ATT&CK Changes Between v12.1 and v13.0
Key
- New objects: ATT&CK objects which are only present in the new release.
- Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
- Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
- Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
- Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
- Object revocations: ATT&CK objects which are revoked by a different object.
- Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
- Object deletions: ATT&CK objects which are no longer found in the STIX data.
| Colors for description field |
|---|
| Added |
| Changed |
| Deleted |
|
Additional formats
These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
This JSON file contains the machine readble output used to create this page: changelog.json
Techniques
enterprise-attack
New Techniques
[T1650] Acquire Access
Current version: 1.0
Description: Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)
Footholds to compromised systems may take a variety of forms, such as access to planted backdoors (e.g., [Web Shell](https://attack.mitre.org/techniques/T1505/003)) or established access via [External Remote Services](https://attack.mitre.org/techniques/T1133). In some cases, access brokers will implant compromised systems with a “load” that can be used to install additional malware for paying customers.(Citation: Microsoft Ransomware as a Service)
By leveraging existing access broker networks rather than developing or obtaining their own initial access capabilities, an adversary can potentially reduce the resources required to gain a foothold on a target network and focus their efforts on later stages of compromise. Adversaries may prioritize acquiring access to systems that have been determined to lack security monitoring or that have high privileges, or systems that belong to organizations in a particular sector.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)
In some cases, purchasing access to an organization in sectors such as IT contracting, software development, or telecommunications may allow an adversary to compromise additional victims via a [Trusted Relationship](https://attack.mitre.org/techniques/T1199), [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111), or even [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195).
**Note:** while this technique is distinct from other behaviors such as [Purchase Technical Data](https://attack.mitre.org/techniques/T1597/002) and [Credentials](https://attack.mitre.org/techniques/T1589/001), they may often be used in conjunction (especially where the acquired foothold requires [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
[T1552.008] Unsecured Credentials: Chat Messages
Current version: 1.0
Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.
Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
[T1059.009] Command and Scripting Interpreter: Cloud API
Current version: 1.0
Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: A), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).
Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.
With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.
[T1651] Cloud Administration Command
Current version: 1.0
Description: Adversaries may abuse cloud management services to execute commands within virtual machines or hybrid-joined devices. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. Similarly, in Azure AD environments, Microsoft Endpoint Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to the Azure AD.(Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)(Citation: SpecterOps Lateral Movement from Azure to On-Prem AD 2020)
If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines or on-premises hybrid-joined devices. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)
[T1021.007] Remote Services: Cloud Services
Current version: 1.0
Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.
Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI.
In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.
[T1027.010] Obfuscated Files or Information: Command Obfuscation
Current version: 1.0
Description: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)
For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017)
Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC)
Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
[T1652] Device Driver Discovery
Current version: 1.0
Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).
Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers)
On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
[T1567.003] Exfiltration Over Web Service: Exfiltration to Text Storage Sites
Current version: 1.0
Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.
Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec)
**Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.
[T1027.011] Obfuscated Files or Information: Fileless Storage
Current version: 1.0
Description: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)
Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage.
Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.
Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)
[T1583.008] Acquire Infrastructure: Malvertising
Current version: 1.0
Description: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.
Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising)
Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising)
Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising)
[T1036.008] Masquerading: Masquerade File Type
Current version: 1.0
Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.
Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections.
Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension.
Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)
[T1556.008] Modify Authentication Process: Network Provider DLL
Current version: 1.0
Description: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)
Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify)
Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)
[T1562.011] Impair Defenses: Spoof Security Alerting
Current version: 1.0
Description: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident.
Rather than or in addition to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), an adversary can spoof positive affirmations that security tools are continuing to function even after legitimate security tools have been disabled (e.g., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)). An adversary can also present a “healthy” system status even after infection. This can be abused to enable further malicious activity by delaying defender responses.
For example, adversaries may show a fake Windows Security GUI and tray icon with a “healthy” system status after Windows Defender and other system tools have been disabled.(Citation: BlackBasta)
Major Version Changes
[T1217] Browser Information Discovery
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | Adversaries may enumerate browser bookmarks to learn more ab | t | Adversaries may enumerate information about browsers to lear |
| out compromised hosts. Browser bookmarks may reveal personal | | n more about compromised environments. Data saved by browser |
| information about users (ex: banking sites, interests, soci | | s (such as bookmarks, accounts, and browsing history) may re |
| al media, etc.) as well as details about internal network re | | veal a variety of personal information about users (e.g., ba |
| sources such as servers, tools/dashboards, or other related | | nking sites, relationships/interests, social media, etc.) as |
| infrastructure. Browser bookmarks may also highlight additi | | well as details about internal network resources such as se |
| onal targets after an adversary has access to valid credenti | | rvers, tools/dashboards, or other related infrastructure.(Ci |
| als, especially [Credentials In Files](https://attack.mitre. | | tation: Kaspersky Autofill) Browser information may also hi |
| org/techniques/T1552/001) associated with logins cached by a | | ghlight additional targets after an adversary has access to |
| browser. Specific storage locations vary based on platform | | valid credentials, especially [Credentials In Files](https:/ |
| and/or application, but browser bookmarks are typically sto | | /attack.mitre.org/techniques/T1552/001) associated with logi |
| red in local files/databases. | | ns cached by a browser. Specific storage locations vary bas |
| | | ed on platform and/or application, but browser information i |
| | | s typically stored in local files and databases (e.g., `%APP |
| | | DATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles) |
Dropped Mitigations:
- T1217: Browser Bookmark Discovery Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 16:06:07.367000+00:00 | 2023-04-16 14:24:40.625000+00:00 |
| name | Browser Bookmark Discovery | Browser Information Discovery |
| description | Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.
Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases. | Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)
Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.
Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles) |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Chrome Roaming Profiles', 'description': 'Chrome Enterprise and Education Help. (n.d.). Use Chrome Browser with Roaming User Profiles. Retrieved March 28, 2023.', 'url': 'https://support.google.com/chrome/a/answer/7349337'} |
| external_references | | {'source_name': 'Kaspersky Autofill', 'description': 'Golubev, S. (n.d.). How malware steals autofill data from browsers. Retrieved March 28, 2023.', 'url': 'https://www.kaspersky.com/blog/browser-data-theft/27871/'} |
| x_mitre_contributors | | Manikantan Srinivasan, NEC Corporation India |
| x_mitre_contributors | | Yinon Engelsman, Talon Cyber Security |
| x_mitre_contributors | | Yonatan Gotlib, Talon Cyber Security |
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
Minor Version Changes
[T1548] Abuse Elevation Control Mechanism
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-21 19:01:25.043000+00:00 | 2023-04-21 12:35:07.744000+00:00 |
| x_mitre_data_sources[0] | Command: Command Execution | File: File Metadata |
| x_mitre_data_sources[1] | File: File Modification | Process: OS API Execution |
| x_mitre_data_sources[2] | Windows Registry: Windows Registry Key Modification | Process: Process Creation |
| x_mitre_data_sources[3] | Process: Process Metadata | Command: Command Execution |
| x_mitre_data_sources[4] | Process: Process Creation | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[5] | Process: OS API Execution | Process: Process Metadata |
| x_mitre_data_sources[6] | File: File Metadata | File: File Modification |
| x_mitre_version | 1.0 | 1.1 |
[T1546.008] Event Triggered Execution: Accessibility Features
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| external_references | | Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-558 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-05-13 20:37:30.048000+00:00 | 2023-04-21 12:33:18.602000+00:00 |
| external_references[1]['source_name'] | capec | Narrator Accessibility Abuse |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/558.html | https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html |
| x_mitre_data_sources[0] | File: File Modification | Command: Command Execution |
| x_mitre_data_sources[1] | File: File Creation | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[2] | Windows Registry: Windows Registry Key Modification | File: File Modification |
| x_mitre_data_sources[4] | Command: Command Execution | File: File Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Narrator Accessibility Abuse', 'description': "Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020.", 'url': 'https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html'} | |
[T1531] Account Access Removal
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may interrupt availability of system and network | t | Adversaries may interrupt availability of system and network |
| resources by inhibiting access to accounts utilized by legi | | resources by inhibiting access to accounts utilized by legi |
| timate users. Accounts may be deleted, locked, or manipulate | | timate users. Accounts may be deleted, locked, or manipulate |
| d (ex: changed credentials) to remove access to accounts. Ad | | d (ex: changed credentials) to remove access to accounts. Ad |
| versaries may also subsequently log off and/or perform a [Sy | | versaries may also subsequently log off and/or perform a [Sy |
| stem Shutdown/Reboot](https://attack.mitre.org/techniques/T1 | | stem Shutdown/Reboot](https://attack.mitre.org/techniques/T1 |
| 529) to set malicious changes into place.(Citation: CarbonBl | | 529) to set malicious changes into place.(Citation: CarbonBl |
| ack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In W | | ack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In W |
| indows, [Net](https://attack.mitre.org/software/S0039) utili | | indows, [Net](https://attack.mitre.org/software/S0039) utili |
| ty, <code>Set-LocalUser</code> and <code>Set-ADAccountPasswo | | ty, <code>Set-LocalUser</code> and <code>Set-ADAccountPasswo |
| rd</code> [PowerShell](https://attack.mitre.org/techniques/T | | rd</code> [PowerShell](https://attack.mitre.org/techniques/T |
| 1059/001) cmdlets may be used by adversaries to modify user | | 1059/001) cmdlets may be used by adversaries to modify user |
| accounts. In Linux, the <code>passwd</code> utility may be u | | accounts. In Linux, the <code>passwd</code> utility may be u |
| sed to change passwords. Accounts could also be disabled by | | sed to change passwords. Accounts could also be disabled by |
| Group Policy. Adversaries who use ransomware may first per | | Group Policy. Adversaries who use ransomware or similar at |
| form this and other Impact behaviors, such as [Data Destruct | | tacks may first perform this and other Impact behaviors, suc |
| ion](https://attack.mitre.org/techniques/T1485) and [Defacem | | h as [Data Destruction](https://attack.mitre.org/techniques/ |
| ent](https://attack.mitre.org/techniques/T1491), before comp | | T1485) and [Defacement](https://attack.mitre.org/techniques/ |
| leting the [Data Encrypted for Impact](https://attack.mitre. | | T1491), in order to impede incident response/recovery before |
| org/techniques/T1486) objective. | | completing the [Data Encrypted for Impact](https://attack.m |
| | | itre.org/techniques/T1486) objective. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Hubert Mank'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 22:57:27.449000+00:00 | 2023-03-22 20:39:15.680000+00:00 |
| description | Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
In Windows, [Net](https://attack.mitre.org/software/S0039) utility, Set-LocalUser and Set-ADAccountPassword [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. In Linux, the passwd utility may be used to change passwords. Accounts could also be disabled by Group Policy.
Adversaries who use ransomware may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective. | Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
In Windows, [Net](https://attack.mitre.org/software/S0039) utility, Set-LocalUser and Set-ADAccountPassword [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. In Linux, the passwd utility may be used to change passwords. Accounts could also be disabled by Group Policy.
Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective. |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | User Account: User Account Modification |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | User Account: User Account Modification | |
[T1087] Account Discovery
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may attempt to get a listing of accounts on a sy | t | Adversaries may attempt to get a listing of valid accounts, |
| stem or within an environment. This information can help adv | | usernames, or email addresses on a system or within a compro |
| ersaries determine which accounts exist to aid in follow-on | | mised environment. This information can help adversaries det |
| behavior. | | ermine which accounts exist, which can aid in follow-on beha |
| | | vior such as brute-forcing, spear-phishing attacks, or accou |
| | | nt takeovers (e.g., [Valid Accounts](https://attack.mitre.or |
| | | g/techniques/T1078)). Adversaries may use several methods t |
| | | o enumerate accounts, including abuse of existing tools, bui |
| | | lt-in commands, and potential misconfigurations that leak ac |
| | | count names and roles or permissions in the targeted environ |
| | | ment. For examples, cloud environments typically provide ea |
| | | sily accessible interfaces to obtain user lists. On hosts, a |
| | | dversaries can use default [PowerShell](https://attack.mitre |
| | | .org/techniques/T1059/001) and other command line functional |
| | | ity to identify accounts. Information about email addresses |
| | | and accounts may also be extracted by searching an infected |
| | | system’s files. |
Dropped Mitigations:
- T1087: Account Discovery Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| external_references | | Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
| external_references | CAPEC-575 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-13 14:05:15.038000+00:00 | 2023-04-15 17:24:23.029000+00:00 |
| description | Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior. | Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.
For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files. |
| external_references[1]['source_name'] | capec | Elastic - Koadiac Detection with EQL |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/575.html | https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql |
| x_mitre_data_sources[0] | File: File Access | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | File: File Access |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'} | |
[T1098] Account Manipulation
Current version: 2.5
Version changed from: 2.4 → 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-18 15:50:24.811000+00:00 | 2023-04-12 23:29:30.966000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[1] | Group: Group Modification | Command: Command Execution |
| x_mitre_data_sources[2] | Process: Process Creation | Active Directory: Active Directory Object Modification |
| x_mitre_data_sources[3] | Active Directory: Active Directory Object Modification | Group: Group Modification |
| x_mitre_data_sources[4] | Command: Command Execution | File: File Modification |
| x_mitre_data_sources[5] | File: File Modification | Process: Process Creation |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1583] Acquire Infrastructure
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may buy, lease, or rent infrastructure that can | t | Adversaries may buy, lease, or rent infrastructure that can |
| be used during targeting. A wide variety of infrastructure e | | be used during targeting. A wide variety of infrastructure e |
| xists for hosting and orchestrating adversary operations. In | | xists for hosting and orchestrating adversary operations. In |
| frastructure solutions include physical or cloud servers, do | | frastructure solutions include physical or cloud servers, do |
| mains, and third-party web services.(Citation: TrendmicroHid | | mains, and third-party web services.(Citation: TrendmicroHid |
| eoutsLease) Additionally, botnets are available for rent or | | eoutsLease) Additionally, botnets are available for rent or |
| purchase. Use of these infrastructure solutions allows an a | | purchase. Use of these infrastructure solutions allows adve |
| dversary to stage, launch, and execute an operation. Solutio | | rsaries to stage, launch, and execute operations. Solutions |
| ns may help adversary operations blend in with traffic that | | may help adversary operations blend in with traffic that is |
| is seen as normal, such as contact to third-party web servic | | seen as normal, such as contacting third-party web services |
| es. Depending on the implementation, adversaries may use inf | | or acquiring infrastructure to support [Proxy](https://attac |
| rastructure that makes it difficult to physically tie back t | | k.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus |
| o them as well as utilize infrastructure that can be rapidly | | ) Depending on the implementation, adversaries may use infra |
| provisioned, modified, and shut down. | | structure that makes it difficult to physically tie back to |
| | | them as well as utilize infrastructure that can be rapidly p |
| | | rovisioned, modified, and shut down. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_contributors | | ['Shailesh Tiwary (Indian Army)'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 15:45:02.209000+00:00 | 2023-03-02 21:34:46.139000+00:00 |
| description | Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.
Use of these infrastructure solutions allows an adversary to stage, launch, and execute an operation. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contact to third-party web services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. | Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.
Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. |
| external_references[1]['source_name'] | TrendmicroHideoutsLease | amnesty_nso_pegasus |
| external_references[1]['description'] | Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017. | Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022. |
| external_references[1]['url'] | https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf | https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ |
| external_references[2]['source_name'] | ThreatConnect Infrastructure Dec 2020 | Koczwara Beacon Hunting Sep 2021 |
| external_references[2]['description'] | ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021. | Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021. |
| external_references[2]['url'] | https://threatconnect.com/blog/infrastructure-research-hunting/ | https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2 |
| external_references[3]['source_name'] | Mandiant SCANdalous Jul 2020 | TrendmicroHideoutsLease |
| external_references[3]['description'] | Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021. | Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017. |
| external_references[3]['url'] | https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation | https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf |
| external_references[4]['source_name'] | Koczwara Beacon Hunting Sep 2021 | Mandiant SCANdalous Jul 2020 |
| external_references[4]['description'] | Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021. | Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021. |
| external_references[4]['url'] | https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2 | https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation |
| x_mitre_data_sources[1] | Domain Name: Domain Registration | Domain Name: Active DNS |
| x_mitre_data_sources[4] | Domain Name: Active DNS | Domain Name: Domain Registration |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ThreatConnect Infrastructure Dec 2020', 'description': 'ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.', 'url': 'https://threatconnect.com/blog/infrastructure-research-hunting/'} |
[T1098.001] Account Manipulation: Additional Cloud Credentials
Current version: 2.5
Version changed from: 2.4 → 2.5
|
|
|---|
| t | Adversaries may add adversary-controlled credentials to a cl | t | Adversaries may add adversary-controlled credentials to a cl |
| oud account to maintain persistent access to victim accounts | | oud account to maintain persistent access to victim accounts |
| and instances within the environment. For example, adversa | | and instances within the environment. For example, adversa |
| ries may add credentials for Service Principals and Applicat | | ries may add credentials for Service Principals and Applicat |
| ions in addition to existing legitimate credentials in Azure | | ions in addition to existing legitimate credentials in Azure |
| AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat | | AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat |
| ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide | | ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide |
| o) These credentials include both x509 keys and passwords.(C | | o) These credentials include both x509 keys and passwords.(C |
| itation: Microsoft SolarWinds Customer Guidance) With suffic | | itation: Microsoft SolarWinds Customer Guidance) With suffic |
| ient permissions, there are a variety of ways to add credent | | ient permissions, there are a variety of ways to add credent |
| ials including the Azure Portal, Azure command line interfac | | ials including the Azure Portal, Azure command line interfac |
| e, and Azure or Az PowerShell modules.(Citation: Demystifyin | | e, and Azure or Az PowerShell modules.(Citation: Demystifyin |
| g Azure AD Service Principals) In infrastructure-as-a-servi | | g Azure AD Service Principals) In infrastructure-as-a-servi |
| ce (IaaS) environments, after gaining access through [Cloud | | ce (IaaS) environments, after gaining access through [Cloud |
| Accounts](https://attack.mitre.org/techniques/T1078/004), ad | | Accounts](https://attack.mitre.org/techniques/T1078/004), ad |
| versaries may generate or import their own SSH keys using ei | | versaries may generate or import their own SSH keys using ei |
| ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ | | ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ |
| code> API in AWS or the <code>gcloud compute os-login ssh-ke | | code> API in AWS or the <code>gcloud compute os-login ssh-ke |
| ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi | | ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi |
| s allows persistent access to instances within the cloud env | | s allows persistent access to instances within the cloud env |
| ironment without further usage of the compromised cloud acco | | ironment without further usage of the compromised cloud acco |
| unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind | | unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind |
| the Scenes) Adversaries may also use the <code>CreateAcces | | the Scenes) Adversaries may also use the <code>CreateAcces |
| sKey</code> API in AWS or the <code>gcloud iam service-accou | | sKey</code> API in AWS or the <code>gcloud iam service-accou |
| nts keys create</code> command in GCP to add access keys to | | nts keys create</code> command in GCP to add access keys to |
| an account. If the target account has different permissions | | an account. If the target account has different permissions |
| from the requesting account, the adversary may also be able | | from the requesting account, the adversary may also be able |
| to escalate their privileges in the environment (i.e. [Cloud | | to escalate their privileges in the environment (i.e. [Cloud |
| Accounts](https://attack.mitre.org/techniques/T1078/004)).( | | Accounts](https://attack.mitre.org/techniques/T1078/004)).( |
| Citation: Rhino Security Labs AWS Privilege Escalation) | | Citation: Rhino Security Labs AWS Privilege Escalation) In |
| | | AWS environments, adversaries with the appropriate permissio |
| | | ns may also use the `sts:GetFederationToken` API call to cre |
| | | ate a temporary set of credentials tied to the permissions o |
| | | f the original user account. These credentials may remain va |
| | | lid for the duration of their lifetime even if the original |
| | | account’s API credentials are deactivated. (Citation: Crowds |
| | | trike AWS User Federation Persistence) |
Dropped Detections:
- DS0026: Active Directory (Active Directory Object Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-24 15:20:47.020000+00:00 | 2023-04-12 21:30:31.151000+00:00 |
| description | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence) |
| external_references[1]['source_name'] | Expel IO Evil in AWS | Crowdstrike AWS User Federation Persistence |
| external_references[1]['description'] | A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020. | Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023. |
| external_references[1]['url'] | https://expel.io/blog/finding-evil-in-aws/ | https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/ |
| external_references[2]['source_name'] | Demystifying Azure AD Service Principals | Expel IO Evil in AWS |
| external_references[2]['description'] | Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020. | A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020. |
| external_references[2]['url'] | https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/ | https://expel.io/blog/finding-evil-in-aws/ |
| external_references[3]['source_name'] | GCP SSH Key Add | Demystifying Azure AD Service Principals |
| external_references[3]['description'] | Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020. | Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020. |
| external_references[3]['url'] | https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add | https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/ |
| external_references[4]['source_name'] | Blue Cloud of Death Video | GCP SSH Key Add |
| external_references[4]['description'] | Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019. | Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020. |
| external_references[4]['url'] | https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815 | https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add |
| external_references[5]['source_name'] | Blue Cloud of Death | Blue Cloud of Death Video |
| external_references[5]['description'] | Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019. | Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019. |
| external_references[5]['url'] | https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1 | https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815 |
| external_references[6]['source_name'] | Microsoft SolarWinds Customer Guidance | Blue Cloud of Death |
| external_references[6]['description'] | MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020. | Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019. |
| external_references[6]['url'] | https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ | https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1 |
| external_references[7]['source_name'] | Expel Behind the Scenes | Microsoft SolarWinds Customer Guidance |
| external_references[7]['description'] | S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020. | MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020. |
| external_references[7]['url'] | https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/ | https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/ |
| external_references[8]['source_name'] | Rhino Security Labs AWS Privilege Escalation | Expel Behind the Scenes |
| external_references[8]['description'] | Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022. | S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020. |
| external_references[8]['url'] | https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ | https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Rhino Security Labs AWS Privilege Escalation', 'description': 'Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.', 'url': 'https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/'} |
| x_mitre_contributors | | Dylan |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Active Directory: Active Directory Object Modification | |
[T1098.003] Account Manipulation: Additional Cloud Roles
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-24 15:21:19.955000+00:00 | 2023-04-14 22:48:50.142000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 2.1 | 2.2 |
[T1546.010] Event Triggered Execution: AppInit DLLs
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-11-10 18:29:31.076000+00:00 | 2023-04-21 12:33:45.568000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Windows Registry: Windows Registry Key Modification |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Windows Registry: Windows Registry Key Modification | |
[T1550.001] Use Alternate Authentication Material: Application Access Token
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may use stolen application access tokens to bypa | t | Adversaries may use stolen application access tokens to bypa |
| ss the typical authentication process and access restricted | | ss the typical authentication process and access restricted |
| accounts, information, or services on remote systems. These | | accounts, information, or services on remote systems. These |
| tokens are typically stolen from users or services and used | | tokens are typically stolen from users or services and used |
| in lieu of login credentials. Application access tokens are | | in lieu of login credentials. Application access tokens are |
| used to make authorized API requests on behalf of a user or | | used to make authorized API requests on behalf of a user or |
| service and are commonly used as a way to access resources | | service and are commonly used to access resources in cloud, |
| in cloud and container-based applications and software-as-a- | | container-based applications, and software-as-a-service (Sa |
| service (SaaS).(Citation: Auth0 - Why You Should Always Use | | aS).(Citation: Auth0 - Why You Should Always Use Access Toke |
| Access Tokens to Secure APIs Sept 2019) In AWS and GCP env | | ns to Secure APIs Sept 2019) OAuth is one commonly impleme |
| ironments, adversaries can trigger a request for a short-liv | | nted framework that issues tokens to users for access to sys |
| ed access token with the privileges of another user account. | | tems. These frameworks are used collaboratively to verify th |
| (Citation: Google Cloud Service Account Credentials)(Citatio | | e user and determine what actions the user is allowed to per |
| n: AWS Temporary Security Credentials) The adversary can the | | form. Once identity is established, the token allows actions |
| n use this token to request data or perform actions the orig | | to be authorized, without passing the actual credentials of |
| inal account could not. If permissions for this feature are | | the user. Therefore, compromise of the token can grant the |
| misconfigured – for example, by allowing all users to reques | | adversary access to resources of other sites through a malic |
| t a token for a particular account - an adversary may be abl | | ious application.(Citation: okta) For example, with a cloud |
| e to gain initial access to a Cloud Account or escalate thei | | -based email service, once an OAuth access token is granted |
| r privileges.(Citation: Rhino Security Labs Enumerating AWS | | to a malicious application, it can potentially gain long-ter |
| Roles) OAuth is one commonly implemented framework that iss | | m access to features of the user account if a "refresh" toke |
| ues tokens to users for access to systems. These frameworks | | n enabling background access is awarded.(Citation: Microsoft |
| are used collaboratively to verify the user and determine wh | | Identity Platform Access 2019) With an OAuth access token a |
| at actions the user is allowed to perform. Once identity is | | n adversary can use the user-granted REST API to perform fun |
| established, the token allows actions to be authorized, with | | ctions such as email searching and contact enumeration.(Cita |
| out passing the actual credentials of the user. Therefore, c | | tion: Staaldraad Phishing with OAuth 2017) Compromised acce |
| ompromise of the token can grant the adversary access to res | | ss tokens may be used as an initial step in compromising oth |
| ources of other sites through a malicious application.(Citat | | er services. For example, if a token grants access to a vict |
| ion: okta) For example, with a cloud-based email service on | | im’s primary email, the adversary may be able to extend acce |
| ce an OAuth access token is granted to a malicious applicati | | ss to all other services which the target subscribes by trig |
| on, it can potentially gain long-term access to features of | | gering forgotten password routines. In AWS and GCP environme |
| the user account if a "refresh" token enabling background ac | | nts, adversaries can trigger a request for a short-lived acc |
| cess is awarded.(Citation: Microsoft Identity Platform Acces | | ess token with the privileges of another user account.(Citat |
| s 2019) With an OAuth access token an adversary can use the | | ion: Google Cloud Service Account Credentials)(Citation: AWS |
| user-granted REST API to perform functions such as email sea | | Temporary Security Credentials) The adversary can then use |
| rching and contact enumeration.(Citation: Staaldraad Phishin | | this token to request data or perform actions the original a |
| g with OAuth 2017) Compromised access tokens may be used as | | ccount could not. If permissions for this feature are miscon |
| an initial step in compromising other services. For example | | figured – for example, by allowing all users to request a to |
| , if a token grants access to a victim’s primary email, the | | ken for a particular account - an adversary may be able to g |
| adversary may be able to extend access to all other services | | ain initial access to a Cloud Account or escalate their priv |
| which the target subscribes by triggering forgotten passwor | | ileges.(Citation: Rhino Security Labs Enumerating AWS Roles) |
| d routines. Direct API access through a token negates the ef | | Direct API access through a token negates the effectivenes |
| fectiveness of a second authentication factor and may be imm | | s of a second authentication factor and may be immune to int |
| une to intuitive countermeasures like changing passwords. Ac | | uitive countermeasures like changing passwords. For example |
| cess abuse over an API channel can be difficult to detect ev | | , in AWS environments, an adversary who compromises a user’s |
| en from the service provider end, as the access can still al | | AWS API credentials may be able to use the `sts:GetFederati |
| ign well with a legitimate workflow. | | onToken` API call to create a federated user session, which |
| | | will have the same permissions as the original user but may |
| | | persist even if the original user credentials are deactivate |
| | | d.(Citation: Crowdstrike AWS User Federation Persistence) Ad |
| | | ditionally, access abuse over an API channel can be difficul |
| | | t to detect even from the service provider end, as the acces |
| | | s can still align well with a legitimate workflow. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-593 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 17:01:05.286000+00:00 | 2023-04-15 00:29:43.297000+00:00 |
| description | Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)
In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)
OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)
For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)
Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. | Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)
OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)
For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)
Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)
Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow. |
| external_references[1]['source_name'] | Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019 | Crowdstrike AWS User Federation Persistence |
| external_references[1]['description'] | Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019. | Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023. |
| external_references[1]['url'] | https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/ | https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/ |
| external_references[2]['source_name'] | AWS Logging IAM Calls | Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019 |
| external_references[2]['description'] | AWS. (n.d.). Logging IAM and AWS STS API calls with AWS CloudTrail. Retrieved April 1, 2022. | Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019. |
| external_references[2]['url'] | https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html | https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/ |
| external_references[3]['source_name'] | AWS Temporary Security Credentials | AWS Logging IAM Calls |
| external_references[3]['description'] | AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022. | AWS. (n.d.). Logging IAM and AWS STS API calls with AWS CloudTrail. Retrieved April 1, 2022. |
| external_references[3]['url'] | https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html | https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html |
| external_references[4]['source_name'] | Microsoft Identity Platform Access 2019 | AWS Temporary Security Credentials |
| external_references[4]['description'] | Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019. | AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens | https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html |
| external_references[5]['source_name'] | Google Cloud Service Account Credentials | Microsoft Identity Platform Access 2019 |
| external_references[5]['description'] | Google Cloud. (2022, March 31). Creating short-lived service account credentials. Retrieved April 1, 2022. | Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019. |
| external_references[5]['url'] | https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials | https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens |
| external_references[6]['source_name'] | GCP Monitoring Service Account Usage | Google Cloud Service Account Credentials |
| external_references[6]['description'] | Google Cloud. (2022, March 31). Monitor usage patterns for service accounts and keys . Retrieved April 1, 2022. | Google Cloud. (2022, March 31). Creating short-lived service account credentials. Retrieved April 1, 2022. |
| external_references[6]['url'] | https://cloud.google.com/iam/docs/service-account-monitoring | https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials |
| external_references[7]['source_name'] | okta | GCP Monitoring Service Account Usage |
| external_references[7]['description'] | okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019. | Google Cloud. (2022, March 31). Monitor usage patterns for service accounts and keys . Retrieved April 1, 2022. |
| external_references[7]['url'] | https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen | https://cloud.google.com/iam/docs/service-account-monitoring |
| external_references[8]['source_name'] | Rhino Security Labs Enumerating AWS Roles | okta |
| external_references[8]['description'] | Spencer Gietzen. (2018, August 8). Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’. Retrieved April 1, 2022. | okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019. |
| external_references[8]['url'] | https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration | https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen |
| external_references[9]['source_name'] | Staaldraad Phishing with OAuth 2017 | Rhino Security Labs Enumerating AWS Roles |
| external_references[9]['description'] | Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019. | Spencer Gietzen. (2018, August 8). Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’. Retrieved April 1, 2022. |
| external_references[9]['url'] | https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/ | https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration |
| external_references[10]['source_name'] | capec | Staaldraad Phishing with OAuth 2017 |
| external_references[10]['url'] | https://capec.mitre.org/data/definitions/593.html | https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Dylan |
[T1071] Application Layer Protocol
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | Adversaries may communicate using application layer protocol | t | Adversaries may communicate using OSI application layer prot |
| s to avoid detection/network filtering by blending in with e | | ocols to avoid detection/network filtering by blending in wi |
| xisting traffic. Commands to the remote system, and often th | | th existing traffic. Commands to the remote system, and ofte |
| e results of those commands, will be embedded within the pro | | n the results of those commands, will be embedded within the |
| tocol traffic between the client and server. Adversaries m | | protocol traffic between the client and server. Adversari |
| ay utilize many different protocols, including those used fo | | es may utilize many different protocols, including those use |
| r web browsing, transferring files, electronic mail, or DNS. | | d for web browsing, transferring files, electronic mail, or |
| For connections that occur internally within an enclave (su | | DNS. For connections that occur internally within an enclave |
| ch as those between a proxy or pivot node and other nodes), | | (such as those between a proxy or pivot node and other node |
| commonly used protocols are SMB, SSH, or RDP. | | s), commonly used protocols are SMB, SSH, or RDP. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_contributors | | ['Duane Michael'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 16:35:45.986000+00:00 | 2023-04-11 14:35:41.468000+00:00 |
| description | Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. | Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Flow | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Content | Network Traffic: Network Traffic Flow |
| x_mitre_version | 2.0 | 2.1 |
[T1010] Application Window Discovery
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may attempt to get a listing of open application | t | Adversaries may attempt to get a listing of open application |
| windows. Window listings could convey information about how | | windows. Window listings could convey information about how |
| the system is used or give context to information collected | | the system is used.(Citation: Prevailion DarkWatchman 2021) |
| by a keylogger.(Citation: Prevailion DarkWatchman 2021) | | For example, information about application windows could be |
| | | used identify potential data to collect as well as identify |
| | | ing security tooling ([Security Software Discovery](https:// |
| | | attack.mitre.org/techniques/T1518/001)) to evade.(Citation: |
| | | ESET Grandoreiro April 2020) Adversaries typically abuse sy |
| | | stem features for this type of enumeration. For example, the |
| | | y may gather information through native system features such |
| | | as [Command and Scripting Interpreter](https://attack.mitre |
| | | .org/techniques/T1059) commands and [Native API](https://att |
| | | ack.mitre.org/techniques/T1106) functions. |
Dropped Mitigations:
- T1010: Application Window Discovery Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 02:07:41.751000+00:00 | 2023-04-15 16:46:04.776000+00:00 |
| description | Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.(Citation: Prevailion DarkWatchman 2021) | Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)
Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions. |
| external_references[1]['source_name'] | Prevailion DarkWatchman 2021 | ESET Grandoreiro April 2020 |
| external_references[1]['description'] | Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022. | ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020. |
| external_references[1]['url'] | https://www.prevailion.com/darkwatchman-new-fileless-techniques/ | https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Prevailion DarkWatchman 2021', 'description': 'Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.', 'url': 'https://www.prevailion.com/darkwatchman-new-fileless-techniques/'} |
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1560.001] Archive Collected Data: Archive via Utility
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use utilities to compress and/or encrypt col | t | Adversaries may use utilities to compress and/or encrypt col |
| lected data prior to exfiltration. Many utilities include fu | | lected data prior to exfiltration. Many utilities include fu |
| nctionalities to compress, encrypt, or otherwise package dat | | nctionalities to compress, encrypt, or otherwise package dat |
| a into a format that is easier/more secure to transport. Ad | | a into a format that is easier/more secure to transport. Ad |
| versaries may abuse various utilities to compress or encrypt | | versaries may abuse various utilities to compress or encrypt |
| data before exfiltration. Some third party utilities may be | | data before exfiltration. Some third party utilities may be |
| preinstalled, such as <code>tar</code> on Linux and macOS o | | preinstalled, such as <code>tar</code> on Linux and macOS o |
| r <code>zip</code> on Windows systems. On Windows, <code>dia | | r <code>zip</code> on Windows systems. On Windows, <code>d |
| ntz</code> or <code> makecab</code> may be used to package c | | iantz</code> or <code> makecab</code> may be used to package |
| ollected files into a cabinet (.cab) file. <code>diantz</cod | | collected files into a cabinet (.cab) file. <code>diantz</c |
| e> may also be used to download and compress files from remo | | ode> may also be used to download and compress files from re |
| te locations (i.e. [Remote Data Staging](https://attack.mitr | | mote locations (i.e. [Remote Data Staging](https://attack.mi |
| e.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) A | | tre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) |
| dditionally, <code>xcopy</code> on Windows can copy files an | | <code>xcopy</code> on Windows can copy files and directorie |
| d directories with a variety of options. Adversaries may us | | s with a variety of options. Additionally, adversaries may u |
| e also third party utilities, such as 7-Zip, WinRAR, and Win | | se [certutil](https://attack.mitre.org/software/S0160) to Ba |
| Zip, to perform similar activities.(Citation: 7zip Homepage) | | se64 encode collected data before exfiltration. Adversarie |
| (Citation: WinRAR Homepage)(Citation: WinZip Homepage) | | s may use also third party utilities, such as 7-Zip, WinRAR, |
| | | and WinZip, to perform similar activities.(Citation: 7zip H |
| | | omepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepag |
| | | e) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 17:17:48.612000+00:00 | 2023-04-14 19:28:21.394000+00:00 |
| description | Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) Additionally, xcopy on Windows can copy files and directories with a variety of options.
Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage) | Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.
On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration.
Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage) |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Command: Command Execution | File: File Creation |
| x_mitre_data_sources[2] | File: File Creation | Command: Command Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Mark Wee |
[T1197] BITS Jobs
Current version: 1.4
Version changed from: 1.3 → 1.4
Dropped Mitigations:
- T1197: BITS Jobs Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-09-14 19:21:26.447000+00:00 | 2023-04-21 12:21:40.927000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1110] Brute Force
Current version: 2.5
Version changed from: 2.4 → 2.5
Dropped Mitigations:
- T1110: Brute Force Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 21:28:49.481000+00:00 | 2023-04-14 23:03:34.362000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | User Account: User Account Authentication | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Application Log: Application Log Content | User Account: User Account Authentication |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/49.html', 'external_id': 'CAPEC-49'} | |
[T1612] Build Image on Host
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may build a container image directly on a host t | t | Adversaries may build a container image directly on a host t |
| o bypass defenses that monitor for the retrieval of maliciou | | o bypass defenses that monitor for the retrieval of maliciou |
| s images from a public registry. A remote <code>build</code> | | s images from a public registry. A remote <code>build</code> |
| request may be sent to the Docker API that includes a Docke | | request may be sent to the Docker API that includes a Docke |
| rfile that pulls a vanilla base image, such as alpine, from | | rfile that pulls a vanilla base image, such as alpine, from |
| a public or local registry and then builds a custom image up | | a public or local registry and then builds a custom image up |
| on it.(Citation: Docker Build Image) An adversary may take | | on it.(Citation: Docker Build Image) An adversary may take |
| advantage of that <code>build</code> API to build a custom i | | advantage of that <code>build</code> API to build a custom i |
| mage on the host that includes malware downloaded from their | | mage on the host that includes malware downloaded from their |
| C2 server, and then they then may utilize [Deploy Container | | C2 server, and then they may utilize [Deploy Container](htt |
| ](https://attack.mitre.org/techniques/T1610) using that cust | | ps://attack.mitre.org/techniques/T1610) using that custom im |
| om image.(Citation: Aqua Build Images on Hosts)(Citation: Aq | | age.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Se |
| ua Security Cloud Native Threat Report June 2021) If the bas | | curity Cloud Native Threat Report June 2021) If the base ima |
| e image is pulled from a public registry, defenses will like | | ge is pulled from a public registry, defenses will likely no |
| ly not detect the image as malicious since it’s a vanilla im | | t detect the image as malicious since it’s a vanilla image. |
| age. If the base image already resides in a local registry, | | If the base image already resides in a local registry, the p |
| the pull may be considered even less suspicious since the im | | ull may be considered even less suspicious since the image i |
| age is already in the environment. | | s already in the environment. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:04:00.946000+00:00 | 2023-04-15 16:22:09.807000+00:00 |
| description | Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)
An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. | Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)
An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. |
| external_references[1]['source_name'] | Docker Build Image | Aqua Build Images on Hosts |
| external_references[1]['description'] | Docker. ( null). Docker Engine API v1.41 Reference - Build an Image. Retrieved March 30, 2021. | Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021. |
| external_references[1]['url'] | https://docs.docker.com/engine/api/v1.41/#operation/ImageBuild | https://blog.aquasec.com/malicious-container-image-docker-container-host |
| external_references[2]['source_name'] | Aqua Build Images on Hosts | Docker Build Image |
| external_references[2]['description'] | Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021. | Docker. ( null). Docker Engine API v1.41 Reference - Build an Image. Retrieved March 30, 2021. |
| external_references[2]['url'] | https://blog.aquasec.com/malicious-container-image-docker-container-host | https://docs.docker.com/engine/api/v1.41/#operation/ImageBuild |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Content | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[1] | Image: Image Creation | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[2] | Network Traffic: Network Traffic Flow | Image: Image Creation |
| x_mitre_data_sources[3] | Network Traffic: Network Connection Creation | Network Traffic: Network Traffic Content |
| x_mitre_version | 1.2 | 1.3 |
[T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 15:11:20.036000+00:00 | 2023-04-21 12:35:39.112000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Command: Command Execution |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1218.003] System Binary Proxy Execution: CMSTP
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-11 18:38:36.109000+00:00 | 2023-04-21 12:24:13.666000+00:00 |
| external_references[1]['source_name'] | Microsoft Connection Manager Oct 2009 | Twitter CMSTP Usage Jan 2018 |
| external_references[1]['description'] | Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018. | Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018. |
| external_references[1]['url'] | https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10) | https://twitter.com/ItsReallyNick/status/958789644165894146 |
| external_references[2]['source_name'] | Twitter CMSTP Usage Jan 2018 | Microsoft Connection Manager Oct 2009 |
| external_references[2]['description'] | Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018. | Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018. |
| external_references[2]['url'] | https://twitter.com/ItsReallyNick/status/958789644165894146 | https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10) |
| external_references[4]['source_name'] | Twitter CMSTP Jan 2018 | GitHub Ultimate AppLocker Bypass List |
| external_references[4]['description'] | Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018. | Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018. |
| external_references[4]['url'] | https://twitter.com/NickTyrer/status/958450014111633408 | https://github.com/api0cradle/UltimateAppLockerByPassList |
| external_references[5]['source_name'] | GitHub Ultimate AppLocker Bypass List | Endurant CMSTP July 2018 |
| external_references[5]['description'] | Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018. | Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018. |
| external_references[5]['url'] | https://github.com/api0cradle/UltimateAppLockerByPassList | http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ |
| external_references[6]['source_name'] | Endurant CMSTP July 2018 | Twitter CMSTP Jan 2018 |
| external_references[6]['description'] | Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018. | Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018. |
| external_references[6]['url'] | http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ | https://twitter.com/NickTyrer/status/958450014111633408 |
| x_mitre_version | 2.0 | 2.1 |
[T1070.003] Indicator Removal: Clear Command History
Current version: 1.4
Version changed from: 1.3 → 1.4
Dropped Mitigations:
- T1146: Clear Command History Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-09-01 21:58:56.496000+00:00 | 2023-04-07 17:20:44.770000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | File: File Modification | User Account: User Account Authentication |
| x_mitre_data_sources[1] | File: File Deletion | Command: Command Execution |
| x_mitre_data_sources[2] | User Account: User Account Authentication | File: File Deletion |
| x_mitre_data_sources[3] | Command: Command Execution | File: File Modification |
| x_mitre_version | 1.3 | 1.4 |
[T1070.008] Indicator Removal: Clear Mailbox Data
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify mail application data to remove evide | t | Adversaries may modify mail and mail application data to rem |
| nce of their activity. Email applications allow users and ot | | ove evidence of their activity. Email applications allow use |
| her programs to export and delete mailbox data via command l | | rs and other programs to export and delete mailbox data via |
| ine tools or use of APIs. Mail application data can be email | | command line tools or use of APIs. Mail application data can |
| s or logs generated by the application or operating system, | | be emails, email metadata, or logs generated by the applica |
| such as export requests. Adversaries may manipulate email | | tion or operating system, such as export requests. Adversa |
| mailbox data to remove logs and artifacts, such as evidence | | ries may manipulate emails and mailbox data to remove logs, |
| of [Phishing](https://attack.mitre.org/techniques/T1566)/[In | | artifacts, and metadata, such as evidence of [Phishing](http |
| ternal Spearphishing](https://attack.mitre.org/techniques/T1 | | s://attack.mitre.org/techniques/T1566)/[Internal Spearphishi |
| 534), [Email Collection](https://attack.mitre.org/techniques | | ng](https://attack.mitre.org/techniques/T1534), [Email Colle |
| /T1114), [Mail Protocols](https://attack.mitre.org/technique | | ction](https://attack.mitre.org/techniques/T1114), [Mail Pro |
| s/T1071/003) for command and control, or email-based exfiltr | | tocols](https://attack.mitre.org/techniques/T1071/003) for c |
| ation such as [Exfiltration Over Alternative Protocol](https | | ommand and control, or email-based exfiltration such as [Exf |
| ://attack.mitre.org/techniques/T1048). For example, to remov | | iltration Over Alternative Protocol](https://attack.mitre.or |
| e evidence on Exchange servers adversaries have used the <co | | g/techniques/T1048). For example, to remove evidence on Exch |
| de>ExchangePowerShell</code> [PowerShell](https://attack.mit | | ange servers adversaries have used the <code>ExchangePowerSh |
| re.org/techniques/T1059/001) module, including <code>Remove- | | ell</code> [PowerShell](https://attack.mitre.org/techniques/ |
| MailboxExportRequest</code> to remove evidence of mailbox ex | | T1059/001) module, including <code>Remove-MailboxExportReque |
| ports.(Citation: Volexity SolarWinds)(Citation: ExchangePowe | | st</code> to remove evidence of mailbox exports.(Citation: V |
| rShell Module) On Linux and macOS, adversaries may also dele | | olexity SolarWinds)(Citation: ExchangePowerShell Module) On |
| te emails through a command line utility called <code>mail</ | | Linux and macOS, adversaries may also delete emails through |
| code> or use [AppleScript](https://attack.mitre.org/techniq | | a command line utility called <code>mail</code> or use [App |
| ues/T1059/002) to interact with APIs on macOS.(Citation: Cyb | | leScript](https://attack.mitre.org/techniques/T1059/002) to |
| ereason Cobalt Kitty 2017)(Citation: mailx man page) | | interact with APIs on macOS.(Citation: Cybereason Cobalt Kit |
| | | ty 2017)(Citation: mailx man page) Adversaries may also rem |
| | | ove emails and metadata/headers indicative of spam or suspic |
| | | ious activity (for example, through the use of organization- |
| | | wide transport rules) to reduce the likelihood of malicious |
| | | emails being detected by security products.(Citation: Micros |
| | | oft OAuth Spam 2022) |
New Mitigations:
New Detections:
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Liran Ravich, CardinalOps'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-17 17:41:43.552000+00:00 | 2023-04-12 20:56:32.743000+00:00 |
| description | Adversaries may modify mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate email mailbox data to remove logs and artifacts, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page) | Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page)
Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.(Citation: Microsoft OAuth Spam 2022) |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft OAuth Spam 2022', 'description': 'Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023.', 'url': 'https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/'} |
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_data_sources | | Application Log: Application Log Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
[T1070.009] Indicator Removal: Clear Persistence
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may clear artifacts associated with previously e | t | Adversaries may clear artifacts associated with previously e |
| stablished persistence on a host system to remove evidence o | | stablished persistence on a host system to remove evidence o |
| f their activity. This may involve various actions, such as | | f their activity. This may involve various actions, such as |
| removing services, deleting executables, [Modify Registry](h | | removing services, deleting executables, [Modify Registry](h |
| ttps://attack.mitre.org/techniques/T1112), [Plist File Modif | | ttps://attack.mitre.org/techniques/T1112), [Plist File Modif |
| ication](https://attack.mitre.org/techniques/T1647), or othe | | ication](https://attack.mitre.org/techniques/T1647), or othe |
| r methods of cleanup to prevent defenders from collecting ev | | r methods of cleanup to prevent defenders from collecting ev |
| idence of their persistent presence.(Citation: Cylance Dust | | idence of their persistent presence.(Citation: Cylance Dust |
| Storm) In some instances, artifacts of persistence may also | | Storm) Adversaries may also delete accounts previously creat |
| be removed once an adversary’s persistence is executed in o | | ed to maintain persistence (i.e. [Create Account](https://at |
| rder to prevent errors with the new instance of the malware. | | tack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco A |
| (Citation: NCC Group Team9 June 2020) | | ttack 2022) In some instances, artifacts of persistence may |
| | | also be removed once an adversary’s persistence is executed |
| | | in order to prevent errors with the new instance of the mal |
| | | ware.(Citation: NCC Group Team9 June 2020) |
New Detections:
- DS0002: User Account (User Account Deletion)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Gavin Knapp'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-18 23:40:32.055000+00:00 | 2023-04-11 22:30:01.227000+00:00 |
| description | Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm)
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020) | Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)
In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020) |
| external_references[2]['source_name'] | NCC Group Team9 June 2020 | Talos - Cisco Attack 2022 |
| external_references[2]['description'] | Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020. | Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023. |
| external_references[2]['url'] | https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/ | https://blog.talosintelligence.com/recent-cyber-attack/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[7] | Windows Registry: Windows Registry Key Deletion | User Account: User Account Deletion |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'NCC Group Team9 June 2020', 'description': 'Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.', 'url': 'https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/'} |
| x_mitre_data_sources | | Command: Command Execution |
| x_mitre_data_sources | | Windows Registry: Windows Registry Key Deletion |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Command: Command Execution | |
[T1070.001] Indicator Removal: Clear Windows Event Logs
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may clear Windows Event Logs to hide the activit | t | Adversaries may clear Windows Event Logs to hide the activit |
| y of an intrusion. Windows Event Logs are a record of a comp | | y of an intrusion. Windows Event Logs are a record of a comp |
| uter's alerts and notifications. There are three system-defi | | uter's alerts and notifications. There are three system-defi |
| ned sources of events: System, Application, and Security, wi | | ned sources of events: System, Application, and Security, wi |
| th five event types: Error, Warning, Information, Success Au | | th five event types: Error, Warning, Information, Success Au |
| dit, and Failure Audit. The event logs can be cleared with | | dit, and Failure Audit. The event logs can be cleared with |
| the following utility commands: * <code>wevtutil cl system< | | the following utility commands: * <code>wevtutil cl system< |
| /code> * <code>wevtutil cl application</code> * <code>wevtut | | /code> * <code>wevtutil cl application</code> * <code>wevtut |
| il cl security</code> These logs may also be cleared throug | | il cl security</code> These logs may also be cleared throug |
| h other mechanisms, such as the event viewer GUI or [PowerSh | | h other mechanisms, such as the event viewer GUI or [PowerSh |
| ell](https://attack.mitre.org/techniques/T1059/001). | | ell](https://attack.mitre.org/techniques/T1059/001). For exa |
| | | mple, adversaries may use the PowerShell command <code>Remov |
| | | e-EventLog -LogName Security</code> to delete the Security E |
| | | ventLog and after reboot, disable future logging. Note: even |
| | | ts may still be generated and logged in the .evtx file betwe |
| | | en the time the command is run and the reboot.(Citation: dis |
| | | able_win_evt_logging) |
Dropped Mitigations:
- T1070: Indicator Removal on Host Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Lucas Heiligenstein'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 13:02:07.168000+00:00 | 2023-04-12 15:32:03.205000+00:00 |
| description | Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
The event logs can be cleared with the following utility commands:
* wevtutil cl system
* wevtutil cl application
* wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). | Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
The event logs can be cleared with the following utility commands:
* wevtutil cl system
* wevtutil cl application
* wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) |
| external_references[1]['source_name'] | Microsoft Clear-EventLog | disable_win_evt_logging |
| external_references[1]['description'] | Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018. | Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022. |
| external_references[1]['url'] | https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog | https://ptylu.github.io/content/report/report.html?report=25 |
| external_references[2]['source_name'] | Microsoft EventLog.Clear | Microsoft Clear-EventLog |
| external_references[2]['description'] | Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018. | Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018. |
| external_references[2]['url'] | https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx | https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog |
| external_references[3]['source_name'] | Microsoft wevtutil Oct 2017 | Microsoft EventLog.Clear |
| external_references[3]['description'] | Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018. | Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018. |
| external_references[3]['url'] | https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil | https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Process: OS API Execution | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Process: OS API Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft wevtutil Oct 2017', 'description': 'Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.', 'url': 'https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil'} |
[T1115] Clipboard Data
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may collect data stored in the clipboard from us | t | Adversaries may collect data stored in the clipboard from us |
| ers copying information within or between applications. In | | ers copying information within or between applications. Fo |
| Windows, Applications can access clipboard data by using th | | r example, on Windows adversaries can access clipboard data |
| e Windows API.(Citation: MSDN Clipboard) OSX provides a nati | | by using <code>clip.exe</code> or <code>Get-Clipboard</code> |
| ve command, <code>pbpaste</code>, to grab clipboard contents | | .(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citat |
| .(Citation: Operating with EmPyre) | | ion: CISA_AA21_200B) Additionally, adversaries may monitor t |
| | | hen replace users’ clipboard with their data (e.g., [Transmi |
| | | tted Data Manipulation](https://attack.mitre.org/techniques/ |
| | | T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and |
| | | Linux also have commands, such as <code>pbpaste</code>, to |
| | | grab clipboard contents.(Citation: Operating with EmPyre) |
Dropped Mitigations:
- T1115: Clipboard Data Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| external_references | | CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-637 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-04-23 18:35:58.230000+00:00 | 2023-04-14 21:51:47.277000+00:00 |
| description | Adversaries may collect data stored in the clipboard from users copying information within or between applications.
In Windows, Applications can access clipboard data by using the Windows API.(Citation: MSDN Clipboard) OSX provides a native command, pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre) | Adversaries may collect data stored in the clipboard from users copying information within or between applications.
For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)
macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre) |
| external_references[1]['source_name'] | capec | CISA_AA21_200B |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/637.html | https://www.cisa.gov/uscert/ncas/alerts/aa21-200b |
| external_references[2]['source_name'] | MSDN Clipboard | mining_ruby_reversinglabs |
| external_references[2]['description'] | Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016. | Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022. |
| external_references[2]['url'] | https://msdn.microsoft.com/en-us/library/ms649012 | https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems |
| external_references[3]['source_name'] | Operating with EmPyre | clip_win_server |
| external_references[3]['description'] | rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017. | Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022. |
| external_references[3]['url'] | https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363 | https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'MSDN Clipboard', 'description': 'Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.', 'url': 'https://msdn.microsoft.com/en-us/library/ms649012'} |
| external_references | | {'source_name': 'Operating with EmPyre', 'description': 'rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.', 'url': 'https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363'} |
[T1136.003] Create Account: Cloud Account
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may create a cloud account to maintain access to | t | Adversaries may create a cloud account to maintain access to |
| victim systems. With a sufficient level of access, such acc | | victim systems. With a sufficient level of access, such acc |
| ounts may be used to establish secondary credentialed access | | ounts may be used to establish secondary credentialed access |
| that does not require persistent remote access tools to be | | that does not require persistent remote access tools to be |
| deployed on the system.(Citation: Microsoft O365 Admin Roles | | deployed on the system.(Citation: Microsoft O365 Admin Roles |
| )(Citation: Microsoft Support O365 Add Another Admin, Octobe | | )(Citation: Microsoft Support O365 Add Another Admin, Octobe |
| r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create | | r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create |
| Cloud Identity Users)(Citation: Microsoft Azure AD Users) A | | Cloud Identity Users)(Citation: Microsoft Azure AD Users) A |
| dversaries may create accounts that only have access to spec | | dversaries may create accounts that only have access to spec |
| ific cloud services, which can reduce the chance of detectio | | ific cloud services, which can reduce the chance of detectio |
| n. | | n. Once an adversary has created a cloud account, they can |
| | | then manipulate that account to ensure persistence and allow |
| | | access to additional resources - for example, by adding [Ad |
| | | ditional Cloud Credentials](https://attack.mitre.org/techniq |
| | | ues/T1098/001) or assigning [Additional Cloud Roles](https:/ |
| | | /attack.mitre.org/techniques/T1098/003). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-07 13:09:30.819000+00:00 | 2023-03-06 21:24:56.669000+00:00 |
| description | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003). |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.2 | 1.3 |
[T1078.004] Valid Accounts: Cloud Accounts
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may obtain and abuse credentials of a cloud acco | t | Adversaries may obtain and abuse credentials of a cloud acco |
| unt as a means of gaining Initial Access, Persistence, Privi | | unt as a means of gaining Initial Access, Persistence, Privi |
| lege Escalation, or Defense Evasion. Cloud accounts are thos | | lege Escalation, or Defense Evasion. Cloud accounts are thos |
| e created and configured by an organization for use by users | | e created and configured by an organization for use by users |
| , remote support, services, or for administration of resourc | | , remote support, services, or for administration of resourc |
| es within a cloud service provider or SaaS application. In s | | es within a cloud service provider or SaaS application. In s |
| ome cases, cloud accounts may be federated with traditional | | ome cases, cloud accounts may be federated with traditional |
| identity management system, such as Window Active Directory. | | identity management systems, such as Windows Active Director |
| (Citation: AWS Identity Federation)(Citation: Google Federat | | y.(Citation: AWS Identity Federation)(Citation: Google Feder |
| ing GC)(Citation: Microsoft Deploying AD Federation) Compro | | ating GC)(Citation: Microsoft Deploying AD Federation) Comp |
| mised credentials for cloud accounts can be used to harvest | | romised credentials for cloud accounts can be used to harves |
| sensitive data from online storage accounts and databases. A | | t sensitive data from online storage accounts and databases. |
| ccess to cloud accounts can also be abused to gain Initial A | | Access to cloud accounts can also be abused to gain Initial |
| ccess to a network by abusing a [Trusted Relationship](https | | Access to a network by abusing a [Trusted Relationship](htt |
| ://attack.mitre.org/techniques/T1199). Similar to [Domain Ac | | ps://attack.mitre.org/techniques/T1199). Similar to [Domain |
| counts](https://attack.mitre.org/techniques/T1078/002), comp | | Accounts](https://attack.mitre.org/techniques/T1078/002), co |
| romise of federated cloud accounts may allow adversaries to | | mpromise of federated cloud accounts may allow adversaries t |
| more easily move laterally within an environment. Once a cl | | o more easily move laterally within an environment. Once a |
| oud account is compromised, an adversary may perform [Accoun | | cloud account is compromised, an adversary may perform [Acco |
| t Manipulation](https://attack.mitre.org/techniques/T1098) - | | unt Manipulation](https://attack.mitre.org/techniques/T1098) |
| for example, by adding [Additional Cloud Roles](https://att | | - for example, by adding [Additional Cloud Roles](https://a |
| ack.mitre.org/techniques/T1098/003) - to maintain persistenc | | ttack.mitre.org/techniques/T1098/003) - to maintain persiste |
| e and potentially escalate their privileges. | | nce and potentially escalate their privileges. |
New Mitigations:
- M1015: Active Directory Configuration
- M1036: Account Use Policies
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 20:23:33.894000+00:00 | 2023-03-21 13:17:14.441000+00:00 |
| description | Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)
Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
Once a cloud account is compromised, an adversary may perform [Account Manipulation](https://attack.mitre.org/techniques/T1098) - for example, by adding [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) - to maintain persistence and potentially escalate their privileges. | Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)
Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.
Once a cloud account is compromised, an adversary may perform [Account Manipulation](https://attack.mitre.org/techniques/T1098) - for example, by adding [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) - to maintain persistence and potentially escalate their privileges. |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[1] | User Account: User Account Authentication | Logon Session: Logon Session Creation |
| x_mitre_data_sources[2] | Logon Session: Logon Session Creation | User Account: User Account Authentication |
| x_mitre_version | 1.4 | 1.5 |
[T1069.003] Permission Groups Discovery: Cloud Groups
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may attempt to find cloud groups and permission | t | Adversaries may attempt to find cloud groups and permission |
| settings. The knowledge of cloud permission groups can help | | settings. The knowledge of cloud permission groups can help |
| adversaries determine the particular roles of users and grou | | adversaries determine the particular roles of users and grou |
| ps within an environment, as well as which users are associa | | ps within an environment, as well as which users are associa |
| ted with a particular group. With authenticated access ther | | ted with a particular group. With authenticated access ther |
| e are several tools that can be used to find permissions gro | | e are several tools that can be used to find permissions gro |
| ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be |
| used to obtain roles and permissions groups for Exchange and | | used to obtain roles and permissions groups for Exchange and |
| Office 365 accounts (Citation: Microsoft Msolrole)(Citation | | Office 365 accounts (Citation: Microsoft Msolrole)(Citation |
| : GitHub Raindance). Azure CLI (AZ CLI) and the Google Clou | | : GitHub Raindance). Azure CLI (AZ CLI) and the Google Clou |
| d Identity Provider API also provide interfaces to obtain pe | | d Identity Provider API also provide interfaces to obtain pe |
| rmissions groups. The command <code>az ad user get-member-gr | | rmissions groups. The command <code>az ad user get-member-gr |
| oups</code> will list groups associated to a user account fo | | oups</code> will list groups associated to a user account fo |
| r Azure while the API endpoint <code>GET https://cloudidenti | | r Azure while the API endpoint <code>GET https://cloudidenti |
| ty.googleapis.com/v1/groups</code> lists group resources ava | | ty.googleapis.com/v1/groups</code> lists group resources ava |
| ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit | | ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit |
| ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: | | ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: |
| Google Cloud Identity API Documentation) Adversaries may at | | Google Cloud Identity API Documentation) In AWS, the command |
| tempt to list ACLs for objects to determine the owner and ot | | s `ListRolePolicies` and `ListAttachedRolePolicies` allow us |
| her accounts with access to the object, for example, via the | | ers to enumerate the policies attached to a role.(Citation: |
| AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket | | Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022 |
| ACL). Using this information an adversary can target accoun | | ) Adversaries may attempt to list ACLs for objects to deter |
| ts with permissions to a given object or leverage accounts t | | mine the owner and other accounts with access to the object, |
| hey have already compromised to access the object. | | for example, via the AWS <code>GetBucketAcl</code> API (Cit |
| | | ation: AWS Get Bucket ACL). Using this information an advers |
| | | ary can target accounts with permissions to a given object o |
| | | r leverage accounts they have already compromised to access |
| | | the object. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 02:44:58.838000+00:00 | 2023-03-21 13:33:40.625000+00:00 |
| description | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).
Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)
Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).
Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object. |
| external_references[2]['source_name'] | Black Hills Red Teaming MS AD Azure, 2018 | Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022 |
| external_references[2]['description'] | Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019. | Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023. |
| external_references[2]['url'] | https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/ | https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/ |
| external_references[3]['source_name'] | Google Cloud Identity API Documentation | Black Hills Red Teaming MS AD Azure, 2018 |
| external_references[3]['description'] | Google. (n.d.). Retrieved March 16, 2021. | Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019. |
| external_references[3]['url'] | https://cloud.google.com/identity/docs/reference/rest | https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/ |
| external_references[4]['source_name'] | Microsoft AZ CLI | Google Cloud Identity API Documentation |
| external_references[4]['description'] | Microsoft. (n.d.). az ad user. Retrieved October 6, 2019. | Google. (n.d.). Retrieved March 16, 2021. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest | https://cloud.google.com/identity/docs/reference/rest |
| external_references[5]['source_name'] | Microsoft Msolrole | Microsoft AZ CLI |
| external_references[5]['description'] | Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019. | Microsoft. (n.d.). az ad user. Retrieved October 6, 2019. |
| external_references[5]['url'] | https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0 | https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest |
| external_references[6]['source_name'] | GitHub Raindance | Microsoft Msolrole |
| external_references[6]['description'] | Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019. | Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019. |
| external_references[6]['url'] | https://github.com/True-Demon/raindance | https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Group: Group Enumeration | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Application Log: Application Log Content |
| x_mitre_data_sources[4] | Application Log: Application Log Content | Group: Group Enumeration |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'GitHub Raindance', 'description': 'Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.', 'url': 'https://github.com/True-Demon/raindance'} |
[T1552.005] Unsecured Credentials: Cloud Instance Metadata API
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1035: Limit Access to Resource Over Network
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:37:23.589000+00:00 | 2023-03-21 13:56:27.910000+00:00 |
| external_references[2]['source_name'] | Krebs Capital One August 2019 | RedLock Instance Metadata API 2018 |
| external_references[2]['description'] | Krebs, B.. (2019, August 19). What We Can Learn from the Capital One Hack. Retrieved March 25, 2020. | Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019. |
| external_references[2]['url'] | https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/ | https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse |
| external_references[3]['source_name'] | RedLock Instance Metadata API 2018 | Krebs Capital One August 2019 |
| external_references[3]['description'] | Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019. | Krebs, B.. (2019, August 19). What We Can Learn from the Capital One Hack. Retrieved March 25, 2020. |
| external_references[3]['url'] | https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse | https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/ |
| x_mitre_version | 1.3 | 1.4 |
[T1526] Cloud Service Discovery
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | An adversary may attempt to enumerate the cloud services run | t | An adversary may attempt to enumerate the cloud services run |
| ning on a system after gaining access. These methods can dif | | ning on a system after gaining access. These methods can dif |
| fer from platform-as-a-service (PaaS), to infrastructure-as- | | fer from platform-as-a-service (PaaS), to infrastructure-as- |
| a-service (IaaS), or software-as-a-service (SaaS). Many serv | | a-service (IaaS), or software-as-a-service (SaaS). Many serv |
| ices exist throughout the various cloud providers and can in | | ices exist throughout the various cloud providers and can in |
| clude Continuous Integration and Continuous Delivery (CI/CD) | | clude Continuous Integration and Continuous Delivery (CI/CD) |
| , Lambda Functions, Azure AD, etc. Adversaries may attempt | | , Lambda Functions, Azure AD, etc. They may also include sec |
| to discover information about the services enabled througho | | urity services, such as AWS GuardDuty and Microsoft Defender |
| ut the environment. Azure tools and APIs, such as the Azure | | for Cloud, and logging services, such as AWS CloudTrail and |
| AD Graph API and Azure Resource Manager API, can enumerate r | | Google Cloud Audit Logs. Adversaries may attempt to discov |
| esources and services, including applications, management gr | | er information about the services enabled throughout the env |
| oups, resources and policy definitions, and their relationsh | | ironment. Azure tools and APIs, such as the Azure AD Graph A |
| ips that are accessible by an identity.(Citation: Azure - Re | | PI and Azure Resource Manager API, can enumerate resources a |
| source Manager API)(Citation: Azure AD Graph API) Stormspot | | nd services, including applications, management groups, reso |
| ter is an open source tool for enumerating and constructing | | urces and policy definitions, and their relationships that a |
| a graph for Azure resources and services, and Pacu is an ope | | re accessible by an identity.(Citation: Azure - Resource Man |
| n source AWS exploitation framework that supports several me | | ager API)(Citation: Azure AD Graph API) For example, Storms |
| thods for discovering cloud services.(Citation: Azure - Stor | | potter is an open source tool for enumerating and constructi |
| mspotter)(Citation: GitHub Pacu) | | ng a graph for Azure resources and services, and Pacu is an |
| | | open source AWS exploitation framework that supports several |
| | | methods for discovering cloud services.(Citation: Azure - S |
| | | tormspotter)(Citation: GitHub Pacu) Adversaries may use the |
| | | information gained to shape follow-on behaviors, such as ta |
| | | rgeting data or credentials from enumerated services or evad |
| | | ing identified defenses through [Disable or Modify Tools](ht |
| | | tps://attack.mitre.org/techniques/T1562/001) or [Disable Clo |
| | | ud Logs](https://attack.mitre.org/techniques/T1562/008). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-16 12:57:03.837000+00:00 | 2023-04-11 20:33:55.356000+00:00 |
| description | An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)
Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) | An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008). |
| external_references[1]['source_name'] | Azure - Resource Manager API | Azure AD Graph API |
| external_references[1]['description'] | Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020. | Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/rest/api/resources/ | https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview |
| external_references[2]['source_name'] | Azure AD Graph API | Azure - Resource Manager API |
| external_references[2]['description'] | Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020. | Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020. |
| external_references[2]['url'] | https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview | https://docs.microsoft.com/en-us/rest/api/resources/ |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Thanabodi |
[T1059] Command and Scripting Interpreter
Current version: 2.4
Version changed from: 2.3 → 2.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 18:31:48.827000+00:00 | 2023-03-27 16:43:58.795000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[1] | Module: Module Load | Process: Process Creation |
| x_mitre_data_sources[3] | Script: Script Execution | Module: Module Load |
| x_mitre_data_sources[4] | Command: Command Execution | Script: Script Execution |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office 365 |
| x_mitre_platforms | | Azure AD |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Google Workspace |
[T1218.001] System Binary Proxy Execution: Compiled HTML File
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-11 18:59:36.836000+00:00 | 2023-04-21 12:23:17.694000+00:00 |
| external_references[1]['source_name'] | Microsoft HTML Help May 2018 | Microsoft CVE-2017-8625 Aug 2017 |
| external_references[1]['description'] | Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved October 3, 2018. | Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer Security Feature Bypass Vulnerability. Retrieved October 3, 2018. |
| external_references[1]['url'] | https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625 |
| external_references[2]['source_name'] | Microsoft HTML Help ActiveX | Microsoft HTML Help May 2018 |
| external_references[2]['description'] | Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved October 3, 2018. | Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved October 3, 2018. |
| external_references[2]['url'] | https://msdn.microsoft.com/windows/desktop/ms644670 | https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk |
| external_references[4]['source_name'] | MsitPros CHM Aug 2017 | Microsoft HTML Help ActiveX |
| external_references[4]['description'] | Moe, O. (2017, August 13). Bypassing Device guard UMCI using CHM – CVE-2017-8625. Retrieved October 3, 2018. | Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved October 3, 2018. |
| external_references[4]['url'] | https://msitpros.com/?p=3909 | https://msdn.microsoft.com/windows/desktop/ms644670 |
| external_references[5]['source_name'] | Microsoft CVE-2017-8625 Aug 2017 | MsitPros CHM Aug 2017 |
| external_references[5]['description'] | Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer Security Feature Bypass Vulnerability. Retrieved October 3, 2018. | Moe, O. (2017, August 13). Bypassing Device guard UMCI using CHM – CVE-2017-8625. Retrieved October 3, 2018. |
| external_references[5]['url'] | https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625 | https://msitpros.com/?p=3909 |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
[T1546.015] Event Triggered Execution: Component Object Model Hijacking
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-11-10 18:19:44.750000+00:00 | 2023-04-21 12:34:29.402000+00:00 |
| external_references[1]['source_name'] | Microsoft Component Object Model | Elastic COM Hijacking |
| external_references[1]['description'] | Microsoft. (n.d.). The Component Object Model. Retrieved August 18, 2016. | Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting Persistence & Evasion with the COM. Retrieved September 15, 2016. |
| external_references[1]['url'] | https://msdn.microsoft.com/library/ms694363.aspx | https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com |
| external_references[3]['source_name'] | Elastic COM Hijacking | Microsoft Component Object Model |
| external_references[3]['description'] | Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting Persistence & Evasion with the COM. Retrieved September 15, 2016. | Microsoft. (n.d.). The Component Object Model. Retrieved August 18, 2016. |
| external_references[3]['url'] | https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com | https://msdn.microsoft.com/library/ms694363.aspx |
| x_mitre_data_sources[0] | Command: Command Execution | Module: Module Load |
| x_mitre_data_sources[1] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[3] | Module: Module Load | Process: Process Creation |
| x_mitre_version | 1.0 | 1.1 |
[T1586] Compromise Accounts
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may compromise accounts with services that can b | t | Adversaries may compromise accounts with services that can b |
| e used during targeting. For operations incorporating social | | e used during targeting. For operations incorporating social |
| engineering, the utilization of an online persona may be im | | engineering, the utilization of an online persona may be im |
| portant. Rather than creating and cultivating accounts (i.e. | | portant. Rather than creating and cultivating accounts (i.e. |
| [Establish Accounts](https://attack.mitre.org/techniques/T1 | | [Establish Accounts](https://attack.mitre.org/techniques/T1 |
| 585)), adversaries may compromise existing accounts. Utilizi | | 585)), adversaries may compromise existing accounts. Utilizi |
| ng an existing persona may engender a level of trust in a po | | ng an existing persona may engender a level of trust in a po |
| tential victim if they have a relationship, or knowledge of, | | tential victim if they have a relationship, or knowledge of, |
| the compromised persona. A variety of methods exist for c | | the compromised persona. A variety of methods exist for c |
| ompromising accounts, such as gathering credentials via [Phi | | ompromising accounts, such as gathering credentials via [Phi |
| shing for Information](https://attack.mitre.org/techniques/T | | shing for Information](https://attack.mitre.org/techniques/T |
| 1598), purchasing credentials from third-party sites, or by | | 1598), purchasing credentials from third-party sites, brute |
| brute forcing credentials (ex: password reuse from breach cr | | forcing credentials (ex: password reuse from breach credenti |
| edential dumps).(Citation: AnonHBGary) Prior to compromising | | al dumps), or paying employees, suppliers or business partne |
| accounts, adversaries may conduct Reconnaissance to inform | | rs for access to credentials.(Citation: AnonHBGary)(Citation |
| decisions about which accounts to compromise to further thei | | : Microsoft DEV-0537) Prior to compromising accounts, advers |
| r operation. Personas may exist on a single site or across | | aries may conduct Reconnaissance to inform decisions about w |
| multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc | | hich accounts to compromise to further their operation. Per |
| .). Compromised accounts may require additional development, | | sonas may exist on a single site or across multiple sites (e |
| this could include filling out or modifying profile informa | | x: Facebook, LinkedIn, Twitter, Google, etc.). Compromised a |
| tion, further developing social networks, or incorporating p | | ccounts may require additional development, this could inclu |
| hotos. Adversaries may directly leverage compromised email | | de filling out or modifying profile information, further dev |
| accounts for [Phishing for Information](https://attack.mitre | | eloping social networks, or incorporating photos. Adversari |
| .org/techniques/T1598) or [Phishing](https://attack.mitre.or | | es may directly leverage compromised email accounts for [Phi |
| g/techniques/T1566). | | shing for Information](https://attack.mitre.org/techniques/T |
| | | 1598) or [Phishing](https://attack.mitre.org/techniques/T156 |
| | | 6). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 17:15:12.428000+00:00 | 2023-04-11 01:08:56.774000+00:00 |
| description | Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.
Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). | Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.
Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). |
| x_mitre_data_sources[0] | Persona: Social Media | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Content | Persona: Social Media |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'} |
[T1584] Compromise Infrastructure
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may compromise third-party infrastructure that c | t | Adversaries may compromise third-party infrastructure that c |
| an be used during targeting. Infrastructure solutions includ | | an be used during targeting. Infrastructure solutions includ |
| e physical or cloud servers, domains, and third-party web an | | e physical or cloud servers, domains, and third-party web an |
| d DNS services. Instead of buying, leasing, or renting infra | | d DNS services. Instead of buying, leasing, or renting infra |
| structure an adversary may compromise infrastructure and use | | structure an adversary may compromise infrastructure and use |
| it during other phases of the adversary lifecycle.(Citation | | it during other phases of the adversary lifecycle.(Citation |
| : Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio | | : Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio |
| n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens | | n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens |
| Part 2) Additionally, adversaries may compromise numerous ma | | Part 2) Additionally, adversaries may compromise numerous ma |
| chines to form a botnet they can leverage. Use of compromis | | chines to form a botnet they can leverage. Use of compromis |
| ed infrastructure allows an adversary to stage, launch, and | | ed infrastructure allows adversaries to stage, launch, and e |
| execute an operation. Compromised infrastructure can help ad | | xecute operations. Compromised infrastructure can help adver |
| versary operations blend in with traffic that is seen as nor | | sary operations blend in with traffic that is seen as normal |
| mal, such as contact with high reputation or trusted sites. | | , such as contact with high reputation or trusted sites. For |
| For example, adversaries may leverage compromised infrastruc | | example, adversaries may leverage compromised infrastructur |
| ture (potentially also in conjunction with [Digital Certific | | e (potentially also in conjunction with [Digital Certificate |
| ates](https://attack.mitre.org/techniques/T1588/004)) to fur | | s](https://attack.mitre.org/techniques/T1588/004)) to furthe |
| ther blend in and support staged information gathering and/o | | r blend in and support staged information gathering and/or [ |
| r [Phishing](https://attack.mitre.org/techniques/T1566) camp | | Phishing](https://attack.mitre.org/techniques/T1566) campaig |
| aigns.(Citation: FireEye DNS Hijack 2019) By using comprom | | ns.(Citation: FireEye DNS Hijack 2019) Additionally, adversa |
| ised infrastructure, adversaries may make it difficult to ti | | ries may also compromise infrastructure to support [Proxy](h |
| e their actions back to them. Prior to targeting, adversarie | | ttps://attack.mitre.org/techniques/T1090).(Citation: amnesty |
| s may compromise the infrastructure of other adversaries.(Ci | | _nso_pegasus) By using compromised infrastructure, adversar |
| tation: NSA NCSC Turla OilRig) | | ies may make it difficult to tie their actions back to them. |
| | | Prior to targeting, adversaries may compromise the infrastr |
| | | ucture of other adversaries.(Citation: NSA NCSC Turla OilRig |
| | | ) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-26 23:33:26.352000+00:00 | 2023-04-12 13:32:15.704000+00:00 |
| description | Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.
Use of compromised infrastructure allows an adversary to stage, launch, and execute an operation. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019)
By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) | Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.
Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus)
By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) |
| external_references[1]['source_name'] | FireEye DNS Hijack 2019 | amnesty_nso_pegasus |
| external_references[1]['description'] | Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020. | Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022. |
| external_references[1]['url'] | https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html | https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ |
| external_references[2]['source_name'] | ICANNDomainNameHijacking | FireEye DNS Hijack 2019 |
| external_references[2]['description'] | ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017. | Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020. |
| external_references[2]['url'] | https://www.icann.org/groups/ssac/documents/sac-007-en | https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html |
| external_references[3]['source_name'] | Koczwara Beacon Hunting Sep 2021 | ICANNDomainNameHijacking |
| external_references[3]['description'] | Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021. | ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017. |
| external_references[3]['url'] | https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2 | https://www.icann.org/groups/ssac/documents/sac-007-en |
| external_references[4]['source_name'] | Mandiant APT1 | Koczwara Beacon Hunting Sep 2021 |
| external_references[4]['description'] | Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. | Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021. |
| external_references[4]['url'] | https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf | https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2 |
| external_references[5]['source_name'] | Talos DNSpionage Nov 2018 | Mandiant APT1 |
| external_references[5]['description'] | Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020. | Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. |
| external_references[5]['url'] | https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html | https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf |
| external_references[6]['source_name'] | NSA NCSC Turla OilRig | Talos DNSpionage Nov 2018 |
| external_references[6]['description'] | NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020. | Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020. |
| external_references[6]['url'] | https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf | https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html |
| external_references[7]['source_name'] | Mandiant SCANdalous Jul 2020 | NSA NCSC Turla OilRig |
| external_references[7]['description'] | Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021. | NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020. |
| external_references[7]['url'] | https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation | https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf |
| external_references[8]['source_name'] | ThreatConnect Infrastructure Dec 2020 | Mandiant SCANdalous Jul 2020 |
| external_references[8]['description'] | ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021. | Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021. |
| external_references[8]['url'] | https://threatconnect.com/blog/infrastructure-research-hunting/ | https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation |
| external_references[9]['source_name'] | FireEye EPS Awakens Part 2 | ThreatConnect Infrastructure Dec 2020 |
| external_references[9]['description'] | Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016. | ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021. |
| external_references[9]['url'] | https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html | https://threatconnect.com/blog/infrastructure-research-hunting/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Domain Name: Active DNS | Internet Scan: Response Content |
| x_mitre_data_sources[2] | Internet Scan: Response Content | Domain Name: Domain Registration |
| x_mitre_data_sources[4] | Domain Name: Domain Registration | Domain Name: Active DNS |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'FireEye EPS Awakens Part 2', 'description': 'Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.', 'url': 'https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html'} |
| x_mitre_contributors | | Shailesh Tiwary (Indian Army) |
[T1552.007] Unsecured Credentials: Container API
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:11:10.849000+00:00 | 2023-04-15 16:11:25.409000+00:00 |
| external_references[1]['source_name'] | Docker API | Unit 42 Unsecured Docker Daemons |
| external_references[1]['description'] | Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved March 31, 2021. | Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021. |
| external_references[1]['url'] | https://docs.docker.com/engine/api/v1.41/ | https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/ |
| external_references[2]['source_name'] | Kubernetes API | Docker API |
| external_references[2]['description'] | The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021. | Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved March 31, 2021. |
| external_references[2]['url'] | https://kubernetes.io/docs/concepts/overview/kubernetes-api/ | https://docs.docker.com/engine/api/v1.41/ |
| external_references[3]['source_name'] | Unit 42 Unsecured Docker Daemons | Kubernetes API |
| external_references[3]['description'] | Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021. | The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021. |
| external_references[3]['url'] | https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/ | https://kubernetes.io/docs/concepts/overview/kubernetes-api/ |
| x_mitre_version | 1.1 | 1.2 |
[T1609] Container Administration Command
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1042: Disable or Remove Feature or Program
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:16:14.786000+00:00 | 2023-04-15 16:03:19.642000+00:00 |
| external_references[1]['source_name'] | Docker Daemon CLI | Docker Exec |
| external_references[1]['description'] | Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021. | Docker. (n.d.). Docker Exec. Retrieved March 29, 2021. |
| external_references[1]['url'] | https://docs.docker.com/engine/reference/commandline/dockerd/ | https://docs.docker.com/engine/reference/commandline/exec/ |
| external_references[2]['source_name'] | Kubernetes API | Docker Entrypoint |
| external_references[2]['description'] | The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021. | Docker. (n.d.). Docker run reference. Retrieved March 29, 2021. |
| external_references[2]['url'] | https://kubernetes.io/docs/concepts/overview/kubernetes-api/ | https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime |
| external_references[3]['source_name'] | Kubernetes Kubelet | Docker Daemon CLI |
| external_references[3]['description'] | The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021. | Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021. |
| external_references[3]['url'] | https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ | https://docs.docker.com/engine/reference/commandline/dockerd/ |
| external_references[4]['source_name'] | Docker Entrypoint | Kubectl Exec Get Shell |
| external_references[4]['description'] | Docker. (n.d.). Docker run reference. Retrieved March 29, 2021. | The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021. |
| external_references[4]['url'] | https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime | https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/ |
| external_references[5]['source_name'] | Docker Exec | Kubernetes Kubelet |
| external_references[5]['description'] | Docker. (n.d.). Docker Exec. Retrieved March 29, 2021. | The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021. |
| external_references[5]['url'] | https://docs.docker.com/engine/reference/commandline/exec/ | https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/ |
| external_references[6]['source_name'] | Kubectl Exec Get Shell | Kubernetes API |
| external_references[6]['description'] | The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021. | The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021. |
| external_references[6]['url'] | https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/ | https://kubernetes.io/docs/concepts/overview/kubernetes-api/ |
| x_mitre_version | 1.1 | 1.2 |
[T1053.007] Scheduled Task/Job: Container Orchestration Job
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:06:58.794000+00:00 | 2023-04-15 16:23:05.392000+00:00 |
| external_references[1]['source_name'] | Kubernetes Jobs | Kubernetes CronJob |
| external_references[1]['description'] | The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March 30, 2021. | The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved March 29, 2021. |
| external_references[1]['url'] | https://kubernetes.io/docs/concepts/workloads/controllers/job/ | https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ |
| external_references[2]['source_name'] | Kubernetes CronJob | Kubernetes Jobs |
| external_references[2]['description'] | The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved March 29, 2021. | The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March 30, 2021. |
| external_references[2]['url'] | https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ | https://kubernetes.io/docs/concepts/workloads/controllers/job/ |
| x_mitre_data_sources[0] | File: File Creation | Scheduled Job: Scheduled Job Creation |
| x_mitre_data_sources[2] | Scheduled Job: Scheduled Job Creation | File: File Creation |
| x_mitre_version | 1.2 | 1.3 |
[T1613] Container and Resource Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-12 18:22:05.737000+00:00 | 2023-04-15 16:08:50.706000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1136] Create Account
Current version: 2.3
Version changed from: 2.2 → 2.3
Dropped Mitigations:
- T1136: Create Account Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-12 13:04:14.534000+00:00 | 2023-04-12 23:24:48.840000+00:00 |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Austin Clark, @c2defense |
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_platforms | | Network |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
[T1134.002] Access Token Manipulation: Create Process with Token
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may create a new process with a different token | t | Adversaries may create a new process with an existing token |
| to escalate privileges and bypass access controls. Processes | | to escalate privileges and bypass access controls. Processes |
| can be created with the token and resulting security contex | | can be created with the token and resulting security contex |
| t of another user using features such as <code>CreateProcess | | t of another user using features such as <code>CreateProcess |
| WithTokenW</code> and <code>runas</code>.(Citation: Microsof | | WithTokenW</code> and <code>runas</code>.(Citation: Microsof |
| t RunAs) Creating processes with a different token may requ | | t RunAs) Creating processes with a token not associated wit |
| ire the credentials of the target user, specific privileges | | h the current user may require the credentials of the target |
| to impersonate that user, or access to the token to be used | | user, specific privileges to impersonate that user, or acce |
| (ex: gathered via other means such as [Token Impersonation/T | | ss to the token to be used. For example, the token could be |
| heft](https://attack.mitre.org/techniques/T1134/001) or [Mak | | duplicated via [Token Impersonation/Theft](https://attack.mi |
| e and Impersonate Token](https://attack.mitre.org/techniques | | tre.org/techniques/T1134/001) or created via [Make and Imper |
| /T1134/003)). | | sonate Token](https://attack.mitre.org/techniques/T1134/003) |
| | | before being used to create a process. While this techniqu |
| | | e is distinct from [Token Impersonation/Theft](https://attac |
| | | k.mitre.org/techniques/T1134/001), the techniques can be use |
| | | d in conjunction where a token is duplicated and then used t |
| | | o create a new process. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 14:51:48.978000+00:00 | 2023-04-11 21:14:37.714000+00:00 |
| description | Adversaries may create a new process with a different token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)
Creating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used (ex: gathered via other means such as [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003)). | Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)
Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process.
While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process. |
| external_references[1]['source_name'] | Microsoft RunAs | Microsoft Command-line Logging |
| external_references[1]['description'] | Microsoft. (2016, August 31). Runas. Retrieved October 1, 2021. | Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017. |
| external_references[1]['url'] | https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11) | https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing |
| external_references[2]['source_name'] | Microsoft Command-line Logging | Microsoft RunAs |
| external_references[2]['description'] | Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017. | Microsoft. (2016, August 31). Runas. Retrieved October 1, 2021. |
| external_references[2]['url'] | https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing | https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11) |
| x_mitre_data_sources[0] | Command: Command Execution | Process: OS API Execution |
| x_mitre_data_sources[1] | Process: OS API Execution | Command: Command Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Jonny Johnson |
[T1110.004] Brute Force: Credential Stuffing
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| external_references | | US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
| external_references | CAPEC-600 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-06 12:31:06.695000+00:00 | 2023-04-14 23:05:16.857000+00:00 |
| external_references[1]['source_name'] | capec | US-CERT TA18-068A 2018 |
| external_references[1]['url'] | https://capec.mitre.org/data/definitions/600.html | https://www.us-cert.gov/ncas/alerts/TA18-086A |
| x_mitre_data_sources[0] | User Account: User Account Authentication | Application Log: Application Log Content |
| x_mitre_data_sources[1] | Application Log: Application Log Content | User Account: User Account Authentication |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'US-CERT TA18-068A 2018', 'description': 'US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-086A'} | |
[T1589.001] Gather Victim Identity Information: Credentials
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may gather credentials that can be used during t | t | Adversaries may gather credentials that can be used during t |
| argeting. Account credentials gathered by adversaries may be | | argeting. Account credentials gathered by adversaries may be |
| those directly associated with the target victim organizati | | those directly associated with the target victim organizati |
| on or attempt to take advantage of the tendency for users to | | on or attempt to take advantage of the tendency for users to |
| use the same passwords across personal and business account | | use the same passwords across personal and business account |
| s. Adversaries may gather credentials from potential victim | | s. Adversaries may gather credentials from potential victim |
| s in various ways, such as direct elicitation via [Phishing | | s in various ways, such as direct elicitation via [Phishing |
| for Information](https://attack.mitre.org/techniques/T1598). | | for Information](https://attack.mitre.org/techniques/T1598). |
| Adversaries may also compromise sites then include maliciou | | Adversaries may also compromise sites then add malicious co |
| s content designed to collect website authentication cookies | | ntent designed to collect website authentication cookies fro |
| from visitors.(Citation: ATT ScanBox) Credential informatio | | m visitors.(Citation: ATT ScanBox) Credential information ma |
| n may also be exposed to adversaries via leaks to online or | | y also be exposed to adversaries via leaks to online or othe |
| other accessible data sets (ex: [Search Engines](https://att | | r accessible data sets (ex: [Search Engines](https://attack. |
| ack.mitre.org/techniques/T1593/002), breach dumps, code repo | | mitre.org/techniques/T1593/002), breach dumps, code reposito |
| sitories, etc.).(Citation: Register Deloitte)(Citation: Regi | | ries, etc.).(Citation: Register Deloitte)(Citation: Register |
| ster Uber)(Citation: Detectify Slack Tokens)(Citation: Forbe | | Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes Gi |
| s GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHu | | tHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gi |
| b Gitrob)(Citation: CNET Leaks) Adversaries may also purchas | | trob)(Citation: CNET Leaks) Adversaries may also purchase cr |
| e credentials from dark web or other black-markets. Gatherin | | edentials from dark web or other black-markets. Finally, whe |
| g this information may reveal opportunities for other forms | | re multi-factor authentication (MFA) based on out-of-band co |
| of reconnaissance (ex: [Search Open Websites/Domains](https: | | mmunications is in use, adversaries may compromise a service |
| //attack.mitre.org/techniques/T1593) or [Phishing for Inform | | provider to gain access to MFA codes and one-time passwords |
| ation](https://attack.mitre.org/techniques/T1598)), establis | | (OTP).(Citation: Okta Scatter Swine 2022) Gathering this i |
| hing operational resources (ex: [Compromise Accounts](https: | | nformation may reveal opportunities for other forms of recon |
| //attack.mitre.org/techniques/T1586)), and/or initial access | | naissance (ex: [Search Open Websites/Domains](https://attack |
| (ex: [External Remote Services](https://attack.mitre.org/te | | .mitre.org/techniques/T1593) or [Phishing for Information](h |
| chniques/T1133) or [Valid Accounts](https://attack.mitre.org | | ttps://attack.mitre.org/techniques/T1598)), establishing ope |
| /techniques/T1078)). | | rational resources (ex: [Compromise Accounts](https://attack |
| | | .mitre.org/techniques/T1586)), and/or initial access (ex: [E |
| | | xternal Remote Services](https://attack.mitre.org/techniques |
| | | /T1133) or [Valid Accounts](https://attack.mitre.org/techniq |
| | | ues/T1078)). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:26:44.352000+00:00 | 2023-04-14 23:29:10.396000+00:00 |
| description | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Finally, where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| external_references[2]['source_name'] | Register Deloitte | Detectify Slack Tokens |
| external_references[2]['description'] | Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020. | Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020. |
| external_references[2]['url'] | https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/ | https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/ |
| external_references[3]['source_name'] | Register Uber | GitHub truffleHog |
| external_references[3]['description'] | McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020. | Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020. |
| external_references[3]['url'] | https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/ | https://github.com/dxa4481/truffleHog |
| external_references[4]['source_name'] | Detectify Slack Tokens | Register Uber |
| external_references[4]['description'] | Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020. | McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020. |
| external_references[4]['url'] | https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/ | https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/ |
| external_references[5]['source_name'] | Forbes GitHub Creds | GitHub Gitrob |
| external_references[5]['description'] | Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020. | Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020. |
| external_references[5]['url'] | https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196 | https://github.com/michenriksen/gitrob |
| external_references[6]['source_name'] | GitHub truffleHog | CNET Leaks |
| external_references[6]['description'] | Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020. | Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020. |
| external_references[6]['url'] | https://github.com/dxa4481/truffleHog | https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/ |
| external_references[7]['source_name'] | GitHub Gitrob | Okta Scatter Swine 2022 |
| external_references[7]['description'] | Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020. | Okta. (2022, August 25). Detecting Scatter Swine: Insights into a Relentless Phishing Campaign. Retrieved February 24, 2023. |
| external_references[7]['url'] | https://github.com/michenriksen/gitrob | https://sec.okta.com/scatterswine |
| external_references[8]['source_name'] | CNET Leaks | Forbes GitHub Creds |
| external_references[8]['description'] | Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020. | Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020. |
| external_references[8]['url'] | https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/ | https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Register Deloitte', 'description': "Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.", 'url': 'https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/'} |
[T1132] Data Encoding
Current version: 1.2
Version changed from: 1.1 → 1.2
Dropped Mitigations:
- T1132: Data Encoding Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-14 23:39:50.338000+00:00 | 2023-04-21 12:20:20.711000+00:00 |
| external_references[1]['source_name'] | Wikipedia Binary-to-text Encoding | University of Birmingham C2 |
| external_references[1]['description'] | Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017. | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. |
| external_references[1]['url'] | https://en.wikipedia.org/wiki/Binary-to-text_encoding | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf |
| external_references[2]['source_name'] | Wikipedia Character Encoding | Wikipedia Binary-to-text Encoding |
| external_references[2]['description'] | Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017. | Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017. |
| external_references[2]['url'] | https://en.wikipedia.org/wiki/Character_encoding | https://en.wikipedia.org/wiki/Binary-to-text_encoding |
| external_references[3]['source_name'] | University of Birmingham C2 | Wikipedia Character Encoding |
| external_references[3]['description'] | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. | Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017. |
| external_references[3]['url'] | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf | https://en.wikipedia.org/wiki/Character_encoding |
| x_mitre_version | 1.1 | 1.2 |
[T1005] Data from Local System
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may search local system sources, such as file sy | t | Adversaries may search local system sources, such as file sy |
| stems and configuration files or local databases, to find fi | | stems and configuration files or local databases, to find fi |
| les of interest and sensitive data prior to Exfiltration. A | | les of interest and sensitive data prior to Exfiltration. A |
| dversaries may do this using a [Command and Scripting Interp | | dversaries may do this using a [Command and Scripting Interp |
| reter](https://attack.mitre.org/techniques/T1059), such as [ | | reter](https://attack.mitre.org/techniques/T1059), such as [ |
| cmd](https://attack.mitre.org/software/S0106) as well as a [ | | cmd](https://attack.mitre.org/software/S0106) as well as a [ |
| Network Device CLI](https://attack.mitre.org/techniques/T105 | | Network Device CLI](https://attack.mitre.org/techniques/T105 |
| 9/008), which have functionality to interact with the file s | | 9/008), which have functionality to interact with the file s |
| ystem to gather information. Adversaries may also use [Autom | | ystem to gather information.(Citation: show_run_config_cmd_c |
| ated Collection](https://attack.mitre.org/techniques/T1119) | | isco) Adversaries may also use [Automated Collection](https: |
| on the local system. | | //attack.mitre.org/techniques/T1119) on the local system. |
Dropped Mitigations:
- T1005: Data from Local System Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-19 21:55:54.866000+00:00 | 2023-04-12 23:54:39.466000+00:00 |
| description | Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information. Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
| Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
|
| external_references[1]['source_name'] | Mandiant APT41 Global Intrusion | show_run_config_cmd_cisco |
| external_references[1]['description'] | Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022. | Cisco. (2022, August 16). show running-config - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022. |
| external_references[1]['url'] | https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits | https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_protocols_through_showmon.html#wp2760878733 |
| external_references[2]['source_name'] | US-CERT-TA18-106A | Mandiant APT41 Global Intrusion |
| external_references[2]['description'] | US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. | Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022. |
| external_references[2]['url'] | https://www.us-cert.gov/ncas/alerts/TA18-106A | https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Process: OS API Execution | Command: Command Execution |
| x_mitre_data_sources[1] | File: File Access | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | File: File Access |
| x_mitre_data_sources[3] | Script: Script Execution | Process: OS API Execution |
| x_mitre_data_sources[4] | Command: Command Execution | Script: Script Execution |
| x_mitre_detection | Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). | Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
For network infrastructure devices, collect AAA logging to monitor `show` commands that view configuration files. |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'US-CERT-TA18-106A', 'description': 'US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-106A'} |
[T1140] Deobfuscate/Decode Files or Information
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use [Obfuscated Files or Information](https: | t | Adversaries may use [Obfuscated Files or Information](https: |
| //attack.mitre.org/techniques/T1027) to hide artifacts of an | | //attack.mitre.org/techniques/T1027) to hide artifacts of an |
| intrusion from analysis. They may require separate mechanis | | intrusion from analysis. They may require separate mechanis |
| ms to decode or deobfuscate that information depending on ho | | ms to decode or deobfuscate that information depending on ho |
| w they intend to use it. Methods for doing that include buil | | w they intend to use it. Methods for doing that include buil |
| t-in functionality of malware or by using utilities present | | t-in functionality of malware or by using utilities present |
| on the system. One such example is use of [certutil](https: | | on the system. One such example is the use of [certutil](ht |
| //attack.mitre.org/software/S0160) to decode a remote access | | tps://attack.mitre.org/software/S0160) to decode a remote ac |
| tool portable executable file that has been hidden inside a | | cess tool portable executable file that has been hidden insi |
| certificate file. (Citation: Malwarebytes Targeted Attack a | | de a certificate file.(Citation: Malwarebytes Targeted Attac |
| gainst Saudi Arabia) Another example is using the Windows <c | | k against Saudi Arabia) Another example is using the Windows |
| ode>copy /b</code> command to reassemble binary fragments in | | <code>copy /b</code> command to reassemble binary fragments |
| to a malicious payload. (Citation: Carbon Black Obfuscation | | into a malicious payload.(Citation: Carbon Black Obfuscatio |
| Sept 2016) Sometimes a user's action may be required to ope | | n Sept 2016) Sometimes a user's action may be required to o |
| n it for deobfuscation or decryption as part of [User Execut | | pen it for deobfuscation or decryption as part of [User Exec |
| ion](https://attack.mitre.org/techniques/T1204). The user ma | | ution](https://attack.mitre.org/techniques/T1204). The user |
| y also be required to input a password to open a password pr | | may also be required to input a password to open a password |
| otected compressed/encrypted file that was provided by the a | | protected compressed/encrypted file that was provided by the |
| dversary. (Citation: Volexity PowerDuke November 2016) | | adversary. (Citation: Volexity PowerDuke November 2016) |
Dropped Mitigations:
- T1140: Deobfuscate/Decode Files or Information Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 04:05:42.508000+00:00 | 2023-04-21 12:21:06.026000+00:00 |
| description | Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016)
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) | Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016)
Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016) |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
[T1610] Deploy Container
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:14:58.939000+00:00 | 2023-04-15 16:13:40.232000+00:00 |
| external_references[1]['source_name'] | Docker Containers API | Aqua Build Images on Hosts |
| external_references[1]['description'] | Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021. | Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021. |
| external_references[1]['url'] | https://docs.docker.com/engine/api/v1.41/#tag/Container | https://blog.aquasec.com/malicious-container-image-docker-container-host |
| external_references[2]['source_name'] | Kubernetes Dashboard | Docker Containers API |
| external_references[2]['description'] | The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021. | Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021. |
| external_references[2]['url'] | https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/ | https://docs.docker.com/engine/api/v1.41/#tag/Container |
| external_references[4]['source_name'] | Aqua Build Images on Hosts | Kubernetes Dashboard |
| external_references[4]['description'] | Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021. | The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021. |
| external_references[4]['url'] | https://blog.aquasec.com/malicious-container-image-docker-container-host | https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/ |
| x_mitre_data_sources[1] | Container: Container Creation | Application Log: Application Log Content |
| x_mitre_data_sources[3] | Application Log: Application Log Content | Container: Container Creation |
| x_mitre_version | 1.1 | 1.2 |
[T1098.005] Account Manipulation: Device Registration
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may register a device to an adversary-controlled | t | Adversaries may register a device to an adversary-controlled |
| account. Devices may be registered in a multifactor authent | | account. Devices may be registered in a multifactor authent |
| ication (MFA) system, which handles authentication to the ne | | ication (MFA) system, which handles authentication to the ne |
| twork, or in a device management system, which handles devic | | twork, or in a device management system, which handles devic |
| e access and compliance. MFA systems, such as Duo or Okta, | | e access and compliance. MFA systems, such as Duo or Okta, |
| allow users to associate devices with their accounts in orde | | allow users to associate devices with their accounts in orde |
| r to complete MFA requirements. An adversary that compromise | | r to complete MFA requirements. An adversary that compromise |
| s a user’s credentials may enroll a new device in order to b | | s a user’s credentials may enroll a new device in order to b |
| ypass initial MFA requirements and gain persistent access to | | ypass initial MFA requirements and gain persistent access to |
| a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar |
| kReading FireEye SolarWinds) Similarly, an adversary with e | | kReading FireEye SolarWinds) In some cases, the MFA self-enr |
| xisting access to a network may register a device to Azure A | | ollment process may require only a username and password to |
| D and/or its device management system, Microsoft Intune, in | | enroll the account's first device or to enroll a device to a |
| order to access sensitive data or resources while bypassing | | n inactive account. (Citation: Mandiant APT29 Microsoft 365 |
| conditional access policies.(Citation: AADInternals - Device | | 2022) Similarly, an adversary with existing access to a net |
| Registration)(Citation: AADInternals - Conditional Access B | | work may register a device to Azure AD and/or its device man |
| ypass)(Citation: Microsoft DEV-0537) Devices registered in | | agement system, Microsoft Intune, in order to access sensiti |
| Azure AD may be able to conduct [Internal Spearphishing](ht | | ve data or resources while bypassing conditional access poli |
| tps://attack.mitre.org/techniques/T1534) campaigns via intra | | cies.(Citation: AADInternals - Device Registration)(Citation |
| -organizational emails, which are less likely to be treated | | : AADInternals - Conditional Access Bypass)(Citation: Micros |
| as suspicious by the email client.(Citation: Microsoft - Dev | | oft DEV-0537) Devices registered in Azure AD may be able t |
| ice Registration) Additionally, an adversary may be able to | | o conduct [Internal Spearphishing](https://attack.mitre.org/ |
| perform a [Service Exhaustion Flood](https://attack.mitre.or | | techniques/T1534) campaigns via intra-organizational emails, |
| g/techniques/T1499/002) on an Azure AD tenant by registering | | which are less likely to be treated as suspicious by the em |
| a large number of devices.(Citation: AADInternals - BPRT) | | ail client.(Citation: Microsoft - Device Registration) Addit |
| | | ionally, an adversary may be able to perform a [Service Exha |
| | | ustion Flood](https://attack.mitre.org/techniques/T1499/002) |
| | | on an Azure AD tenant by registering a large number of devi |
| | | ces.(Citation: AADInternals - BPRT) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-25 16:26:53.204000+00:00 | 2023-04-20 18:14:17.197000+00:00 |
| description | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds)
Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)
Devices registered in Azure AD may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Azure AD tenant by registering a large number of devices.(Citation: AADInternals - BPRT) | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022)
Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)
Devices registered in Azure AD may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Azure AD tenant by registering a large number of devices.(Citation: AADInternals - BPRT) |
| external_references[2]['source_name'] | AADInternals - Conditional Access Bypass | Mandiant APT29 Microsoft 365 2022 |
| external_references[2]['description'] | Dr. Nestori Syynimaa. (2020, September 6). Bypassing conditional access by faking device compliance. Retrieved March 4, 2022. | Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023. |
| external_references[2]['url'] | https://o365blog.com/post/mdm | https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft |
| external_references[3]['source_name'] | AADInternals - BPRT | AADInternals - Conditional Access Bypass |
| external_references[3]['description'] | Dr. Nestori Syynimaa. (2021, January 31). BPRT unleashed: Joining multiple devices to Azure AD and Intune. Retrieved March 4, 2022. | Dr. Nestori Syynimaa. (2020, September 6). Bypassing conditional access by faking device compliance. Retrieved March 4, 2022. |
| external_references[3]['url'] | https://o365blog.com/post/bprt/ | https://o365blog.com/post/mdm |
| external_references[4]['source_name'] | AADInternals - Device Registration | AADInternals - BPRT |
| external_references[4]['description'] | Dr. Nestori Syynimaa. (2021, March 3). Deep-dive to Azure AD device join. Retrieved March 9, 2022. | Dr. Nestori Syynimaa. (2021, January 31). BPRT unleashed: Joining multiple devices to Azure AD and Intune. Retrieved March 4, 2022. |
| external_references[4]['url'] | https://o365blog.com/post/devices/ | https://o365blog.com/post/bprt/ |
| external_references[5]['source_name'] | DarkReading FireEye SolarWinds | AADInternals - Device Registration |
| external_references[5]['description'] | Kelly Jackson Higgins. (2021, January 7). FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack. Retrieved April 18, 2022. | Dr. Nestori Syynimaa. (2021, March 3). Deep-dive to Azure AD device join. Retrieved March 9, 2022. |
| external_references[5]['url'] | https://www.darkreading.com/threat-intelligence/fireeye-s-mandia-severity-zero-alert-led-to-discovery-of-solarwinds-attack | https://o365blog.com/post/devices/ |
| external_references[6]['source_name'] | Microsoft - Device Registration | DarkReading FireEye SolarWinds |
| external_references[6]['description'] | Microsoft 365 Defender Threat Intelligence Team. (2022, January 26). Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA. Retrieved March 4, 2022. | Kelly Jackson Higgins. (2021, January 7). FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack. Retrieved April 18, 2022. |
| external_references[6]['url'] | https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa | https://www.darkreading.com/threat-intelligence/fireeye-s-mandia-severity-zero-alert-led-to-discovery-of-solarwinds-attack |
| external_references[7]['source_name'] | Microsoft DEV-0537 | Microsoft - Device Registration |
| external_references[7]['description'] | Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022. | Microsoft 365 Defender Threat Intelligence Team. (2022, January 26). Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA. Retrieved March 4, 2022. |
| external_references[7]['url'] | https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ | https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | User Account: User Account Modification | Active Directory: Active Directory Object Creation |
| x_mitre_data_sources[1] | Active Directory: Active Directory Object Creation | User Account: User Account Modification |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'} |
| x_mitre_contributors | | Joe Gumke, U.S. Bank |
[T1562.008] Impair Defenses: Disable Cloud Logs
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | An adversary may disable cloud logging capabilities and inte | t | An adversary may disable cloud logging capabilities and inte |
| grations to limit what data is collected on their activities | | grations to limit what data is collected on their activities |
| and avoid detection. Cloud environments allow for collect | | and avoid detection. Cloud environments allow for collectio |
| ion and analysis of audit and application logs that provide | | n and analysis of audit and application logs that provide in |
| insight into what activities a user does within the environm | | sight into what activities a user does within the environmen |
| ent. If an adversary has sufficient permissions, they can di | | t. If an adversary has sufficient permissions, they can disa |
| sable logging to avoid detection of their activities. For ex | | ble logging to avoid detection of their activities. For exa |
| ample, in AWS an adversary may disable CloudWatch/CloudTrail | | mple, in AWS an adversary may disable CloudWatch/CloudTrail |
| integrations prior to conducting further malicious activity | | integrations prior to conducting further malicious activity. |
| .(Citation: Following the CloudTrail: Generating strong AWS | | (Citation: Following the CloudTrail: Generating strong AWS s |
| security signals with Sumo Logic) | | ecurity signals with Sumo Logic) In Office 365, an adversary |
| | | may disable logging on mail collection activities for speci |
| | | fic users by using the `Set-MailboxAuditBypassAssociation` c |
| | | mdlet, by disabling M365 Advanced Auditing for the user, or |
| | | by downgrading the user’s license from an Enterprise E5 to a |
| | | n Enterprise E3 license.(Citation: Dark Reading Microsoft 36 |
| | | 5 Attacks 2021) |
New Detections:
- DS0002: User Account (User Account Modification)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:55:27.505000+00:00 | 2023-04-20 18:13:50.277000+00:00 |
| description | An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.
Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic) | An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities.
For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading Microsoft 365 Attacks 2021) |
| external_references[1]['source_name'] | Following the CloudTrail: Generating strong AWS security signals with Sumo Logic | Stopping CloudTrail from Sending Events to CloudWatch Logs |
| external_references[1]['description'] | Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020. | Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020. |
| external_references[1]['url'] | https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/ | https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html |
| external_references[2]['source_name'] | Stopping CloudTrail from Sending Events to CloudWatch Logs | Following the CloudTrail: Generating strong AWS security signals with Sumo Logic |
| external_references[2]['description'] | Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020. | Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020. |
| external_references[2]['url'] | https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html | https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/ |
| external_references[4]['source_name'] | az monitor diagnostic-settings | Dark Reading Microsoft 365 Attacks 2021 |
| external_references[4]['description'] | Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020. | Kelly Sheridan. (2021, August 5). Incident Responders Explore Microsoft 365 Attacks in the Wild. Retrieved March 17, 2023. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete | https://www.darkreading.com/threat-intelligence/incident-responders-explore-microsoft-365-attacks-in-the-wild/d/d-id/1341591 |
| x_mitre_detection | Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled. | Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled. |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'az monitor diagnostic-settings', 'description': 'Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020.', 'url': 'https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete'} |
| x_mitre_contributors | | Joe Gumke, U.S. Bank |
| x_mitre_data_sources | | User Account: User Account Modification |
| x_mitre_platforms | | SaaS |
| x_mitre_platforms | | Google Workspace |
| x_mitre_platforms | | Azure AD |
| x_mitre_platforms | | Office 365 |
[T1562.002] Impair Defenses: Disable Windows Event Logging
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may disable Windows event logging to limit data | t | Adversaries may disable Windows event logging to limit data |
| that can be leveraged for detections and audits. Windows eve | | that can be leveraged for detections and audits. Windows eve |
| nt logs record user and system activity such as login attemp | | nt logs record user and system activity such as login attemp |
| ts, process creation, and much more.(Citation: Windows Log E | | ts, process creation, and much more.(Citation: Windows Log E |
| vents) This data is used by security tools and analysts to g | | vents) This data is used by security tools and analysts to g |
| enerate detections. The EventLog service maintains event lo | | enerate detections. The EventLog service maintains event lo |
| gs from various system components and applications.(Citation | | gs from various system components and applications.(Citation |
| : EventLog_Core_Technologies) By default, the service automa | | : EventLog_Core_Technologies) By default, the service automa |
| tically starts when a system powers on. An audit policy, mai | | tically starts when a system powers on. An audit policy, mai |
| ntained by the Local Security Policy (secpol.msc), defines w | | ntained by the Local Security Policy (secpol.msc), defines w |
| hich system events the EventLog service logs. Security audit | | hich system events the EventLog service logs. Security audit |
| policy settings can be changed by running secpol.msc, then | | policy settings can be changed by running secpol.msc, then |
| navigating to <code>Security Settings\Local Policies\Audit P | | navigating to <code>Security Settings\Local Policies\Audit P |
| olicy</code> for basic audit policy settings or <code>Securi | | olicy</code> for basic audit policy settings or <code>Securi |
| ty Settings\Advanced Audit Policy Configuration</code> for a | | ty Settings\Advanced Audit Policy Configuration</code> for a |
| dvanced audit policy settings.(Citation: Audit_Policy_Micros | | dvanced audit policy settings.(Citation: Audit_Policy_Micros |
| oft)(Citation: Advanced_sec_audit_policy_settings) <code>aud | | oft)(Citation: Advanced_sec_audit_policy_settings) <code>aud |
| itpol.exe</code> may also be used to set audit policies.(Cit | | itpol.exe</code> may also be used to set audit policies.(Cit |
| ation: auditpol) Adversaries may target system-wide logging | | ation: auditpol) Adversaries may target system-wide logging |
| or just that of a particular application. For example, the | | or just that of a particular application. For example, the |
| EventLog service may be disabled using the following PowerSh | | Windows EventLog service may be disabled using the <code>Set |
| ell line: <code>Stop-Service -Name EventLog</code>.(Citation | | -Service -Name EventLog -Status Stopped</code> or <code>sc c |
| : Disable_Win_Event_Logging) Additionally, adversaries may u | | onfig eventlog start=disabled</code> commands (followed by m |
| se <code>auditpol</code> and its sub-commands in a command p | | anually stopping the service using <code>Stop-Service -Name |
| rompt to disable auditing or clear the audit policy. To enab | | EventLog</code>).(Citation: Disable_Win_Event_Logging)(Cita |
| le or disable a specified setting or audit category, adversa | | tion: disable_win_evt_logging) Additionally, the service may |
| ries may use the <code>/success</code> or <code>/failure</co | | be disabled by modifying the “Start” value in <code>HKEY_LO |
| de> parameters. For example, <code>auditpol /set /category:” | | CAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog</code |
| Account Logon” /success:disable /failure:disable</code> turn | | > then restarting the system for the change to take effect.( |
| s off auditing for the Account Logon category.(Citation: aud | | Citation: disable_win_evt_logging) There are several ways t |
| itpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clea | | o disable the EventLog service via registry key modification |
| r the audit policy, adversaries may run the following lines: | | . First, without Administrator privileges, adversaries may m |
| <code>auditpol /clear /y</code> or <code>auditpol /remove / | | odify the "Start" value in the key <code>HKEY_LOCAL_MACHINE\ |
| allusers</code>.(Citation: T1562.002_redcanaryco) By disabl | | SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Sec |
| ing Windows event logging, adversaries can operate while lea | | urity</code>, then reboot the system to disable the Security |
| ving less evidence of a compromise behind. | | EventLog.(Citation: winser19_file_overwrite_bug_twitter) Se |
| | | cond, with Administrator privilege, adversaries may modify t |
| | | he same values in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentCon |
| | | trolSet\Control\WMI\Autologger\EventLog-System</code> and <c |
| | | ode>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\ |
| | | Autologger\EventLog-Application</code> to disable the entire |
| | | EventLog.(Citation: disable_win_evt_logging) Additionally, |
| | | adversaries may use <code>auditpol</code> and its sub-comma |
| | | nds in a command prompt to disable auditing or clear the aud |
| | | it policy. To enable or disable a specified setting or audit |
| | | category, adversaries may use the <code>/success</code> or |
| | | <code>/failure</code> parameters. For example, <code>auditpo |
| | | l /set /category:”Account Logon” /success:disable /failure:d |
| | | isable</code> turns off auditing for the Account Logon categ |
| | | ory.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_re |
| | | dcanaryco) To clear the audit policy, adversaries may run th |
| | | e following lines: <code>auditpol /clear /y</code> or <code> |
| | | auditpol /remove /allusers</code>.(Citation: T1562.002_redca |
| | | naryco) By disabling Windows event logging, adversaries can |
| | | operate while leaving less evidence of a compromise behind. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-19 13:37:30.534000+00:00 | 2023-03-17 23:24:19.730000+00:00 |
| description | Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.
The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol)
Adversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.(Citation: Disable_Win_Event_Logging) Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco)
By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind. | Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.
The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol)
Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging)
There are several ways to disable the EventLog service via registry key modification. First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging)
Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco)
By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind. |
| external_references[1]['source_name'] | Windows Log Events | Disable_Win_Event_Logging |
| external_references[1]['description'] | Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020. | dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021. |
| external_references[1]['url'] | https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/ | https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging |
| external_references[2]['source_name'] | EventLog_Core_Technologies | def_ev_win_event_logging |
| external_references[2]['description'] | Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021. | Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021. |
| external_references[2]['url'] | https://www.coretechnologies.com/blog/windows-services/eventlog/ | https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ |
| external_references[3]['source_name'] | Audit_Policy_Microsoft | EventLog_Core_Technologies |
| external_references[3]['description'] | Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021. | Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy | https://www.coretechnologies.com/blog/windows-services/eventlog/ |
| external_references[4]['source_name'] | Advanced_sec_audit_policy_settings | Audit_Policy_Microsoft |
| external_references[4]['description'] | Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021. | Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings | https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy |
| external_references[5]['source_name'] | auditpol | Windows Log Events |
| external_references[5]['description'] | Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021. | Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020. |
| external_references[5]['url'] | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol | https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/ |
| external_references[6]['source_name'] | Disable_Win_Event_Logging | disable_win_evt_logging |
| external_references[6]['description'] | dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021. | Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022. |
| external_references[6]['url'] | https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging | https://ptylu.github.io/content/report/report.html?report=25 |
| external_references[7]['source_name'] | auditpol.exe_STRONTIC | auditpol |
| external_references[7]['description'] | STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021. | Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021. |
| external_references[7]['url'] | https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol |
| external_references[8]['source_name'] | T1562.002_redcanaryco | winser19_file_overwrite_bug_twitter |
| external_references[8]['description'] | redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021. | Naceri, A. (2021, November 7). Windows Server 2019 file overwrite bug. Retrieved April 7, 2022. |
| external_references[8]['url'] | https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md | https://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040 |
| external_references[9]['source_name'] | def_ev_win_event_logging | T1562.002_redcanaryco |
| external_references[9]['description'] | Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021. | redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021. |
| external_references[9]['url'] | https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ | https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md |
| external_references[10]['source_name'] | evt_log_tampering | Advanced_sec_audit_policy_settings |
| external_references[10]['description'] | svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021. | Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021. |
| external_references[10]['url'] | https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c | https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings |
| x_mitre_data_sources[0] | Command: Command Execution | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Sensor Health: Host Status | Script: Script Execution |
| x_mitre_data_sources[3] | Script: Script Execution | Windows Registry: Windows Registry Key Creation |
| x_mitre_data_sources[5] | Windows Registry: Windows Registry Key Creation | Command: Command Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'auditpol.exe_STRONTIC', 'description': 'STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.', 'url': 'https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html'} |
| external_references | | {'source_name': 'evt_log_tampering', 'description': 'svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.', 'url': 'https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c'} |
| x_mitre_contributors | | Lucas Heiligenstein |
[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may disable or modify a firewall within a cloud | t | Adversaries may disable or modify a firewall within a cloud |
| environment to bypass controls that limit access to cloud re | | environment to bypass controls that limit access to cloud re |
| sources. Cloud firewalls are separate from system firewalls | | sources. Cloud firewalls are separate from system firewalls |
| that are described in [Disable or Modify System Firewall](ht | | that are described in [Disable or Modify System Firewall](ht |
| tps://attack.mitre.org/techniques/T1562/004). Cloud enviro | | tps://attack.mitre.org/techniques/T1562/004). Cloud enviro |
| nments typically utilize restrictive security groups and fir | | nments typically utilize restrictive security groups and fir |
| ewall rules that only allow network activity from trusted IP | | ewall rules that only allow network activity from trusted IP |
| addresses via expected ports and protocols. An adversary ma | | addresses via expected ports and protocols. An adversary ma |
| y introduce new firewall rules or policies to allow access i | | y introduce new firewall rules or policies to allow access i |
| nto a victim cloud environment. For example, an adversary ma | | nto a victim cloud environment. For example, an adversary ma |
| y use a script or utility that creates new ingress rules in | | y use a script or utility that creates new ingress rules in |
| existing security groups to allow any TCP/IP connectivity.(C | | existing security groups to allow any TCP/IP connectivity, o |
| itation: Expel IO Evil in AWS) Modifying or disabling a clo | | r remove networking limitations to support traffic associate |
| ud firewall may enable adversary C2 communications, lateral | | d with malicious activity (such as cryptomining).(Citation: |
| movement, and/or data exfiltration that would otherwise not | | Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromise |
| be allowed. | | d Cloud Compute Credentials 2022) Modifying or disabling a |
| | | cloud firewall may enable adversary C2 communications, later |
| | | al movement, and/or data exfiltration that would otherwise n |
| | | ot be allowed. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:02.146000+00:00 | 2023-04-15 00:25:36.502000+00:00 |
| description | Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.(Citation: Expel IO Evil in AWS)
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. | Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity, or remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022', 'description': 'Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.', 'url': 'https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/'} |
[T1562.004] Impair Defenses: Disable or Modify System Firewall
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may disable or modify system firewalls in order | t | Adversaries may disable or modify system firewalls in order |
| to bypass controls limiting network usage. Changes could be | | to bypass controls limiting network usage. Changes could be |
| disabling the entire mechanism as well as adding, deleting, | | disabling the entire mechanism as well as adding, deleting, |
| or modifying particular rules. This can be done numerous way | | or modifying particular rules. This can be done numerous way |
| s depending on the operating system, including via command-l | | s depending on the operating system, including via command-l |
| ine, editing Windows Registry keys, and Windows Control Pane | | ine, editing Windows Registry keys, and Windows Control Pane |
| l. Modifying or disabling a system firewall may enable adve | | l. Modifying or disabling a system firewall may enable adve |
| rsary C2 communications, lateral movement, and/or data exfil | | rsary C2 communications, lateral movement, and/or data exfil |
| tration that would otherwise not be allowed. | | tration that would otherwise not be allowed. For example, ad |
| | | versaries may add a new firewall rule for a well-known proto |
| | | col (such as RDP) using a non-traditional and potentially le |
| | | ss securitized port (i.e. [Non-Standard Port](https://attack |
| | | .mitre.org/techniques/T1571)).(Citation: change_rdp_port_con |
| | | ti) |
New Mitigations:
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 22:18:11.166000+00:00 | 2023-02-28 22:34:38.316000+00:00 |
| description | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti) |
| x_mitre_data_sources[1] | Firewall: Firewall Rule Modification | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[3] | Windows Registry: Windows Registry Key Modification | Firewall: Firewall Rule Modification |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'change_rdp_port_conti', 'description': 'The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved March 1, 2022.', 'url': 'https://twitter.com/TheDFIRReport/status/1498657772254240768'} |
[T1562.001] Impair Defenses: Disable or Modify Tools
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may modify and/or disable security tools to avoi | t | Adversaries may modify and/or disable security tools to avoi |
| d possible detection of their malware/tools and activities. | | d possible detection of their malware/tools and activities. |
| This may take many forms, such as killing security software | | This may take many forms, such as killing security software |
| processes or services, modifying / deleting Registry keys or | | processes or services, modifying / deleting Registry keys or |
| configuration files so that tools do not operate properly, | | configuration files so that tools do not operate properly, |
| or other methods to interfere with security tools scanning o | | or other methods to interfere with security tools scanning o |
| r reporting information. Adversaries may also disable update | | r reporting information. Adversaries may also disable update |
| s to prevent the latest security patches from reaching tools | | s to prevent the latest security patches from reaching tools |
| on victim systems.(Citation: SCADAfence_ransomware) Advers | | on victim systems.(Citation: SCADAfence_ransomware) Advers |
| aries may also tamper with artifacts deployed and utilized b | | aries may also tamper with artifacts deployed and utilized b |
| y security tools. Security tools may make dynamic changes to | | y security tools. Security tools may make dynamic changes to |
| system components in order to maintain visibility into spec | | system components in order to maintain visibility into spec |
| ific events. For example, security products may load their o | | ific events. For example, security products may load their o |
| wn modules and/or modify those loaded by processes to facili | | wn modules and/or modify those loaded by processes to facili |
| tate data collection. Similar to [Indicator Blocking](https: | | tate data collection. Similar to [Indicator Blocking](https: |
| //attack.mitre.org/techniques/T1562/006), adversaries may un | | //attack.mitre.org/techniques/T1562/006), adversaries may un |
| hook or otherwise modify these features added by tools (espe | | hook or otherwise modify these features added by tools (espe |
| cially those that exist in userland or are otherwise potenti | | cially those that exist in userland or are otherwise potenti |
| ally accessible to adversaries) to avoid detection.(Citation | | ally accessible to adversaries) to avoid detection.(Citation |
| : OutFlank System Calls)(Citation: MDSec System Calls) In c | | : OutFlank System Calls)(Citation: MDSec System Calls) Adv |
| loud environments, tools disabled by adversaries may include | | ersaries may also focus on specific applications such as Sys |
| cloud monitoring agents that report back to services such a | | mon. For example, the “Start” and “Enable” values in <code>H |
| s AWS CloudWatch or Google Cloud Monitor. Furthermore, alth | | KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autol |
| ough defensive tools may have anti-tampering mechanisms, adv | | ogger\EventLog-Microsoft-Windows-Sysmon-Operational</code> m |
| ersaries may abuse tools such as legitimate rootkit removal | | ay be modified to tamper with and potentially disable Sysmon |
| kits to impair and/or disable these tools.(Citation: chasing | | logging.(Citation: disable_win_evt_logging) In cloud envi |
| _avaddon_ransomware)(Citation: dharma_ransomware)(Citation: | | ronments, tools disabled by adversaries may include cloud mo |
| demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For e | | nitoring agents that report back to services such as AWS Clo |
| xample, adversaries have used tools such as GMER to find and | | udWatch or Google Cloud Monitor. Furthermore, although defe |
| shut down hidden processes and antivirus software on infect | | nsive tools may have anti-tampering mechanisms, adversaries |
| ed systems.(Citation: demystifying_ryuk) Additionally, adve | | may abuse tools such as legitimate rootkit removal kits to i |
| rsaries may exploit legitimate drivers from anti-virus softw | | mpair and/or disable these tools.(Citation: chasing_avaddon_ |
| are to gain access to kernel space (i.e. [Exploitation for P | | ransomware)(Citation: dharma_ransomware)(Citation: demystify |
| rivilege Escalation](https://attack.mitre.org/techniques/T10 | | ing_ryuk)(Citation: doppelpaymer_crowdstrike) For example, a |
| 68)), which may lead to bypassing anti-tampering features.(C | | dversaries have used tools such as GMER to find and shut dow |
| itation: avoslocker_ransomware) | | n hidden processes and antivirus software on infected system |
| | | s.(Citation: demystifying_ryuk) Additionally, adversaries m |
| | | ay exploit legitimate drivers from anti-virus software to ga |
| | | in access to kernel space (i.e. [Exploitation for Privilege |
| | | Escalation](https://attack.mitre.org/techniques/T1068)), whi |
| | | ch may lead to bypassing anti-tampering features.(Citation: |
| | | avoslocker_ransomware) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022. |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | CAPEC-578 | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-24 15:23:59.433000+00:00 | 2023-04-12 13:43:42.986000+00:00 |
| description | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)
In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.
Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)
Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware) | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)
Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)
Adversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging)
In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.
Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)
Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware) |
| external_references[2]['source_name'] | chasing_avaddon_ransomware | disable_win_evt_logging |
| external_references[2]['description'] | Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022. | Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022. |
| external_references[2]['url'] | https://www.mandiant.com/resources/chasing-avaddon-ransomware | https://ptylu.github.io/content/report/report.html?report=25 |
| external_references[3]['source_name'] | doppelpaymer_crowdstrike | chasing_avaddon_ransomware |
| external_references[3]['description'] | Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022. | Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022. |
| external_references[3]['url'] | https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/ | https://www.mandiant.com/resources/chasing-avaddon-ransomware |
| external_references[4]['source_name'] | avoslocker_ransomware | doppelpaymer_crowdstrike |
| external_references[4]['description'] | Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022. | Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022. |
| external_references[4]['url'] | https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html | https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/ |
| external_references[5]['source_name'] | dharma_ransomware | avoslocker_ransomware |
| external_references[5]['description'] | Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022. | Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022. |
| external_references[5]['url'] | https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/ | https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html |
| external_references[6]['source_name'] | MDSec System Calls | dharma_ransomware |
| external_references[6]['description'] | MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021. | Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022. |
| external_references[6]['url'] | https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/ | https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/ |
| external_references[7]['source_name'] | SCADAfence_ransomware | MDSec System Calls |
| external_references[7]['description'] | Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022. | MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021. |
| external_references[7]['url'] | https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf | https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/ |
| external_references[8]['source_name'] | demystifying_ryuk | SCADAfence_ransomware |
| external_references[8]['description'] | Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022. | Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022. |
| external_references[8]['url'] | https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947 | https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf |
| external_references[9]['source_name'] | capec | demystifying_ryuk |
| external_references[9]['url'] | https://capec.mitre.org/data/definitions/578.html | https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[1] | Driver: Driver Load | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[2] | Windows Registry: Windows Registry Key Modification | Process: Process Termination |
| x_mitre_data_sources[3] | Service: Service Metadata | Sensor Health: Host Status |
| x_mitre_data_sources[4] | Command: Command Execution | Driver: Driver Load |
| x_mitre_data_sources[5] | Process: Process Termination | Service: Service Metadata |
| x_mitre_data_sources[6] | Sensor Health: Host Status | Command: Command Execution |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Lucas Heiligenstein |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | Lucas Heiligenstein | |
[T1561.002] Disk Wipe: Disk Structure Wipe
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may corrupt or wipe the disk data structures on | t | Adversaries may corrupt or wipe the disk data structures on |
| a hard drive necessary to boot a system; targeting specific | | a hard drive necessary to boot a system; targeting specific |
| critical systems or in large numbers in a network to interru | | critical systems or in large numbers in a network to interru |
| pt availability to system and network resources. Adversari | | pt availability to system and network resources. Adversari |
| es may attempt to render the system unable to boot by overwr | | es may attempt to render the system unable to boot by overwr |
| iting critical data located in structures such as the master | | iting critical data located in structures such as the master |
| boot record (MBR) or partition table.(Citation: Symantec Sh | | boot record (MBR) or partition table.(Citation: Symantec Sh |
| amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa | | amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa |
| lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 | | lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201 |
| 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di | | 7)(Citation: Unit 42 Shamoon3 2018) The data contained in di |
| sk structures may include the initial executable code for lo | | sk structures may include the initial executable code for lo |
| ading an operating system or the location of the file system | | ading an operating system or the location of the file system |
| partitions on disk. If this information is not present, the | | partitions on disk. If this information is not present, the |
| computer will not be able to load an operating system durin | | computer will not be able to load an operating system durin |
| g the boot process, leaving the computer unavailable. [Disk | | g the boot process, leaving the computer unavailable. [Disk |
| Structure Wipe](https://attack.mitre.org/techniques/T1561/00 | | Structure Wipe](https://attack.mitre.org/techniques/T1561/00 |
| 2) may be performed in isolation, or along with [Disk Conten | | 2) may be performed in isolation, or along with [Disk Conten |
| t Wipe](https://attack.mitre.org/techniques/T1561/001) if al | | t Wipe](https://attack.mitre.org/techniques/T1561/001) if al |
| l sectors of a disk are wiped. To maximize impact on the ta | | l sectors of a disk are wiped. On a network devices, advers |
| rget organization, malware designed for destroying disk stru | | aries may reformat the file system using [Network Device CLI |
| ctures may have worm-like features to propagate across a net | | ](https://attack.mitre.org/techniques/T1059/008) commands su |
| work by leveraging other techniques like [Valid Accounts](ht | | ch as `format`.(Citation: format_cmd_cisco) To maximize imp |
| tps://attack.mitre.org/techniques/T1078), [OS Credential Dum | | act on the target organization, malware designed for destroy |
| ping](https://attack.mitre.org/techniques/T1003), and [SMB/W | | ing disk structures may have worm-like features to propagate |
| indows Admin Shares](https://attack.mitre.org/techniques/T10 | | across a network by leveraging other techniques like [Valid |
| 21/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye | | Accounts](https://attack.mitre.org/techniques/T1078), [OS C |
| Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Cita | | redential Dumping](https://attack.mitre.org/techniques/T1003 |
| tion: Kaspersky StoneDrill 2017) | | ), and [SMB/Windows Admin Shares](https://attack.mitre.org/t |
| | | echniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citat |
| | | ion: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon N |
| | | ov 2016)(Citation: Kaspersky StoneDrill 2017) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_contributors | | ['Austin Clark, @c2defense'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'root', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-28 23:00:00.367000+00:00 | 2023-04-14 19:38:24.089000+00:00 |
| description | Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped.
To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) | Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped.
On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco)
To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) |
| external_references[1]['source_name'] | Symantec Shamoon 2012 | format_cmd_cisco |
| external_references[1]['description'] | Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019. | Cisco. (2022, August 16). format - Cisco IOS Configuration Fundamentals Command Reference. Retrieved July 13, 2022. |
| external_references[1]['url'] | https://www.symantec.com/connect/blogs/shamoon-attacks | https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/F_through_K.html#wp2829794668 |
| external_references[2]['source_name'] | FireEye Shamoon Nov 2016 | Unit 42 Shamoon3 2018 |
| external_references[2]['description'] | FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017. | Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019. |
| external_references[2]['url'] | https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html | https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/ |
| external_references[4]['source_name'] | Kaspersky StoneDrill 2017 | FireEye Shamoon Nov 2016 |
| external_references[4]['description'] | Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019. | FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017. |
| external_references[4]['url'] | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf | https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html |
| external_references[5]['source_name'] | Unit 42 Shamoon3 2018 | Kaspersky StoneDrill 2017 |
| external_references[5]['description'] | Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019. | Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019. |
| external_references[5]['url'] | https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/ | https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf |
| x_mitre_data_sources[2] | Command: Command Execution | Driver: Driver Load |
| x_mitre_data_sources[3] | Driver: Driver Load | Command: Command Execution |
| x_mitre_detection | Look for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the \\\\.\\ notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity. | Look for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the \\\\.\\ notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity.
For network infrastructure devices, collect AAA logging to monitor for `format` commands being run to erase the file structure and prevent recovery of the device. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Symantec Shamoon 2012', 'description': 'Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.', 'url': 'https://www.symantec.com/connect/blogs/shamoon-attacks'} |
| x_mitre_platforms | | Network |
[T1561] Disk Wipe
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may wipe or corrupt raw disk data on specific sy | t | Adversaries may wipe or corrupt raw disk data on specific sy |
| stems or in large numbers in a network to interrupt availabi | | stems or in large numbers in a network to interrupt availabi |
| lity to system and network resources. With direct write acce | | lity to system and network resources. With direct write acce |
| ss to a disk, adversaries may attempt to overwrite portions | | ss to a disk, adversaries may attempt to overwrite portions |
| of disk data. Adversaries may opt to wipe arbitrary portions | | of disk data. Adversaries may opt to wipe arbitrary portions |
| of disk data and/or wipe disk structures like the master bo | | of disk data and/or wipe disk structures like the master bo |
| ot record (MBR). A complete wipe of all disk sectors may be | | ot record (MBR). A complete wipe of all disk sectors may be |
| attempted. To maximize impact on the target organization in | | attempted. To maximize impact on the target organization in |
| operations where network-wide availability interruption is | | operations where network-wide availability interruption is |
| the goal, malware used for wiping disks may have worm-like f | | the goal, malware used for wiping disks may have worm-like f |
| eatures to propagate across a network by leveraging addition | | eatures to propagate across a network by leveraging addition |
| al techniques like [Valid Accounts](https://attack.mitre.org | | al techniques like [Valid Accounts](https://attack.mitre.org |
| /techniques/T1078), [OS Credential Dumping](https://attack.m | | /techniques/T1078), [OS Credential Dumping](https://attack.m |
| itre.org/techniques/T1003), and [SMB/Windows Admin Shares](h | | itre.org/techniques/T1003), and [SMB/Windows Admin Shares](h |
| ttps://attack.mitre.org/techniques/T1021/002).(Citation: Nov | | ttps://attack.mitre.org/techniques/T1021/002).(Citation: Nov |
| etta Blockbuster Destructive Malware) | | etta Blockbuster Destructive Malware) On network devices, a |
| | | dversaries may wipe configuration files and other data from |
| | | the device using [Network Device CLI](https://attack.mitre.o |
| | | rg/techniques/T1059/008) commands such as `erase`.(Citation: |
| | | erase_cmd_cisco) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Austin Clark, @c2defense'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-28 18:55:35.987000+00:00 | 2023-04-20 18:16:41.942000+00:00 |
| description | Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) | Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted.
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)
On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco) |
| external_references[1]['source_name'] | Novetta Blockbuster Destructive Malware | erase_cmd_cisco |
| external_references[1]['description'] | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. | Cisco. (2022, August 16). erase - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022. |
| external_references[1]['url'] | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf | https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/D_through_E.html#wp3557227463 |
| external_references[2]['source_name'] | Microsoft Sysmon v6 May 2017 | Novetta Blockbuster Destructive Malware |
| external_references[2]['description'] | Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017. | Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. |
| external_references[2]['url'] | https://docs.microsoft.com/sysinternals/downloads/sysmon | https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Drive: Drive Access | Drive: Drive Modification |
| x_mitre_data_sources[1] | Command: Command Execution | Process: Process Creation |
| x_mitre_data_sources[2] | Process: Process Creation | Command: Command Execution |
| x_mitre_data_sources[4] | Drive: Drive Modification | Drive: Drive Access |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Sysmon v6 May 2017', 'description': 'Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017.', 'url': 'https://docs.microsoft.com/sysinternals/downloads/sysmon'} |
| x_mitre_platforms | | Network |
[T1021.003] Remote Services: Distributed Component Object Model
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-23 18:58:32.752000+00:00 | 2023-04-03 18:58:54.034000+00:00 |
| external_references[3]['source_name'] | Microsoft Process Wide Com Keys | Microsoft COM ACL |
| external_references[3]['description'] | Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017. | Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017. |
| external_references[3]['url'] | https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx | https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1 |
| external_references[4]['source_name'] | Microsoft COM ACL | Microsoft Process Wide Com Keys |
| external_references[4]['description'] | Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017. | Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1 | https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx |
| external_references[5]['source_name'] | Enigma Outlook DCOM Lateral Movement Nov 2017 | MSDN WMI |
| external_references[5]['description'] | Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017. | Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016. |
| external_references[5]['url'] | https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/ | https://msdn.microsoft.com/en-us/library/aa394582.aspx |
| external_references[6]['source_name'] | Enigma MMC20 COM Jan 2017 | Enigma DCOM Lateral Movement Jan 2017 |
| external_references[6]['description'] | Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017. | Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017. |
| external_references[6]['url'] | https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ | https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/ |
| external_references[7]['source_name'] | Enigma DCOM Lateral Movement Jan 2017 | Enigma MMC20 COM Jan 2017 |
| external_references[7]['description'] | Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017. | Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017. |
| external_references[7]['url'] | https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/ | https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ |
| external_references[8]['source_name'] | Enigma Excel DCOM Sept 2017 | Enigma Outlook DCOM Lateral Movement Nov 2017 |
| external_references[8]['description'] | Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017. | Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017. |
| external_references[8]['url'] | https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/ | https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/ |
| external_references[9]['source_name'] | Cyberreason DCOM DDE Lateral Movement Nov 2017 | Enigma Excel DCOM Sept 2017 |
| external_references[9]['description'] | Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral movement via DCOM. Retrieved November 21, 2017. | Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017. |
| external_references[9]['url'] | https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom | https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/ |
| external_references[10]['source_name'] | MSDN WMI | Cyberreason DCOM DDE Lateral Movement Nov 2017 |
| external_references[10]['description'] | Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016. | Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral movement via DCOM. Retrieved November 21, 2017. |
| external_references[10]['url'] | https://msdn.microsoft.com/en-us/library/aa394582.aspx | https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom |
| x_mitre_data_sources[0] | Process: Process Creation | Module: Module Load |
| x_mitre_data_sources[2] | Module: Module Load | Process: Process Creation |
| x_mitre_version | 1.1 | 1.2 |
[T1087.002] Account Discovery: Domain Account
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may attempt to get a listing of domain accounts. | t | Adversaries may attempt to get a listing of domain accounts. |
| This information can help adversaries determine which domai | | This information can help adversaries determine which domai |
| n accounts exist to aid in follow-on behavior. Commands suc | | n accounts exist to aid in follow-on behavior such as target |
| h as <code>net user /domain</code> and <code>net group /doma | | ing specific accounts which possess particular privileges. |
| in</code> of the [Net](https://attack.mitre.org/software/S00 | | Commands such as <code>net user /domain</code> and <code>net |
| 39) utility, <code>dscacheutil -q group</code>on macOS, and | | group /domain</code> of the [Net](https://attack.mitre.org/ |
| <code>ldapsearch</code> on Linux can list domain users and g | | software/S0039) utility, <code>dscacheutil -q group</code>on |
| roups. | | macOS, and <code>ldapsearch</code> on Linux can list domain |
| | | users and groups. [PowerShell](https://attack.mitre.org/tec |
| | | hniques/T1059/001) cmdlets including <code>Get-ADUser</code> |
| | | and <code>Get-ADGroupMember</code> may enumerate members of |
| | | Active Directory groups. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-08-25 13:04:00.863000+00:00 | 2023-04-15 16:37:59.115000+00:00 |
| description | Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.
Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. | Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups. |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Command: Command Execution | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Process: Process Creation | Process: OS API Execution |
| x_mitre_data_sources[2] | Network Traffic: Network Traffic Content | Process: Process Creation |
| x_mitre_data_sources[4] | Process: OS API Execution | Command: Command Execution |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/575.html', 'external_id': 'CAPEC-575'} | |
[T1078.002] Valid Accounts: Domain Accounts
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 20:14:34.479000+00:00 | 2023-04-13 17:17:03.605000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | User Account: User Account Authentication |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/560.html', 'external_id': 'CAPEC-560'} | |
| x_mitre_data_sources | User Account: User Account Authentication | |
[T1069.002] Permission Groups Discovery: Domain Groups
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 12:55:51.337000+00:00 | 2023-04-07 17:16:47.754000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Group: Group Enumeration |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Group: Group Enumeration | |
[T1584.001] Compromise Infrastructure: Domains
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may hijack domains and/or subdomains that can be | t | Adversaries may hijack domains and/or subdomains that can be |
| used during targeting. Domain registration hijacking is the | | used during targeting. Domain registration hijacking is the |
| act of changing the registration of a domain name without t | | act of changing the registration of a domain name without t |
| he permission of the original registrant.(Citation: ICANNDom | | he permission of the original registrant.(Citation: ICANNDom |
| ainNameHijacking) Adversaries may gain access to an email ac | | ainNameHijacking) Adversaries may gain access to an email ac |
| count for the person listed as the owner of the domain. The | | count for the person listed as the owner of the domain. The |
| adversary can then claim that they forgot their password in | | adversary can then claim that they forgot their password in |
| order to make changes to the domain registration. Other poss | | order to make changes to the domain registration. Other poss |
| ibilities include social engineering a domain registration h | | ibilities include social engineering a domain registration h |
| elp desk to gain access to an account or taking advantage of | | elp desk to gain access to an account or taking advantage of |
| renewal process gaps.(Citation: Krebs DNS Hijack 2019) Sub | | renewal process gaps.(Citation: Krebs DNS Hijack 2019) Sub |
| domain hijacking can occur when organizations have DNS entri | | domain hijacking can occur when organizations have DNS entri |
| es that point to non-existent or deprovisioned resources. In | | es that point to non-existent or deprovisioned resources. In |
| such cases, an adversary may take control of a subdomain to | | such cases, an adversary may take control of a subdomain to |
| conduct operations with the benefit of the trust associated | | conduct operations with the benefit of the trust associated |
| with that domain.(Citation: Microsoft Sub Takeover 2020) | | with that domain.(Citation: Microsoft Sub Takeover 2020) A |
| | | dversaries who compromise a domain may also engage in domain |
| | | shadowing by creating malicious subdomains under their cont |
| | | rol while keeping any existing DNS records. As service will |
| | | not be disrupted, the malicious subdomains may go unnoticed |
| | | for long periods of time.(Citation: Palo Alto Unit 42 Domain |
| | | Shadowing 2022) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 14:10:48.814000+00:00 | 2023-03-07 13:05:42.901000+00:00 |
| description | Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)
Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020) | Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)
Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)
Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022) |
| external_references[3]['source_name'] | Microsoft Sub Takeover 2020 | Palo Alto Unit 42 Domain Shadowing 2022 |
| external_references[3]['description'] | Microsoft. (2020, September 29). Prevent dangling DNS entries and avoid subdomain takeover. Retrieved October 12, 2020. | Janos Szurdi, Rebekah Houser and Daiping Liu. (2022, September 21). Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime. Retrieved March 7, 2023. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover | https://unit42.paloaltonetworks.com/domain-shadowing/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[1] | Domain Name: Passive DNS | Domain Name: Domain Registration |
| x_mitre_data_sources[2] | Domain Name: Domain Registration | Domain Name: Passive DNS |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Sub Takeover 2020', 'description': 'Microsoft. (2020, September 29). Prevent dangling DNS entries and avoid subdomain takeover. Retrieved October 12, 2020.', 'url': 'https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover'} |
[T1189] Drive-by Compromise
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may gain access to a system through a user visit | t | Adversaries may gain access to a system through a user visit |
| ing a website over the normal course of browsing. With this | | ing a website over the normal course of browsing. With this |
| technique, the user's web browser is typically targeted for | | technique, the user's web browser is typically targeted for |
| exploitation, but adversaries may also use compromised websi | | exploitation, but adversaries may also use compromised websi |
| tes for non-exploitation behavior such as acquiring [Applica | | tes for non-exploitation behavior such as acquiring [Applica |
| tion Access Token](https://attack.mitre.org/techniques/T1550 | | tion Access Token](https://attack.mitre.org/techniques/T1550 |
| /001). Multiple ways of delivering exploit code to a browse | | /001). Multiple ways of delivering exploit code to a browse |
| r exist, including: * A legitimate website is compromised w | | r exist (i.e., [Drive-by Target](https://attack.mitre.org/te |
| here adversaries have injected some form of malicious code s | | chniques/T1608/004)), including: * A legitimate website is |
| uch as JavaScript, iFrames, and cross-site scripting. * Mali | | compromised where adversaries have injected some form of mal |
| cious ads are paid for and served through legitimate ad prov | | icious code such as JavaScript, iFrames, and cross-site scri |
| iders. * Built-in web application interfaces are leveraged f | | pting * Script files served to a legitimate website from a p |
| or the insertion of any other kind of object that can be use | | ublicly writeable cloud storage bucket are modified by an ad |
| d to display web content or contain a script that executes o | | versary * Malicious ads are paid for and served through legi |
| n the visiting client (e.g. forum posts, comments, and other | | timate ad providers (i.e., [Malvertising](https://attack.mit |
| user controllable web content). Often the website used by | | re.org/techniques/T1583/008)) * Built-in web application int |
| an adversary is one visited by a specific community, such as | | erfaces are leveraged for the insertion of any other kind of |
| government, a particular industry, or region, where the goa | | object that can be used to display web content or contain a |
| l is to compromise a specific user or set of users based on | | script that executes on the visiting client (e.g. forum pos |
| a shared interest. This kind of targeted campaign is often r | | ts, comments, and other user controllable web content). Oft |
| eferred to a strategic web compromise or watering hole attac | | en the website used by an adversary is one visited by a spec |
| k. There are several known examples of this occurring.(Citat | | ific community, such as government, a particular industry, o |
| ion: Shadowserver Strategic Web Compromise) Typical drive-b | | r region, where the goal is to compromise a specific user or |
| y compromise process: 1. A user visits a website that is us | | set of users based on a shared interest. This kind of targe |
| ed to host the adversary controlled content. 2. Scripts auto | | ted campaign is often referred to a strategic web compromise |
| matically execute, typically searching versions of the brows | | or watering hole attack. There are several known examples o |
| er and plugins for a potentially vulnerable version. * | | f this occurring.(Citation: Shadowserver Strategic Web Compr |
| The user may be required to assist in this process by enabli | | omise) Typical drive-by compromise process: 1. A user visi |
| ng scripting or active website components and ignoring warni | | ts a website that is used to host the adversary controlled c |
| ng dialog boxes. 3. Upon finding a vulnerable version, explo | | ontent. 2. Scripts automatically execute, typically searchin |
| it code is delivered to the browser. 4. If exploitation is s | | g versions of the browser and plugins for a potentially vuln |
| uccessful, then it will give the adversary code execution on | | erable version. * The user may be required to assist in |
| the user's system unless other protections are in place. | | this process by enabling scripting or active website compon |
| * In some cases a second visit to the website after the in | | ents and ignoring warning dialog boxes. 3. Upon finding a vu |
| itial scan is required before exploit code is delivered. Un | | lnerable version, exploit code is delivered to the browser. |
| like [Exploit Public-Facing Application](https://attack.mitr | | 4. If exploitation is successful, then it will give the adve |
| e.org/techniques/T1190), the focus of this technique is to e | | rsary code execution on the user's system unless other prote |
| xploit software on a client endpoint upon visiting a website | | ctions are in place. * In some cases a second visit to t |
| . This will commonly give an adversary access to systems on | | he website after the initial scan is required before exploit |
| the internal network instead of external systems that may be | | code is delivered. Unlike [Exploit Public-Facing Applicati |
| in a DMZ. Adversaries may also use compromised websites to | | on](https://attack.mitre.org/techniques/T1190), the focus of |
| deliver a user to a malicious application designed to [Stea | | this technique is to exploit software on a client endpoint |
| l Application Access Token](https://attack.mitre.org/techniq | | upon visiting a website. This will commonly give an adversar |
| ues/T1528)s, like OAuth tokens, to gain access to protected | | y access to systems on the internal network instead of exter |
| applications and information. These malicious applications h | | nal systems that may be in a DMZ. Adversaries may also use |
| ave been delivered through popups on legitimate websites.(Ci | | compromised websites to deliver a user to a malicious applic |
| tation: Volexity OceanLotus Nov 2017) | | ation designed to [Steal Application Access Token](https://a |
| | | ttack.mitre.org/techniques/T1528)s, like OAuth tokens, to ga |
| | | in access to protected applications and information. These m |
| | | alicious applications have been delivered through popups on |
| | | legitimate websites.(Citation: Volexity OceanLotus Nov 2017) |
Dropped Mitigations:
- T1189: Drive-by Compromise Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:11:47.798000+00:00 | 2023-04-14 23:58:45.490000+00:00 |
| description | Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).
Multiple ways of delivering exploit code to a browser exist, including:
* A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.
* Malicious ads are paid for and served through legitimate ad providers.
* Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content).
Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise)
Typical drive-by compromise process:
1. A user visits a website that is used to host the adversary controlled content.
2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version.
* The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.
3. Upon finding a vulnerable version, exploit code is delivered to the browser.
4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.
* In some cases a second visit to the website after the initial scan is required before exploit code is delivered.
Unlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.
Adversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017) | Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).
Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)), including:
* A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting
* Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary
* Malicious ads are paid for and served through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008))
* Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content).
Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise)
Typical drive-by compromise process:
1. A user visits a website that is used to host the adversary controlled content.
2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version.
* The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.
3. Upon finding a vulnerable version, exploit code is delivered to the browser.
4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.
* In some cases a second visit to the website after the initial scan is required before exploit code is delivered.
Unlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.
Adversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017) |
| x_mitre_data_sources[2] | Network Traffic: Network Traffic Content | Process: Process Creation |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
[T1608.004] Stage Capabilities: Drive-by Target
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may prepare an operational environment to infect | t | Adversaries may prepare an operational environment to infect |
| systems that visit a website over the normal course of brow | | systems that visit a website over the normal course of brow |
| sing. Endpoint systems may be compromised through browsing t | | sing. Endpoint systems may be compromised through browsing t |
| o adversary controlled sites, as in [Drive-by Compromise](ht | | o adversary controlled sites, as in [Drive-by Compromise](ht |
| tps://attack.mitre.org/techniques/T1189). In such cases, the | | tps://attack.mitre.org/techniques/T1189). In such cases, the |
| user's web browser is typically targeted for exploitation ( | | user's web browser is typically targeted for exploitation ( |
| often not requiring any extra user interaction once landing | | often not requiring any extra user interaction once landing |
| on the site), but adversaries may also set up websites for n | | on the site), but adversaries may also set up websites for n |
| on-exploitation behavior such as [Application Access Token]( | | on-exploitation behavior such as [Application Access Token]( |
| https://attack.mitre.org/techniques/T1550/001). Prior to [Dr | | https://attack.mitre.org/techniques/T1550/001). Prior to [Dr |
| ive-by Compromise](https://attack.mitre.org/techniques/T1189 | | ive-by Compromise](https://attack.mitre.org/techniques/T1189 |
| ), adversaries must stage resources needed to deliver that e | | ), adversaries must stage resources needed to deliver that e |
| xploit to users who browse to an adversary controlled site. | | xploit to users who browse to an adversary controlled site. |
| Drive-by content can be staged on adversary controlled infra | | Drive-by content can be staged on adversary controlled infra |
| structure that has been acquired ([Acquire Infrastructure](h | | structure that has been acquired ([Acquire Infrastructure](h |
| ttps://attack.mitre.org/techniques/T1583)) or previously com | | ttps://attack.mitre.org/techniques/T1583)) or previously com |
| promised ([Compromise Infrastructure](https://attack.mitre.o | | promised ([Compromise Infrastructure](https://attack.mitre.o |
| rg/techniques/T1584)). Adversaries may upload or inject mal | | rg/techniques/T1584)). Adversaries may upload or inject mal |
| icious web content, such as [JavaScript](https://attack.mitr | | icious web content, such as [JavaScript](https://attack.mitr |
| e.org/techniques/T1059/007), into websites.(Citation: FireEy | | e.org/techniques/T1059/007), into websites.(Citation: FireEy |
| e CFR Watering Hole 2012)(Citation: Gallagher 2015) This may | | e CFR Watering Hole 2012)(Citation: Gallagher 2015) This may |
| be done in a number of ways, including inserting malicious | | be done in a number of ways, including: * Inserting malici |
| script into web pages or other user controllable web content | | ous scripts into web pages or other user controllable web co |
| such as forum posts. Adversaries may also craft malicious w | | ntent such as forum posts * Modifying script files served to |
| eb advertisements and purchase ad space on a website through | | websites from publicly writeable cloud storage buckets * Cr |
| legitimate ad providers. In addition to staging content to | | afting malicious web advertisements and purchasing ad space |
| exploit a user's web browser, adversaries may also stage scr | | on a website through legitimate ad providers (i.e., [Malvert |
| ipting content to profile the user's browser (as in [Gather | | ising](https://attack.mitre.org/techniques/T1583/008)) In a |
| Victim Host Information](https://attack.mitre.org/techniques | | ddition to staging content to exploit a user's web browser, |
| /T1592)) to ensure it is vulnerable prior to attempting expl | | adversaries may also stage scripting content to profile the |
| oitation.(Citation: ATT ScanBox) Websites compromised by an | | user's browser (as in [Gather Victim Host Information](https |
| adversary and used to stage a drive-by may be ones visited | | ://attack.mitre.org/techniques/T1592)) to ensure it is vulne |
| by a specific community, such as government, a particular in | | rable prior to attempting exploitation.(Citation: ATT ScanBo |
| dustry, or region, where the goal is to compromise a specifi | | x) Websites compromised by an adversary and used to stage a |
| c user or set of users based on a shared interest. This kind | | drive-by may be ones visited by a specific community, such |
| of targeted campaign is referred to a strategic web comprom | | as government, a particular industry, or region, where the g |
| ise or watering hole attack. Adversaries may purchase domai | | oal is to compromise a specific user or set of users based o |
| ns similar to legitimate domains (ex: homoglyphs, typosquatt | | n a shared interest. This kind of targeted campaign is refer |
| ing, different top-level domain, etc.) during acquisition of | | red to a strategic web compromise or watering hole attack. |
| infrastructure ([Domains](https://attack.mitre.org/techniqu | | Adversaries may purchase domains similar to legitimate domai |
| es/T1583/001)) to help facilitate [Drive-by Compromise](http | | ns (ex: homoglyphs, typosquatting, different top-level domai |
| s://attack.mitre.org/techniques/T1189). | | n, etc.) during acquisition of infrastructure ([Domains](htt |
| | | ps://attack.mitre.org/techniques/T1583/001)) to help facilit |
| | | ate [Drive-by Compromise](https://attack.mitre.org/technique |
| | | s/T1189). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:59:57.082000+00:00 | 2023-04-15 00:21:55.791000+00:00 |
| description | Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).
Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts. Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers. In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox)
Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). | Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).
Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including:
* Inserting malicious scripts into web pages or other user controllable web content such as forum posts
* Modifying script files served to websites from publicly writeable cloud storage buckets
* Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008))
In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox)
Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). |
| external_references[1]['source_name'] | FireEye CFR Watering Hole 2012 | ATT ScanBox |
| external_references[1]['description'] | Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020. | Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020. |
| external_references[1]['url'] | https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html | https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks |
| external_references[3]['source_name'] | ATT ScanBox | FireEye CFR Watering Hole 2012 |
| external_references[3]['description'] | Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020. | Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020. |
| external_references[3]['url'] | https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks | https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html |
| x_mitre_version | 1.2 | 1.3 |
[T1586.002] Compromise Accounts: Email Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may compromise email accounts that can be used d | t | Adversaries may compromise email accounts that can be used d |
| uring targeting. Adversaries can use compromised email accou | | uring targeting. Adversaries can use compromised email accou |
| nts to further their operations, such as leveraging them to | | nts to further their operations, such as leveraging them to |
| conduct [Phishing for Information](https://attack.mitre.org/ | | conduct [Phishing for Information](https://attack.mitre.org/ |
| techniques/T1598) or [Phishing](https://attack.mitre.org/tec | | techniques/T1598), [Phishing](https://attack.mitre.org/techn |
| hniques/T1566). Utilizing an existing persona with a comprom | | iques/T1566), or large-scale spam email campaigns. Utilizing |
| ised email account may engender a level of trust in a potent | | an existing persona with a compromised email account may en |
| ial victim if they have a relationship, or knowledge of, the | | gender a level of trust in a potential victim if they have a |
| compromised persona. Compromised email accounts can also be | | relationship with, or knowledge of, the compromised persona |
| used in the acquisition of infrastructure (ex: [Domains](ht | | . Compromised email accounts can also be used in the acquisi |
| tps://attack.mitre.org/techniques/T1583/001)). A variety of | | tion of infrastructure (ex: [Domains](https://attack.mitre.o |
| methods exist for compromising email accounts, such as gath | | rg/techniques/T1583/001)). A variety of methods exist for c |
| ering credentials via [Phishing for Information](https://att | | ompromising email accounts, such as gathering credentials vi |
| ack.mitre.org/techniques/T1598), purchasing credentials from | | a [Phishing for Information](https://attack.mitre.org/techni |
| third-party sites, or by brute forcing credentials (ex: pas | | ques/T1598), purchasing credentials from third-party sites, |
| sword reuse from breach credential dumps).(Citation: AnonHBG | | brute forcing credentials (ex: password reuse from breach cr |
| ary) Prior to compromising email accounts, adversaries may c | | edential dumps), or paying employees, suppliers or business |
| onduct Reconnaissance to inform decisions about which accoun | | partners for access to credentials.(Citation: AnonHBGary)(Ci |
| ts to compromise to further their operation. Adversaries ca | | tation: Microsoft DEV-0537) Prior to compromising email acco |
| n use a compromised email account to hijack existing email t | | unts, adversaries may conduct Reconnaissance to inform decis |
| hreads with targets of interest. | | ions about which accounts to compromise to further their ope |
| | | ration. Adversaries may target compromising well-known email |
| | | accounts or domains from which malicious spam or [Phishing] |
| | | (https://attack.mitre.org/techniques/T1566) emails may evade |
| | | reputation-based email filtering rules. Adversaries can us |
| | | e a compromised email account to hijack existing email threa |
| | | ds with targets of interest. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_contributors | | ['Tristan Bennett, Seamless Intelligence', 'Bryan Onel'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 02:57:25.544000+00:00 | 2023-04-11 01:07:48.218000+00:00 |
| description | Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).
A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.
Adversaries can use a compromised email account to hijack existing email threads with targets of interest. | Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).
A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or [Phishing](https://attack.mitre.org/techniques/T1566) emails may evade reputation-based email filtering rules.
Adversaries can use a compromised email account to hijack existing email threads with targets of interest. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'} |
[T1114] Email Collection
Current version: 2.4
Version changed from: 2.3 → 2.4
Dropped Mitigations:
- T1114: Email Collection Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 20:19:33.750000+00:00 | 2023-04-12 20:46:04.871000+00:00 |
| x_mitre_data_sources[1] | Logon Session: Logon Session Creation | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Application Log: Application Log Content | Logon Session: Logon Session Creation |
| x_mitre_version | 2.3 | 2.4 |
[T1114.003] Email Collection: Email Forwarding Rule
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may setup email forwarding rules to collect sens | t | Adversaries may setup email forwarding rules to collect sens |
| itive information. Adversaries may abuse email-forwarding ru | | itive information. Adversaries may abuse email forwarding ru |
| les to monitor the activities of a victim, steal information | | les to monitor the activities of a victim, steal information |
| , and further gain intelligence on the victim or the victim’ | | , and further gain intelligence on the victim or the victim’ |
| s organization to use as part of further exploits or operati | | s organization to use as part of further exploits or operati |
| ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo | | ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo |
| rwarding rules can allow adversaries to maintain persistent | | rwarding rules can allow adversaries to maintain persistent |
| access to victim's emails even after compromised credentials | | access to victim's emails even after compromised credentials |
| are reset by administrators.(Citation: Pfammatter - Hidden | | are reset by administrators.(Citation: Pfammatter - Hidden |
| Inbox Rules) Most email clients allow users to create inbox | | Inbox Rules) Most email clients allow users to create inbox |
| rules for various email functions, including forwarding to a | | rules for various email functions, including forwarding to a |
| different recipient. These rules may be created through a l | | different recipient. These rules may be created through a l |
| ocal email application, a web interface, or by command-line | | ocal email application, a web interface, or by command-line |
| interface. Messages can be forwarded to internal or external | | interface. Messages can be forwarded to internal or external |
| recipients, and there are no restrictions limiting the exte | | recipients, and there are no restrictions limiting the exte |
| nt of this rule. Administrators may also create forwarding r | | nt of this rule. Administrators may also create forwarding r |
| ules for user accounts with the same considerations and outc | | ules for user accounts with the same considerations and outc |
| omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar | | omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar |
| ding 2)(Citation: Mac Forwarding Rules) Any user or adminis | | ding 2)(Citation: Mac Forwarding Rules) Any user or adminis |
| trator within the organization (or adversary with valid cred | | trator within the organization (or adversary with valid cred |
| entials) can create rules to automatically forward all recei | | entials) can create rules to automatically forward all recei |
| ved messages to another recipient, forward emails to differe | | ved messages to another recipient, forward emails to differe |
| nt locations based on the sender, and more. Adversaries may | | nt locations based on the sender, and more. Adversaries may |
| also hide the rule by making use of the Microsoft Messaging | | also hide the rule by making use of the Microsoft Messaging |
| API (MAPI) to modify the rule properties, making it hidden a | | API (MAPI) to modify the rule properties, making it hidden a |
| nd not visible from Outlook, OWA or most Exchange Administra | | nd not visible from Outlook, OWA or most Exchange Administra |
| tion tools.(Citation: Pfammatter - Hidden Inbox Rules) | | tion tools.(Citation: Pfammatter - Hidden Inbox Rules) In s |
| | | ome environments, administrators may be able to enable email |
| | | forwarding rules that operate organization-wide rather than |
| | | on individual inboxes. For example, Microsoft Exchange supp |
| | | orts transport rules that evaluate all mail an organization |
| | | receives against user-specified conditions, then performs a |
| | | user-specified action on mail that adheres to those conditio |
| | | ns.(Citation: Microsoft Mail Flow Rules 2023) Adversaries th |
| | | at abuse such features may be able to enable forwarding on a |
| | | ll or specific mail an organization receives. |
New Detections:
- DS0017: Command (Command Execution)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 20:19:33.416000+00:00 | 2023-04-12 20:47:47.583000+00:00 |
| description | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules)
In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives. |
| external_references[1]['source_name'] | US-CERT TA18-068A 2018 | Mac Forwarding Rules |
| external_references[1]['description'] | US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019. | Apple. (n.d.). Reply to, forward, or redirect emails in Mail on Mac. Retrieved June 22, 2021. |
| external_references[1]['url'] | https://www.us-cert.gov/ncas/alerts/TA18-086A | https://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/mac |
| external_references[4]['source_name'] | Mac Forwarding Rules | Microsoft Mail Flow Rules 2023 |
| external_references[4]['description'] | Apple. (n.d.). Reply to, forward, or redirect emails in Mail on Mac. Retrieved June 22, 2021. | Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023. |
| external_references[4]['url'] | https://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/mac | https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'US-CERT TA18-068A 2018', 'description': 'US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-086A'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
| x_mitre_data_sources | | Command: Command Execution |
[T1564.008] Hide Artifacts: Email Hiding Rules
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use email rules to hide inbound emails in a | t | Adversaries may use email rules to hide inbound emails in a |
| compromised user's mailbox. Many email clients allow users t | | compromised user's mailbox. Many email clients allow users t |
| o create inbox rules for various email functions, including | | o create inbox rules for various email functions, including |
| moving emails to other folders, marking emails as read, or d | | moving emails to other folders, marking emails as read, or d |
| eleting emails. Rules may be created or modified within emai | | eleting emails. Rules may be created or modified within emai |
| l clients or through external features such as the <code>New | | l clients or through external features such as the <code>New |
| -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] | | -InboxRule</code> or <code>Set-InboxRule</code> [PowerShell] |
| (https://attack.mitre.org/techniques/T1059/001) cmdlets on W | | (https://attack.mitre.org/techniques/T1059/001) cmdlets on W |
| indows systems.(Citation: Microsoft Inbox Rules)(Citation: M | | indows systems.(Citation: Microsoft Inbox Rules)(Citation: M |
| acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio | | acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio |
| n: Microsoft Set-InboxRule) Adversaries may utilize email r | | n: Microsoft Set-InboxRule) Adversaries may utilize email r |
| ules within a compromised user's mailbox to delete and/or mo | | ules within a compromised user's mailbox to delete and/or mo |
| ve emails to less noticeable folders. Adversaries may do thi | | ve emails to less noticeable folders. Adversaries may do thi |
| s to hide security alerts, C2 communication, or responses to | | s to hide security alerts, C2 communication, or responses to |
| [Internal Spearphishing](https://attack.mitre.org/technique | | [Internal Spearphishing](https://attack.mitre.org/technique |
| s/T1534) emails sent from the compromised account. Any user | | s/T1534) emails sent from the compromised account. Any user |
| or administrator within the organization (or adversary with | | or administrator within the organization (or adversary with |
| valid credentials) may be able to create rules to automatic | | valid credentials) may be able to create rules to automatic |
| ally move or delete emails. These rules can be abused to imp | | ally move or delete emails. These rules can be abused to imp |
| air/delay detection had the email content been immediately s | | air/delay detection had the email content been immediately s |
| een by a user or defender. Malicious rules commonly filter o | | een by a user or defender. Malicious rules commonly filter o |
| ut emails based on key words (such as <code>malware</code>, | | ut emails based on key words (such as <code>malware</code>, |
| <code>suspicious</code>, <code>phish</code>, and <code>hack< | | <code>suspicious</code>, <code>phish</code>, and <code>hack< |
| /code>) found in message bodies and subject lines. (Citation | | /code>) found in message bodies and subject lines. (Citation |
| : Microsoft Cloud App Security) | | : Microsoft Cloud App Security) In some environments, admin |
| | | istrators may be able to enable email rules that operate org |
| | | anization-wide rather than on individual inboxes. For exampl |
| | | e, Microsoft Exchange supports transport rules that evaluate |
| | | all mail an organization receives against user-specified co |
| | | nditions, then performs a user-specified action on mail that |
| | | adheres to those conditions.(Citation: Microsoft Mail Flow |
| | | Rules 2023) Adversaries that abuse such features may be able |
| | | to automatically modify or delete all emails related to spe |
| | | cific topics (such as internal security incident notificatio |
| | | ns). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-12 15:22:29.599000+00:00 | 2023-04-12 20:42:20.079000+00:00 |
| description | Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)
Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.
Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security) | Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)
Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.
Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)
In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications). |
| external_references[3]['source_name'] | Microsoft Inbox Rules | Microsoft Mail Flow Rules 2023 |
| external_references[3]['description'] | Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021. | Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023. |
| external_references[3]['url'] | https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59 | https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules |
| external_references[4]['source_name'] | Microsoft New-InboxRule | Microsoft Inbox Rules |
| external_references[4]['description'] | Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021. | Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps | https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59 |
| external_references[5]['source_name'] | Microsoft Set-InboxRule | Microsoft New-InboxRule |
| external_references[5]['description'] | Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021. | Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021. |
| external_references[5]['url'] | https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps | https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps |
| external_references[6]['source_name'] | Microsoft Cloud App Security | Microsoft Set-InboxRule |
| external_references[6]['description'] | Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021. | Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021. |
| external_references[6]['url'] | https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154 | https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Cloud App Security', 'description': 'Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021.', 'url': 'https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
| x_mitre_data_sources | | File: File Modification |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | File: File Modification | |
[T1611] Escape to Host
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1042: Disable or Remove Feature or Program
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 20:03:06.707000+00:00 | 2023-04-15 16:21:04.265000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Container: Container Creation |
| x_mitre_data_sources | | Process: Process Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process: Process Creation | |
| x_mitre_data_sources | Container: Container Creation | |
[T1048] Exfiltration Over Alternative Protocol
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may steal data by exfiltrating it over a differe | t | Adversaries may steal data by exfiltrating it over a differe |
| nt protocol than that of the existing command and control ch | | nt protocol than that of the existing command and control ch |
| annel. The data may also be sent to an alternate network loc | | annel. The data may also be sent to an alternate network loc |
| ation from the main command and control server. Alternate | | ation from the main command and control server. Alternate |
| protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other | | protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other |
| network protocol not being used as the main command and con | | network protocol not being used as the main command and con |
| trol channel. Different protocol channels could also include | | trol channel. Adversaries may also opt to encrypt and/or obf |
| Web services such as cloud storage. Adversaries may also op | | uscate these alternate channels. [Exfiltration Over Altern |
| t to encrypt and/or obfuscate these alternate channels. [E | | ative Protocol](https://attack.mitre.org/techniques/T1048) c |
| xfiltration Over Alternative Protocol](https://attack.mitre. | | an be done using various common operating system utilities s |
| org/techniques/T1048) can be done using various common opera | | uch as [Net](https://attack.mitre.org/software/S0039)/SMB or |
| ting system utilities such as [Net](https://attack.mitre.org | | FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linu |
| /software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct | | x <code>curl</code> may be used to invoke protocols such as |
| 2016) On macOS and Linux <code>curl</code> may be used to in | | HTTP/S or FTP/S to exfiltrate data from a system.(Citation: |
| voke protocols such as HTTP/S or FTP/S to exfiltrate data fr | | 20 macOS Common Tools and Techniques) Many IaaS and SaaS pl |
| om a system.(Citation: 20 macOS Common Tools and Techniques) | | atforms (such as Microsoft Exchange, Microsoft SharePoint, G |
| | | itHub, and AWS S3) support the direct download of files, ema |
| | | ils, source code, and other sensitive information via the we |
| | | b console or [Cloud API](https://attack.mitre.org/techniques |
| | | /T1059/009). |
New Mitigations:
- M1018: User Account Management
- M1022: Restrict File and Directory Permissions
New Detections:
- DS0010: Cloud Storage (Cloud Storage Access)
- DS0015: Application Log (Application Log Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_network_requirements | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:49:28.766000+00:00 | 2023-04-15 00:58:36.287000+00:00 |
| description | Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.
[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) | Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels.
[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques)
Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009). |
| external_references[1]['source_name'] | Palo Alto OilRig Oct 2016 | University of Birmingham C2 |
| external_references[1]['description'] | Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017. | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. |
| external_references[1]['url'] | http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/ | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf |
| external_references[2]['source_name'] | 20 macOS Common Tools and Techniques | Palo Alto OilRig Oct 2016 |
| external_references[2]['description'] | Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021. | Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017. |
| external_references[2]['url'] | https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/ | http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/ |
| external_references[3]['source_name'] | University of Birmingham C2 | 20 macOS Common Tools and Techniques |
| external_references[3]['description'] | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. | Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021. |
| external_references[3]['url'] | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf | https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/ |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_data_sources[3] | Command: Command Execution | Cloud Storage: Cloud Storage Access |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Application Log: Application Log Content |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
| x_mitre_data_sources | | Command: Command Execution |
| x_mitre_platforms | | Office 365 |
| x_mitre_platforms | | SaaS |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Google Workspace |
| x_mitre_platforms | | Network |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network Traffic: Network Connection Creation | |
[T1041] Exfiltration Over C2 Channel
Current version: 2.2
Version changed from: 2.1 → 2.2
Dropped Mitigations:
- T1041: Exfiltration Over Command and Control Channel Mitigation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
| x_mitre_network_requirements | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:45:50.620000+00:00 | 2023-04-07 17:09:14.040000+00:00 |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Content | File: File Access |
| x_mitre_data_sources[1] | Command: Command Execution | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[3] | Network Traffic: Network Connection Creation | Command: Command Execution |
| x_mitre_data_sources[4] | File: File Access | Network Traffic: Network Connection Creation |
| x_mitre_version | 2.1 | 2.2 |
[T1048.003] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | Adversaries may steal data by exfiltrating it over an un-enc | t | Adversaries may steal data by exfiltrating it over an un-enc |
| rypted network protocol other than that of the existing comm | | rypted network protocol other than that of the existing comm |
| and and control channel. The data may also be sent to an alt | | and and control channel. The data may also be sent to an alt |
| ernate network location from the main command and control se | | ernate network location from the main command and control se |
| rver. Adversaries may opt to obfuscate this data, without | | rver.(Citation: copy_cmd_cisco) Adversaries may opt to obfu |
| the use of encryption, within network protocols that are nat | | scate this data, without the use of encryption, within netwo |
| ively unencrypted (such as HTTP, FTP, or DNS). This may incl | | rk protocols that are natively unencrypted (such as HTTP, FT |
| ude custom or publicly available encoding/compression algori | | P, or DNS). This may include custom or publicly available en |
| thms (such as base64) as well as embedding data within proto | | coding/compression algorithms (such as base64) as well as em |
| col headers and fields. | | bedding data within protocol headers and fields. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_network_requirements | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-12 19:57:45.277000+00:00 | 2023-04-12 23:39:25.476000+00:00 |
| description | Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. | Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)
Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. |
| external_references[1]['source_name'] | University of Birmingham C2 | copy_cmd_cisco |
| external_references[1]['description'] | Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. | Cisco. (2022, August 16). copy - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022. |
| external_references[1]['url'] | https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf | https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Content | Command: Command Execution |
| x_mitre_data_sources[2] | Command: Command Execution | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[4] | Network Traffic: Network Connection Creation | Network Traffic: Network Traffic Content |
| x_mitre_detection | Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) | Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)
For network infrastructure devices, collect AAA logging to monitor for `copy` commands being run to exfiltrate configuration files to non-standard destinations over unencrypted protocols such as TFTP. |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'} |
| x_mitre_contributors | | Austin Clark, @c2defense |
| x_mitre_platforms | | Network |
[T1190] Exploit Public-Facing Application
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may attempt to take advantage of a weakness in a | t | Adversaries may attempt to exploit a weakness in an Internet |
| n Internet-facing computer or program using software, data, | | -facing host or system to initially access a network. The we |
| or commands in order to cause unintended or unanticipated be | | akness in the system can be a software bug, a temporary glit |
| havior. The weakness in the system can be a bug, a glitch, o | | ch, or a misconfiguration. Exploited applications are often |
| r a design vulnerability. These applications are often websi | | websites/web servers, but can also include databases (like |
| tes, but can include databases (like SQL), standard services | | SQL), standard services (like SMB or SSH), network device ad |
| (like SMB or SSH), network device administration and manage | | ministration and management protocols (like SNMP and Smart I |
| ment protocols (like SNMP and Smart Install), and any other | | nstall), and any other system with Internet accessible open |
| applications with Internet accessible open sockets, such as | | sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple |
| web servers and related services.(Citation: NVD CVE-2016-666 | | SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In |
| 2)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US- | | frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic |
| CERT TA18-106A Network Infrastructure Devices 2018)(Citation | | e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla |
| : Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7 | | w being exploited this may also involve [Exploitation for De |
| 169) Depending on the flaw being exploited this may include | | fense Evasion](https://attack.mitre.org/techniques/T1211). |
| [Exploitation for Defense Evasion](https://attack.mitre.org/ | | If an application is hosted on cloud-based infrastructure a |
| techniques/T1211). If an application is hosted on cloud-ba | | nd/or is containerized, then exploiting it may lead to compr |
| sed infrastructure and/or is containerized, then exploiting | | omise of the underlying instance or container. This can allo |
| it may lead to compromise of the underlying instance or cont | | w an adversary a path to access the cloud or container APIs, |
| ainer. This can allow an adversary a path to access the clou | | exploit container host access via [Escape to Host](https:// |
| d or container APIs, exploit container host access via [Esca | | attack.mitre.org/techniques/T1611), or take advantage of wea |
| pe to Host](https://attack.mitre.org/techniques/T1611), or t | | k identity and access management policies. Adversaries may |
| ake advantage of weak identity and access management policie | | also exploit edge network infrastructure and related applian |
| s. For websites and databases, the OWASP top 10 and CWE top | | ces, specifically targeting devices that do not support robu |
| 25 highlight the most common web-based vulnerabilities.(Cit | | st host-based defenses.(Citation: Mandiant Fortinet Zero Day |
| ation: OWASP Top 10)(Citation: CWE top 25) | | )(Citation: Wired Russia Cyberwar) For websites and databas |
| | | es, the OWASP top 10 and CWE top 25 highlight the most commo |
| | | n web-based vulnerabilities.(Citation: OWASP Top 10)(Citatio |
| | | n: CWE top 25) |
Dropped Mitigations:
- T1190: Exploit Public-Facing Application Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 17:06:53.032000+00:00 | 2023-04-14 22:18:39.190000+00:00 |
| description | Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) |
| external_references[3]['source_name'] | NVD CVE-2016-6662 | Wired Russia Cyberwar |
| external_references[3]['description'] | National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018. | Greenberg, A. (2022, November 10). Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless. Retrieved March 22, 2023. |
| external_references[3]['url'] | https://nvd.nist.gov/vuln/detail/CVE-2016-6662 | https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/ |
| external_references[4]['source_name'] | NVD CVE-2014-7169 | Mandiant Fortinet Zero Day |
| external_references[4]['description'] | National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018. | Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023. |
| external_references[4]['url'] | https://nvd.nist.gov/vuln/detail/CVE-2014-7169 | https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem |
| external_references[5]['source_name'] | Cisco Blog Legacy Device Attacks | NVD CVE-2016-6662 |
| external_references[5]['description'] | Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020. | National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018. |
| external_references[5]['url'] | https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954 | https://nvd.nist.gov/vuln/detail/CVE-2016-6662 |
| external_references[6]['source_name'] | OWASP Top 10 | NVD CVE-2014-7169 |
| external_references[6]['description'] | OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018. | National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018. |
| external_references[6]['url'] | https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project | https://nvd.nist.gov/vuln/detail/CVE-2014-7169 |
| external_references[7]['source_name'] | US-CERT TA18-106A Network Infrastructure Devices 2018 | Cisco Blog Legacy Device Attacks |
| external_references[7]['description'] | US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020. | Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020. |
| external_references[7]['url'] | https://us-cert.cisa.gov/ncas/alerts/TA18-106A | https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Application Log: Application Log Content | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[1] | Network Traffic: Network Traffic Content | Application Log: Application Log Content |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'OWASP Top 10', 'description': 'OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.', 'url': 'https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project'} |
| external_references | | {'source_name': 'US-CERT TA18-106A Network Infrastructure Devices 2018', 'description': 'US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.', 'url': 'https://us-cert.cisa.gov/ncas/alerts/TA18-106A'} |
[T1068] Exploitation for Privilege Escalation
Current version: 1.5
Version changed from: 1.4 → 1.5
Dropped Mitigations:
- T1068: Exploitation for Privilege Escalation Mitigation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-06-16 19:25:12.835000+00:00 | 2023-04-07 17:13:54.168000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Driver: Driver Load | Process: Process Creation |
| x_mitre_data_sources[1] | Process: Process Creation | Driver: Driver Load |
| x_mitre_version | 1.4 | 1.5 |
[T1606] Forge Web Credentials
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may forge credential materials that can be used | t | Adversaries may forge credential materials that can be used |
| to gain access to web applications or Internet services. Web | | to gain access to web applications or Internet services. Web |
| applications and services (hosted in cloud SaaS environment | | applications and services (hosted in cloud SaaS environment |
| s or on-premise servers) often use session cookies, tokens, | | s or on-premise servers) often use session cookies, tokens, |
| or other materials to authenticate and authorize user access | | or other materials to authenticate and authorize user access |
| . Adversaries may generate these credential materials in or | | . Adversaries may generate these credential materials in or |
| der to gain access to web resources. This differs from [Stea | | der to gain access to web resources. This differs from [Stea |
| l Web Session Cookie](https://attack.mitre.org/techniques/T1 | | l Web Session Cookie](https://attack.mitre.org/techniques/T1 |
| 539), [Steal Application Access Token](https://attack.mitre. | | 539), [Steal Application Access Token](https://attack.mitre. |
| org/techniques/T1528), and other similar behaviors in that t | | org/techniques/T1528), and other similar behaviors in that t |
| he credentials are new and forged by the adversary, rather t | | he credentials are new and forged by the adversary, rather t |
| han stolen or intercepted from legitimate users. The generat | | han stolen or intercepted from legitimate users. The generat |
| ion of web credentials often requires secret values, such as | | ion of web credentials often requires secret values, such as |
| passwords, [Private Keys](https://attack.mitre.org/techniqu | | passwords, [Private Keys](https://attack.mitre.org/techniqu |
| es/T1552/004), or other cryptographic seed values.(Citation: | | es/T1552/004), or other cryptographic seed values.(Citation: |
| GitHub AWS-ADFS-Credential-Generator) Once forged, adversa | | GitHub AWS-ADFS-Credential-Generator) Adversaries may also |
| ries may use these web credentials to access resources (ex: | | forge tokens by taking advantage of features such as the `As |
| [Use Alternate Authentication Material](https://attack.mitre | | sumeRole` and `GetFederationToken` APIs in AWS, which allow |
| .org/techniques/T1550)), which may bypass multi-factor and o | | users to request temporary security credentials.(Citation: A |
| ther authentication protection mechanisms.(Citation: Pass Th | | WS Temporary Security Credentials) Once forged, adversaries |
| e Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019) | | may use these web credentials to access resources (ex: [Use |
| (Citation: Microsoft SolarWinds Customer Guidance) | | Alternate Authentication Material](https://attack.mitre.org |
| | | /techniques/T1550)), which may bypass multi-factor and other |
| | | authentication protection mechanisms.(Citation: Pass The Co |
| | | okie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Cit |
| | | ation: Microsoft SolarWinds Customer Guidance) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_contributors | | ['Dylan'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-12 14:26:52.179000+00:00 | 2023-04-12 21:35:48.084000+00:00 |
| description | Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.
Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator)
Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance) | Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.
Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials.(Citation: AWS Temporary Security Credentials)
Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance) |
| external_references[1]['source_name'] | GitHub AWS-ADFS-Credential-Generator | AWS Temporary Security Credentials |
| external_references[1]['description'] | Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved December 16, 2020. | AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022. |
| external_references[1]['url'] | https://github.com/damianh/aws-adfs-credential-generator | https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html |
| external_references[2]['source_name'] | Pass The Cookie | Unit 42 Mac Crypto Cookies January 2019 |
| external_references[2]['description'] | Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019. | Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019. |
| external_references[2]['url'] | https://wunderwuzzi23.github.io/blog/passthecookie.html | https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ |
| external_references[3]['source_name'] | Unit 42 Mac Crypto Cookies January 2019 | GitHub AWS-ADFS-Credential-Generator |
| external_references[3]['description'] | Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019. | Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved December 16, 2020. |
| external_references[3]['url'] | https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ | https://github.com/damianh/aws-adfs-credential-generator |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Pass The Cookie', 'description': 'Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.', 'url': 'https://wunderwuzzi23.github.io/blog/passthecookie.html'} |
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Logon Session: Logon Session Creation | |
[T1615] Group Policy Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may gather information on Group Policy settings | t | Adversaries may gather information on Group Policy settings |
| to identify paths for privilege escalation, security measure | | to identify paths for privilege escalation, security measure |
| s applied within a domain, and to discover patterns in domai | | s applied within a domain, and to discover patterns in domai |
| n objects that can be manipulated or used to blend in the en | | n objects that can be manipulated or used to blend in the en |
| vironment. Group Policy allows for centralized management of | | vironment. Group Policy allows for centralized management of |
| user and computer settings in Active Directory (AD). Group | | user and computer settings in Active Directory (AD). Group |
| policy objects (GPOs) are containers for group policy settin | | policy objects (GPOs) are containers for group policy settin |
| gs made up of files stored within a predicable network path | | gs made up of files stored within a predictable network path |
| <code>\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\</code>.(Citation: | | `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Gr |
| TechNet Group Policy Basics)(Citation: ADSecurity GPO Persis | | oup Policy Basics)(Citation: ADSecurity GPO Persistence 2016 |
| tence 2016) Adversaries may use commands such as <code>gpre | | ) Adversaries may use commands such as <code>gpresult</code |
| sult</code> or various publicly available PowerShell functio | | > or various publicly available PowerShell functions, such a |
| ns, such as <code>Get-DomainGPO</code> and <code>Get-DomainG | | s <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGro |
| POLocalGroup</code>, to gather information on Group Policy s | | up</code>, to gather information on Group Policy settings.(C |
| ettings.(Citation: Microsoft gpresult)(Citation: Github Powe | | itation: Microsoft gpresult)(Citation: Github PowerShell Emp |
| rShell Empire) Adversaries may use this information to shape | | ire) Adversaries may use this information to shape follow-on |
| follow-on behaviors, including determining potential attack | | behaviors, including determining potential attack paths wit |
| paths within the target network as well as opportunities to | | hin the target network as well as opportunities to manipulat |
| manipulate Group Policy settings (i.e. [Domain Policy Modif | | e Group Policy settings (i.e. [Domain Policy Modification](h |
| ication](https://attack.mitre.org/techniques/T1484)) for the | | ttps://attack.mitre.org/techniques/T1484)) for their benefit |
| ir benefit. | | . |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.1.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 23:16:28.296000+00:00 | 2023-01-06 12:41:08.579000+00:00 |
| description | Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predicable network path \\SYSVOL\\Policies\.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit. | Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\SYSVOL\\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit. |
| external_references[1]['source_name'] | TechNet Group Policy Basics | ADSecurity GPO Persistence 2016 |
| external_references[1]['description'] | srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019. | Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019. |
| external_references[1]['url'] | https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/ | https://adsecurity.org/?p=2716 |
| external_references[2]['source_name'] | ADSecurity GPO Persistence 2016 | Microsoft gpresult |
| external_references[2]['description'] | Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019. | Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021. |
| external_references[2]['url'] | https://adsecurity.org/?p=2716 | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult |
| external_references[3]['source_name'] | Microsoft gpresult | Github PowerShell Empire |
| external_references[3]['description'] | Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021. | Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. |
| external_references[3]['url'] | https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult | https://github.com/PowerShellEmpire/Empire |
| external_references[4]['source_name'] | Github PowerShell Empire | TechNet Group Policy Basics |
| external_references[4]['description'] | Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. | srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019. |
| external_references[4]['url'] | https://github.com/PowerShellEmpire/Empire | https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/ |
| x_mitre_data_sources[0] | Network Traffic: Network Traffic Content | Active Directory: Active Directory Object Access |
| x_mitre_data_sources[1] | Command: Command Execution | Script: Script Execution |
| x_mitre_data_sources[2] | Script: Script Execution | Process: Process Creation |
| x_mitre_data_sources[3] | Process: Process Creation | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[4] | Active Directory: Active Directory Object Access | Command: Command Execution |
| x_mitre_version | 1.0 | 1.1 |
[T1562] Impair Defenses
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may maliciously modify components of a victim en | t | Adversaries may maliciously modify components of a victim en |
| vironment in order to hinder or disable defensive mechanisms | | vironment in order to hinder or disable defensive mechanisms |
| . This not only involves impairing preventative defenses, su | | . This not only involves impairing preventative defenses, su |
| ch as firewalls and anti-virus, but also detection capabilit | | ch as firewalls and anti-virus, but also detection capabilit |
| ies that defenders can use to audit activity and identify ma | | ies that defenders can use to audit activity and identify ma |
| licious behavior. This may also span both native defenses as | | licious behavior. This may also span both native defenses as |
| well as supplemental capabilities installed by users and ad | | well as supplemental capabilities installed by users and ad |
| ministrators. Adversaries could also target event aggregati | | ministrators. Adversaries may also impair routine operation |
| on and analysis mechanisms, or otherwise disrupt these proce | | s that contribute to defensive hygiene, such as blocking use |
| dures by altering other system components. | | rs from logging out of a computer or stopping it from being |
| | | shut down. These restrictions can further enable malicious o |
| | | perations as well as the continued propagation of incidents. |
| | | (Citation: Emotet shutdown) Adversaries could also target e |
| | | vent aggregation and analysis mechanisms, or otherwise disru |
| | | pt these procedures by altering other system components. |
New Mitigations:
New Detections:
- DS0002: User Account (User Account Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-19 16:32:56.502000+00:00 | 2023-04-15 00:48:46.626000+00:00 |
| description | Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. | Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)
Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. |
| x_mitre_attack_spec_version | 2.1.0 | 3.1.0 |
| x_mitre_data_sources[0] | Cloud Service: Cloud Service Modification | Firewall: Firewall Rule Modification |
| x_mitre_data_sources[1] | Firewall: Firewall Rule Modification | Cloud Service: Cloud Service Disable |
| x_mitre_data_sources[2] | Process: Process Termination | Command: Command Execution |
| x_mitre_data_sources[3] | Service: Service Metadata | User Account: User Account Modification |
| x_mitre_data_sources[4] | Process: Process Creation | Cloud Service: Cloud Service Modification |
| x_mitre_data_sources[5] | Driver: Driver Load | Firewall: Firewall Disable |
| x_mitre_data_sources[6] | Firewall: Firewall Disable | Script: Script Execution |
| x_mitre_data_sources[7] | Command: Command Execution | Driver: Driver Load |
| x_mitre_data_sources[8] | Cloud Service: Cloud Service Disable | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[9] | Windows Registry: Windows Registry Key Deletion | Sensor Health: Host Status |
| x_mitre_data_sources[10] | Windows Registry: Windows Registry Key Modification | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[11] | Sensor Health: Host Status | Process: Process Termination |
| x_mitre_data_sources[12] | Script: Script Execution | Process: Process Creation |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Emotet shutdown', 'description': 'The DFIR Report. (2022, November 8). Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware. Retrieved March 6, 2023.', 'url': 'https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/#:~:text=Don’t%20Sleep%20has%20the%20capability%20to%20keep%20the%20computer%20from%20being%20shutdown%20and%20the%20user%20from%20being%20signed%20off.%20This%20was%20likely%20done%20to%20ensure%20nothing%20will%20interfere%20with%20the%20propagation%20of%20the%20ransomware%20payload'} |
| x_mitre_data_sources | | Service: Service Metadata |
[T1562.006] Impair Defenses: Indicator Blocking
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | An adversary may attempt to block indicators or events typic | t | An adversary may attempt to block indicators or events typic |
| ally captured by sensors from being gathered and analyzed. T | | ally captured by sensors from being gathered and analyzed. T |
| his could include maliciously redirecting (Citation: Microso | | his could include maliciously redirecting(Citation: Microsof |
| ft Lamin Sept 2017) or even disabling host-based sensors, su | | t Lamin Sept 2017) or even disabling host-based sensors, suc |
| ch as Event Tracing for Windows (ETW),(Citation: Microsoft A | | h as Event Tracing for Windows (ETW)(Citation: Microsoft Abo |
| bout Event Tracing 2018) by tampering settings that control | | ut Event Tracing 2018), by tampering settings that control t |
| the collection and flow of event telemetry. (Citation: Mediu | | he collection and flow of event telemetry.(Citation: Medium |
| m Event Tracing Tampering 2018) These settings may be stored | | Event Tracing Tampering 2018) These settings may be stored o |
| on the system in configuration files and/or in the Registry | | n the system in configuration files and/or in the Registry a |
| as well as being accessible via administrative utilities su | | s well as being accessible via administrative utilities such |
| ch as [PowerShell](https://attack.mitre.org/techniques/T1059 | | as [PowerShell](https://attack.mitre.org/techniques/T1059/0 |
| /001) or [Windows Management Instrumentation](https://attack | | 01) or [Windows Management Instrumentation](https://attack.m |
| .mitre.org/techniques/T1047). ETW interruption can be achie | | itre.org/techniques/T1047). For example, adversaries may mo |
| ved multiple ways, however most directly by defining conditi | | dify the `File` value in <code>HKEY_LOCAL_MACHINE\SYSTEM\Cur |
| ons using the [Powe |