NIAGARA |
| external_references[3]['description'] | ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020) | (Citation: Secureworks GOLD NIAGARA Threat Profile) |
| external_references[4]['source_name'] | Carbon Spider | FireEye CARBANAK June 2017 |
| external_references[4]['description'] | (Citation: CrowdStrike Carbon Spider August 2021) | Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. |
| external_references[5]['source_name'] | FireEye FIN7 March 2017 | FireEye FIN7 April 2017 |
| external_references[5]['description'] | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. | Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. |
| external_references[5]['url'] | https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html | https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html |
| external_references[6]['source_name'] | FireEye FIN7 April 2017 | FireEye FIN7 Aug 2018 |
| external_references[6]['description'] | Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017. | Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. |
| external_references[6]['url'] | https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html | https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html |
| external_references[7]['source_name'] | FireEye CARBANAK June 2017 | Secureworks GOLD NIAGARA Threat Profile |
| external_references[7]['description'] | Bennett, J., Vengerik, B. (2017, June 12). Behind the CARBANAK Backdoor. Retrieved June 11, 2018. | CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021. |
| external_references[7]['url'] | https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html | https://www.secureworks.com/research/threat-profiles/gold-niagara |
| external_references[8]['source_name'] | FireEye FIN7 Aug 2018 | FireEye FIN7 Shim Databases |
| external_references[8]['description'] | Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018. | Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017. |
| external_references[8]['url'] | https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html | https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html |
| external_references[9]['source_name'] | CrowdStrike Carbon Spider August 2021 | Morphisec FIN7 June 2017 |
| external_references[9]['description'] | Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. | Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017. |
| external_references[9]['url'] | https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ | http://blog.morphisec.com/fin7-attacks-restaurant-industry |
| external_references[10]['source_name'] | Morphisec FIN7 June 2017 | ITG14 |
| external_references[10]['description'] | Gorelik, M.. (2017, June 9). FIN7 Takes Another Bite at the Restaurant Industry. Retrieved July 13, 2017. | ITG14 shares campaign overlap with [FIN7](https://attack.mitre.org/groups/G0046).(Citation: IBM Ransomware Trends September 2020) |
| external_references[11]['source_name'] | FireEye FIN7 Shim Databases | CrowdStrike Carbon Spider August 2021 |
| external_references[11]['description'] | Erickson, J., McWhirt, M., Palombo, D. (2017, May 3). To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence. Retrieved July 18, 2017. | Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021. |
| external_references[11]['url'] | https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html | https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ |
| external_references[12]['source_name'] | Secureworks GOLD NIAGARA Threat Profile | FireEye FIN7 March 2017 |
| external_references[12]['description'] | CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021. | Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017. |
| external_references[12]['url'] | https://www.secureworks.com/research/threat-profiles/gold-niagara | https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
[G0049] OilRig
Current version: 3.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:20:37.658000+00:00 | 2022-06-02 20:18:52.733000+00:00 |
| aliases[3] | HELIX KITTEN | APT34 |
| aliases[4] | APT34 | Helix Kitten |
| external_references[4]['source_name'] | HELIX KITTEN | Helix Kitten |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
[G0034] Sandworm Team
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-23 21:21:17.572000+00:00 | 2022-10-12 20:11:40.313000+00:00 |
| aliases[6] | VOODOO BEAR | Voodoo Bear |
| external_references[1]['source_name'] | VOODOO BEAR | Voodoo Bear |
| x_mitre_contributors[0] | Dragos Threat Intelligence | Dragos Threat Intelligence |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_domains | | enterprise-attack |
| x_mitre_domains | | mobile-attack |
Campaigns
enterprise-attack
New Campaigns
[C0010] C0010
Current version: 1.0
Description: [C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. [C0010](https://attack.mitre.org/campaigns/C0010) began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)
[C0011] C0011
Current version: 1.0
Description: [C0011](https://attack.mitre.org/campaigns/C0011) was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/groups/G0134) that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from [Transparent Tribe](https://attack.mitre.org/groups/G0134)'s historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
[C0015] C0015
Current version: 1.0
Description: [C0015](https://attack.mitre.org/campaigns/C0015) was a ransomware intrusion during which the unidentified attackers used [Bazar](https://attack.mitre.org/software/S0534), [Cobalt Strike](https://attack.mitre.org/software/S0154), and [Conti](https://attack.mitre.org/software/S0575), along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated [Conti](https://attack.mitre.org/software/S0575) ransomware playbook based on the observed pattern of activity and operator errors.(Citation: DFIR Conti Bazar Nov 2021)
[C0004] CostaRicto
Current version: 1.0
Description: [CostaRicto](https://attack.mitre.org/campaigns/C0004) was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. [CostaRicto](https://attack.mitre.org/campaigns/C0004) actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.(Citation: BlackBerry CostaRicto November 2020)
[C0001] Frankenstein
Current version: 1.0
Description: [Frankenstein](https://attack.mitre.org/campaigns/C0001) was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including [Empire](https://attack.mitre.org/software/S0363). The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)
[C0007] FunnyDream
Current version: 1.0
Description: [FunnyDream](https://attack.mitre.org/campaigns/C0007) was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign to possible Chinese-speaking threat actors through the use of the [Chinoxy](https://attack.mitre.org/software/S1041) backdoor and noted infrastructure overlap with the TAG-16 threat group.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: Kaspersky APT Trends Q1 2020)(Citation: Recorded Future Chinese Activity in Southeast Asia December 2021)
[C0002] Night Dragon
Current version: 1.0
Description: [Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)
[C0012] Operation CuckooBees
Current version: 1.0
Description: [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)
[C0016] Operation Dust Storm
Current version: 1.0
Description: [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm)
[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)
[C0006] Operation Honeybee
Current version: 1.0
Description: [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. [Operation Honeybee](https://attack.mitre.org/campaigns/C0006) initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee)
[C0013] Operation Sharpshooter
Current version: 1.0
Description: [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous [Lazarus Group](https://attack.mitre.org/groups/G0032) operations, including fake job recruitment lures and shared malware code.(Citation: McAfee Sharpshooter December 2018)(Citation: Bleeping Computer Op Sharpshooter March 2019)(Citation: Threatpost New Op Sharpshooter Data March 2019)
[C0005] Operation Spalax
Current version: 1.0
Description: [Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The [Operation Spalax](https://attack.mitre.org/campaigns/C0005) threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Citation: ESET Operation Spalax Jan 2021)
[C0014] Operation Wocao
Current version: 1.0
Description: [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.(Citation: FoxIT Wocao December 2019)
Security researchers assessed the [Operation Wocao](https://attack.mitre.org/campaigns/C0014) actors used similar TTPs and tools as APT20, suggesting a possible overlap. [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.(Citation: FoxIT Wocao December 2019)
mobile-attack
New Campaigns
[C0016] Operation Dust Storm
Current version: 1.0
Description: [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.(Citation: Cylance Dust Storm)
[Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.(Citation: Cylance Dust Storm)
ics-attack
New Campaigns
[C0009] Oldsmar Treatment Plant Intrusion
Current version: 1.0
Description: [Oldsmar Treatment Plant Intrusion](https://attack.mitre.org/campaigns/C0009) was a cyber incident involving a water treatment facility in Florida. During this incident, unidentified threat actors leveraged features of the system to access and modify setpoints for a specific chemical required in the treatment process. The incident was detected immediately and prevented before it could cause any harm to the public.(Citation: Pinellas County Sheriffs Office February 2021)(Citation: CISA AA21-042A Water Treatment Intrusion Feb 2021)(Citation: Dragos Oldsmar Feb 2021)
Mitigations
enterprise-attack
Patches
[M1036] Account Use Policies
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-06-13 16:07:21.233000+00:00 | 2022-10-21 15:52:18.525000+00:00 |
[M1047] Audit
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-11-19 20:44:07.442000+00:00 | 2022-10-21 15:52:12.722000+00:00 |
[M1043] Credential Access Protection
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-31 13:09:22.442000+00:00 | 2022-10-21 15:51:57.176000+00:00 |
[M1032] Multi-factor Authentication
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-06-10 20:53:36.319000+00:00 | 2022-10-21 15:52:06.295000+00:00 |
[M1027] Password Policies
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 2.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-06-06 21:10:35.792000+00:00 | 2022-10-21 15:52:23.327000+00:00 |
ics-attack
Patches
[M0801] Access Management
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 2.1', 'IEC 62443-4-2:2019 - CR 2.1', 'NIST SP 800-53 Rev. 4 - AC-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.034000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0936] Account Use Policies
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.11', 'IEC 62443-4-2:2019 - CR 1.11', 'NIST SP 800-53 Rev. 4 - IA-5'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.034000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0915] Active Directory Configuration
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.035000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0949] Antivirus/Antimalware
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.2', 'IEC 62443-4-2:2019 - CR 3.2', 'NIST SP 800-53 Rev. 4 - SI-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.036000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0913] Application Developer Guidance
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - AT-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.036000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0948] Application Isolation and Sandboxing
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 5.4', 'IEC 62443-4-2:2019 - CR 5.4', 'NIST SP 800-53 Rev. 4 - SI-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.036000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0947] Audit
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.4', 'IEC 62443-4-2:2019 - CR 3.4', 'NIST SP 800-53 Rev. 4 - SI-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.037000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0800] Authorization Enforcement
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 2.1', 'IEC 62443-4-2:2019 - CR 2.1', 'NIST SP 800-53 Rev. 4 - AC-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.038000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0946] Boot Integrity
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-4-2:2019 - CR 3.14', 'NIST SP 800-53 Rev. 4 - SI-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.038000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0945] Code Signing
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.4', 'IEC 62443-4-2:2019 - CR 3.4', 'NIST SP 800-53 Rev. 4 - SI-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.039000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0802] Communication Authenticity
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.1', 'IEC 62443-4-2:2019 - CR 3.1', 'NIST SP 800-53 Rev. 4 - SC-8; SC-23'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.039000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0803] Data Loss Prevention
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 4.1', 'IEC 62443-4-2:2019 - CR 4.1'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.040000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0942] Disable or Remove Feature or Program
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 7.7', 'IEC 62443-4-2:2019 - CR 7.7', 'NIST SP 800-53 Rev. 4 - CM-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.041000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0808] Encrypt Network Traffic
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 4.1', 'IEC 62443-4-2:2019 - CR 4.1', 'NIST SP 800-53 Rev. 4 - SC-8'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.041000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0941] Encrypt Sensitive Information
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 4.1', 'IEC 62443-4-2:2019 - CR 4.1', 'NIST SP 800-53 Rev. 4 - SC-28'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.041000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0938] Execution Prevention
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.2', 'IEC 62443-4-2:2019 - CR 3.2', 'NIST SP 800-53 Rev. 4 - SI-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.042000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0950] Exploit Protection
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.2', 'IEC 62443-4-2:2019 - CR 3.2', 'NIST SP 800-53 Rev. 4 - SI-16'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.042000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0937] Filter Network Traffic
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 5.1', 'IEC 62443-4-2:2019 - CR 5.1', 'NIST SP 800-53 Rev. 4 - AC-3; SC-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.043000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0804] Human User Authentication
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.1', 'IEC 62443-4-2:2019 - CR 1.1', 'NIST SP 800-53 Rev. 4 - IA-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.060000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0935] Limit Access to Resource Over Network
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 5.1', 'IEC 62443-4-2:2019 - CR 5.1', 'NIST SP 800-53 Rev. 4 - AC-3; SC-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.044000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0934] Limit Hardware Installation
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 3.2', 'IEC 62443-4-2:2019 - EDR 3.2', 'NIST SP 800-53 Rev. 4 - MP-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.045000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0805] Mechanical Protection Layers
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.046000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0806] Minimize Wireless Signal Propagation
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.6', 'IEC 62443-4-2:2019 - CR 1.6', 'NIST SP 800-53 Rev. 4 - SC-40'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.048000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0816] Mitigation Limited or Not Effective
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.048000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0932] Multi-factor Authentication
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.7', 'IEC 62443-4-2:2019 - CR 1.7', 'NIST SP 800-53 Rev. 4 - IA-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.048000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0807] Network Allowlists
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - AC-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.060000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0931] Network Intrusion Prevention
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 6.2', 'IEC 62443-4-2:2019 - CR 6.2', 'NIST SP 800-53 Rev. 4 - SI-4'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.049000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0930] Network Segmentation
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 5.1', 'IEC 62443-4-2:2019 - CR 5.1', 'NIST SP 800-53 Rev. 4 - AC-3'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.051000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0928] Operating System Configuration
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 7.7', 'IEC 62443-4-2:2019 - CR 7.7', 'NIST SP 800-53 Rev. 4 - CM-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.051000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0809] Operational Information Confidentiality
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 4.1', 'IEC 62443-4-2:2019 - CR 4.1'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.051000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0810] Out-of-Band Communications Channel
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - SC-37'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.053000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0927] Password Policies
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.5', 'IEC 62443-4-2:2019 - CR 1.5', 'NIST SP 800-53 Rev. 4 - IA-5'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.053000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0926] Privileged Account Management
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.3', 'IEC 62443-4-2:2019 - CR 1.3', 'NIST SP 800-53 Rev. 4 - AC-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.053000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0811] Redundancy of Service
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - CP-9'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.054000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0922] Restrict File and Directory Permissions
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 2.1', 'IEC 62443-4-2:2019 - CR 2.1', 'NIST SP 800-53 Rev. 4 - AC-6'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.054000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0944] Restrict Library Loading
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 7.7', 'IEC 62443-4-2:2019 - CR 7.7', 'NIST SP 800-53 Rev. 4 - CP-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.054000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0924] Restrict Registry Permissions
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 2.1', 'IEC 62443-4-2:2019 - CR 2.1', 'NIST SP 800-53 Rev. 4 - AC-6'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.055000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0921] Restrict Web-Based Content
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 2.4', 'IEC 62443-4-2:2019 - HDR 2.4', 'NIST SP 800-53 Rev. 4 - SC-18'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.055000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0920] SSL/TLS Inspection
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.055000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0812] Safety Instrumented Systems
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.056000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0954] Software Configuration
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 7.7', 'IEC 62443-4-2:2019 - CR 7.7', 'NIST SP 800-53 Rev. 4 - CM-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.057000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0813] Software Process and Device Authentication
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.2', 'IEC 62443-4-2:2019 - CR 1.2', 'NIST SP 800-53 Rev. 4 - IA-9'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.057000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0814] Static Network Configuration
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 7.7', 'IEC 62443-4-2:2019 - CR 7.7', 'NIST SP 800-53 Rev. 4 - CM-7'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.057000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0817] Supply Chain Management
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - SA-12'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.058000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0919] Threat Intelligence Program
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.058000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0951] Update Software
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-4-2:2019 - CR 3.10', 'NIST SP 800-53 Rev. 4 - SI-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.058000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0918] User Account Management
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-3-3:2013 - SR 1.3', 'IEC 62443-4-2:2019 - CR 1.3', 'NIST SP 800-53 Rev. 4 - AC-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.059000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0917] User Training
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - AT-2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.059000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0916] Vulnerability Scanning
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['NIST SP 800-53 Rev. 4 - RA-5'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.059000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
[M0815] Watchdog Timers
Current version: 1.0
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| labels | ['IEC 62443-4-2:2019 - CR 7.2'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-06 17:47:24.060000+00:00 | 2022-10-24 15:09:07.609000+00:00 |
| external_references[0]['source_name'] | mitre-ics-attack | mitre-attack |
Data Sources
enterprise-attack
Minor Version Changes
[DS0017] Command
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20T18:09:26.646Z | 2022-10-21T15:55:31.986Z |
| x_mitre_version | 1.0 | 1.1 |
[DS0028] Logon Session
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Logon occurring on a system or resource (local, domain, or c | t | Logon occurring on a system or resource (local, domain, or c |
| loud) to which a user/device is gaining access after success | | loud) to which a user/device is gaining access after success |
| ful authentication and authorizaton(Citation: Microsoft Audi | | ful authentication and authorization(Citation: Microsoft Aud |
| t Logon Events) | | it Logon Events) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.805Z | 2022-10-21T15:56:16.481Z |
| description | Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorizaton(Citation: Microsoft Audit Logon Events) | Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events) |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0028 | https://attack.mitre.org/data-sources/DS0028 |
[DS0004] Malware Repository
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.271Z | 2022-10-20T20:20:36.693Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0004 | https://attack.mitre.org/data-sources/DS0004 |
[DS0029] Network Traffic
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:18:34.334Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0029 | https://attack.mitre.org/data-sources/DS0029 |
[DS0009] Process
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-21T15:58:32.516Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0009 | https://attack.mitre.org/data-sources/DS0009 |
[DS0012] Script
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-11-10T09:30:48.698Z | 2022-10-21T15:58:58.335Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0012 | https://attack.mitre.org/data-sources/DS0012 |
| external_references[1]['source_name'] | Microsoft PowerShell Logging | FireEye PowerShell Logging |
| external_references[1]['description'] | Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021. | Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7 | https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html |
| external_references[2]['source_name'] | FireEye PowerShell Logging | Microsoft AMSI |
| external_references[2]['description'] | Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021. | Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html | https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal |
| external_references[3]['source_name'] | Microsoft AMSI | Microsoft PowerShell Logging |
| external_references[3]['description'] | Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021. | Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal | https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7 |
[DS0013] Sensor Health
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:22:52.060Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0013 | https://attack.mitre.org/data-sources/DS0013 |
[DS0002] User Account
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.807Z | 2022-10-21T15:59:59.646Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0002 | https://attack.mitre.org/data-sources/DS0002 |
Deprecations
[DS0031] Cluster
Current version: 1.0
Description: A set of containerized computing resources that are managed together but have separate nodes to execute various tasks and/or applications(Citation: Kube Cluster Admin)(Citation: Kube Cluster Info)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | True |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-11-10T09:30:48.694Z | 2022-10-20T20:54:47.329Z |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0031 | https://attack.mitre.org/data-sources/DS0031 |
ics-attack
New Data Sources
[DS0039] Asset
Current version: 1.0
Description: Data sources with information about the set of devices found within the network, along with their current software and configurations
Minor Version Changes
[DS0017] Command
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20T18:09:26.646Z | 2022-10-21T15:55:31.986Z |
| x_mitre_version | 1.0 | 1.1 |
[DS0028] Logon Session
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Logon occurring on a system or resource (local, domain, or c | t | Logon occurring on a system or resource (local, domain, or c |
| loud) to which a user/device is gaining access after success | | loud) to which a user/device is gaining access after success |
| ful authentication and authorizaton(Citation: Microsoft Audi | | ful authentication and authorization(Citation: Microsoft Aud |
| t Logon Events) | | it Logon Events) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.805Z | 2022-10-21T15:56:16.481Z |
| description | Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorizaton(Citation: Microsoft Audit Logon Events) | Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization(Citation: Microsoft Audit Logon Events) |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0028 | https://attack.mitre.org/data-sources/DS0028 |
[DS0029] Network Traffic
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:18:34.334Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0029 | https://attack.mitre.org/data-sources/DS0029 |
[DS0009] Process
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-21T15:58:32.516Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0009 | https://attack.mitre.org/data-sources/DS0009 |
[DS0012] Script
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-11-10T09:30:48.698Z | 2022-10-21T15:58:58.335Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0012 | https://attack.mitre.org/data-sources/DS0012 |
| external_references[1]['source_name'] | Microsoft PowerShell Logging | FireEye PowerShell Logging |
| external_references[1]['description'] | Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021. | Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7 | https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html |
| external_references[2]['source_name'] | FireEye PowerShell Logging | Microsoft AMSI |
| external_references[2]['description'] | Dunwoody, M. (2016, February 11). Greater Visibility Through PowerShell Logging. Retrieved September 28, 2021. | Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html | https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal |
| external_references[3]['source_name'] | Microsoft AMSI | Microsoft PowerShell Logging |
| external_references[3]['description'] | Microsoft. (2019, April 19). Antimalware Scan Interface (AMSI). Retrieved September 28, 2021. | Microsoft. (2020, March 30). about_Logging_Windows. Retrieved September 28, 2021. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal | https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7 |
[DS0002] User Account
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.807Z | 2022-10-21T15:59:59.646Z |
| x_mitre_version | 1.0 | 1.1 |
| external_references[0]['url'] | https://attack.mitre.org/datasources/DS0002 | https://attack.mitre.org/data-sources/DS0002 |
Data Components
enterprise-attack
Minor Version Changes
Command: Command Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Invoking a computer program directive to perform a specific | t | The execution of a line of text, potentially with arguments, |
| task (ex: Windows EID 4688 of cmd.exe showing command-line p | | created from program code (e.g. a cmdlet executed via power |
| arameters, ~/.bash_history, or ~/.zsh_history) | | shell.exe, interactive commands like >dir, shell executions, |
| | | etc. ) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.273Z | 2022-10-07T16:14:39.124Z |
| description | Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history) | The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. ) |
| x_mitre_version | 1.0 | 1.1 |
Sensor Health: Host Status
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a WMI object, such as a filter, cons | t | Logging, messaging, and other artifacts highlighting the hea |
| umer, subscription, binding, or provider (ex: Sysmon EIDs 19 | | lth of host sensors (ex: metrics, errors, and/or exceptions |
| -21) | | from logging applications) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:22:45.613Z |
| description | Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21) | Logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications) |
| x_mitre_version | 1.0 | 1.1 |
Logon Session: Logon Session Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a new user logon session (ex: Window | t | Initial construction of a successful new user logon followin |
| s EID 4624, /var/log/utmp, or /var/log/wmtp) | | g an authentication attempt. (e.g. Windows EID 4624, /var/lo |
| | | g/utmp, or /var/log/wmtp) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.274Z | 2022-10-07T16:18:20.802Z |
| description | Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp) | Initial construction of a successful new user logon following an authentication attempt. (e.g. Windows EID 4624, /var/log/utmp, or /var/log/wmtp) |
| x_mitre_version | 1.0 | 1.1 |
Malware Repository: Malware Content
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a WMI object, such as a filter, cons | t | Code, strings, and other signatures that compromise a malici |
| umer, subscription, binding, or provider (ex: Sysmon EIDs 19 | | ous payload |
| -21) | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:19:58.845Z |
| description | Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21) | Code, strings, and other signatures that compromise a malicious payload |
| x_mitre_version | 1.0 | 1.1 |
Malware Repository: Malware Metadata
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a WMI object, such as a filter, cons | t | Contextual data about a malicious payload, such as compilati |
| umer, subscription, binding, or provider (ex: Sysmon EIDs 19 | | on times, file hashes, as well as watermarks or other identi |
| -21) | | fiable configuration information |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:20:12.165Z |
| description | Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21) | Contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information |
| x_mitre_version | 1.0 | 1.1 |
Network Traffic: Network Connection Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a WMI object, such as a filter, cons | t | Initial construction of a network connection, such as captur |
| umer, subscription, binding, or provider (ex: Sysmon EIDs 19 | | ing socket information with a source/destination IP and port |
| -21) | | (s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:18:06.745Z |
| description | Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21) | Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log) |
| x_mitre_version | 1.0 | 1.1 |
Process: Process Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Birth of a new running process (ex: Sysmon EID 1 or Windows | t | The initial construction of an executable managed by the OS, |
| EID 4688) | | that may involve one or more tasks or threads. (e.g. Win EI |
| | | D 4688, Sysmon EID 1, cmd.exe > net use, etc.) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.272Z | 2022-10-07T16:15:56.932Z |
| description | Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688) | The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.) |
| x_mitre_version | 1.0 | 1.1 |
Script: Script Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Launching a list of commands through a script file (ex: Wind | t | The execution of a text file that contains code via the inte |
| ows EID 4104) | | rpreter (e.g. Powershell, WMI, Windows EID 4104, etc.) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.272Z | 2022-10-07T16:16:55.269Z |
| description | Launching a list of commands through a script file (ex: Windows EID 4104) | The execution of a text file that contains code via the interpreter (e.g. Powershell, WMI, Windows EID 4104, etc.) |
| x_mitre_version | 1.0 | 1.1 |
User Account: User Account Authentication
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | An attempt by a user to gain access to a network or computin | t | An attempt by a user to gain access to a network or computin |
| g resource, often by providing credentials (ex: Windows EID | | g resource, often by providing credentials (ex: Windows EID |
| 4625 or /var/log/auth.log) | | 4776 or /var/log/auth.log) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.271Z | 2022-10-07T16:19:46.282Z |
| description | An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log) | An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4776 or /var/log/auth.log) |
| x_mitre_version | 1.0 | 1.1 |
Deprecations
Cluster: Cluster Metadata
Current version: 1.0
Description: Contextual data about a cluster and activity around it such as name, namespace, age, or status
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | True |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.274Z | 2022-10-20T20:54:47.331Z |
ics-attack
New Data Components
Asset: Asset Inventory
Current version: 1.0
Description: This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses)
Scheduled Job: Scheduled Job Creation
Current version: 1.0
Description: Initial construction of a new scheduled job (ex: Windows EID 4698 or /var/log cron logs)
Service: Service Modification
Current version: 1.0
Description: Changes made to a service/daemon, such as changes to name, description, and/or start type (ex: Windows EID 7040 or /var/log daemon logs)
Asset: Software
Current version: 1.0
Description: This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).
Minor Version Changes
Command: Command Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Invoking a computer program directive to perform a specific | t | The execution of a line of text, potentially with arguments, |
| task (ex: Windows EID 4688 of cmd.exe showing command-line p | | created from program code (e.g. a cmdlet executed via power |
| arameters, ~/.bash_history, or ~/.zsh_history) | | shell.exe, interactive commands like >dir, shell executions, |
| | | etc. ) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.273Z | 2022-10-07T16:14:39.124Z |
| description | Invoking a computer program directive to perform a specific task (ex: Windows EID 4688 of cmd.exe showing command-line parameters, ~/.bash_history, or ~/.zsh_history) | The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. ) |
| x_mitre_version | 1.0 | 1.1 |
Logon Session: Logon Session Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a new user logon session (ex: Window | t | Initial construction of a successful new user logon followin |
| s EID 4624, /var/log/utmp, or /var/log/wmtp) | | g an authentication attempt. (e.g. Windows EID 4624, /var/lo |
| | | g/utmp, or /var/log/wmtp) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.274Z | 2022-10-07T16:18:20.802Z |
| description | Initial construction of a new user logon session (ex: Windows EID 4624, /var/log/utmp, or /var/log/wmtp) | Initial construction of a successful new user logon following an authentication attempt. (e.g. Windows EID 4624, /var/log/utmp, or /var/log/wmtp) |
| x_mitre_version | 1.0 | 1.1 |
Network Traffic: Network Connection Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Initial construction of a WMI object, such as a filter, cons | t | Initial construction of a network connection, such as captur |
| umer, subscription, binding, or provider (ex: Sysmon EIDs 19 | | ing socket information with a source/destination IP and port |
| -21) | | (s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.806Z | 2022-10-20T20:18:06.745Z |
| description | Initial construction of a WMI object, such as a filter, consumer, subscription, binding, or provider (ex: Sysmon EIDs 19-21) | Initial construction of a network connection, such as capturing socket information with a source/destination IP and port(s) (ex: Windows EID 5156, Sysmon EID 3, or Zeek conn.log) |
| x_mitre_version | 1.0 | 1.1 |
Process: Process Creation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Birth of a new running process (ex: Sysmon EID 1 or Windows | t | The initial construction of an executable managed by the OS, |
| EID 4688) | | that may involve one or more tasks or threads. (e.g. Win EI |
| | | D 4688, Sysmon EID 1, cmd.exe > net use, etc.) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.272Z | 2022-10-07T16:15:56.932Z |
| description | Birth of a new running process (ex: Sysmon EID 1 or Windows EID 4688) | The initial construction of an executable managed by the OS, that may involve one or more tasks or threads. (e.g. Win EID 4688, Sysmon EID 1, cmd.exe > net use, etc.) |
| x_mitre_version | 1.0 | 1.1 |
Script: Script Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Launching a list of commands through a script file (ex: Wind | t | The execution of a text file that contains code via the inte |
| ows EID 4104) | | rpreter (e.g. Powershell, WMI, Windows EID 4104, etc.) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.272Z | 2022-10-07T16:16:55.269Z |
| description | Launching a list of commands through a script file (ex: Windows EID 4104) | The execution of a text file that contains code via the interpreter (e.g. Powershell, WMI, Windows EID 4104, etc.) |
| x_mitre_version | 1.0 | 1.1 |
User Account: User Account Authentication
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | An attempt by a user to gain access to a network or computin | t | An attempt by a user to gain access to a network or computin |
| g resource, often by providing credentials (ex: Windows EID | | g resource, often by providing credentials (ex: Windows EID |
| 4625 or /var/log/auth.log) | | 4776 or /var/log/auth.log) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| revoked | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-20T15:05:19.271Z | 2022-10-07T16:19:46.282Z |
| description | An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4625 or /var/log/auth.log) | An attempt by a user to gain access to a network or computing resource, often by providing credentials (ex: Windows EID 4776 or /var/log/auth.log) |
| x_mitre_version | 1.0 | 1.1 |