ATT&CK Changes Between v12.1 and v13.0

Key

Colors for description field
Added
Changed
Deleted

Additional formats

These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.

This JSON file contains the machine readble output used to create this page: changelog.json

Techniques

enterprise-attack

New Techniques

[T1650] Acquire Access

Current version: 1.0

Description: Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022) Footholds to compromised systems may take a variety of forms, such as access to planted backdoors (e.g., [Web Shell](https://attack.mitre.org/techniques/T1505/003)) or established access via [External Remote Services](https://attack.mitre.org/techniques/T1133). In some cases, access brokers will implant compromised systems with a “load” that can be used to install additional malware for paying customers.(Citation: Microsoft Ransomware as a Service) By leveraging existing access broker networks rather than developing or obtaining their own initial access capabilities, an adversary can potentially reduce the resources required to gain a foothold on a target network and focus their efforts on later stages of compromise. Adversaries may prioritize acquiring access to systems that have been determined to lack security monitoring or that have high privileges, or systems that belong to organizations in a particular sector.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers) In some cases, purchasing access to an organization in sectors such as IT contracting, software development, or telecommunications may allow an adversary to compromise additional victims via a [Trusted Relationship](https://attack.mitre.org/techniques/T1199), [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111), or even [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195). **Note:** while this technique is distinct from other behaviors such as [Purchase Technical Data](https://attack.mitre.org/techniques/T1597/002) and [Credentials](https://attack.mitre.org/techniques/T1589/001), they may often be used in conjunction (especially where the acquired foothold requires [Valid Accounts](https://attack.mitre.org/techniques/T1078)).


[T1552.008] Unsecured Credentials: Chat Messages

Current version: 1.0

Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).


[T1059.009] Command and Scripting Interpreter: Cloud API

Current version: 1.0

Description: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: A), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). Cloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies. With proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment.


[T1651] Cloud Administration Command

Current version: 1.0

Description: Adversaries may abuse cloud management services to execute commands within virtual machines or hybrid-joined devices. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. Similarly, in Azure AD environments, Microsoft Endpoint Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to the Azure AD.(Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)(Citation: SpecterOps Lateral Movement from Azure to On-Prem AD 2020) If an adversary gains administrative access to a cloud environment, they may be able to abuse cloud management services to execute commands in the environment’s virtual machines or on-premises hybrid-joined devices. Additionally, an adversary that compromises a service provider or delegated administrator account may similarly be able to leverage a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) to execute commands in connected virtual machines.(Citation: MSTIC Nobelium Oct 2021)


[T1021.007] Remote Services: Cloud Services

Current version: 1.0

Description: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user. Many enterprises federate centrally managed user identities to cloud services, allowing users to login with their domain credentials in order to access the cloud control plane. Similarly, adversaries may connect to available cloud services through the web console or through the cloud command line interface (CLI) (e.g., [Cloud API](https://attack.mitre.org/techniques/T1059/009)), using commands such as Connect-AZAccount for Azure PowerShell, Connect-MgGraph for Microsoft Graph PowerShell, and gcloud auth login for the Google Cloud CLI. In some cases, adversaries may be able to authenticate to these services via [Application Access Token](https://attack.mitre.org/techniques/T1550/001) instead of a username and password.


[T1027.010] Obfuscated Files or Information: Command Obfuscation

Current version: 1.0

Description: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE) For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017) Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) Tools such as Invoke-Obfuscation and Invoke-DOSfucation have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)


[T1652] Device Driver Discovery

Current version: 1.0

Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)


[T1567.003] Exfiltration Over Web Service: Exfiltration to Text Storage Sites

Current version: 1.0

Description: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information. Text storage sites are often used to host malicious code for C2 communication (e.g., [Stage Capabilities](https://attack.mitre.org/techniques/T1608)), but adversaries may also use these sites to exfiltrate collected data. Furthermore, paid features and encryption options may allow adversaries to conceal and store data more securely.(Citation: Pastebin EchoSec) **Note:** This is distinct from [Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001), which highlight access to code repositories via APIs.


[T1027.011] Obfuscated Files or Information: Fileless Storage

Current version: 1.0

Description: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored. Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless)


[T1583.008] Acquire Infrastructure: Malvertising

Current version: 1.0

Description: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites. Adversaries may purchase ads and other resources to help distribute artifacts containing malicious code to victims. Purchased ads may attempt to impersonate or spoof well-known brands. For example, these spoofed ads may trick victims into clicking the ad which could then send them to a malicious domain that may be a clone of official websites containing trojanized versions of the advertised software.(Citation: Masquerads-Guardio)(Citation: FBI-search) Adversary’s efforts to create malicious domains and purchase advertisements may also be automated at scale to better resist cleanup efforts.(Citation: sentinelone-malvertising) Malvertising may be used to support [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), potentially requiring limited interaction from the user if the ad contains code/exploits that infect the target system's web browser.(Citation: BBC-malvertising) Adversaries may also employ several techniques to evade detection by the advertising network. For example, adversaries may dynamically route ad clicks to send automated crawler/policy enforcer traffic to benign sites while validating potential targets then sending victims referred from real ad clicks to malicious pages. This infection vector may therefore remain hidden from the ad network as well as any visitor not reaching the malicious sites with a valid identifier from clicking on the advertisement.(Citation: Masquerads-Guardio) Other tricks, such as intentional typos to avoid brand reputation monitoring, may also be used to evade automated detection.(Citation: spamhaus-malvertising)


[T1036.008] Masquerading: Masquerade File Type

Current version: 1.0

Description: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`. Adversaries may edit the header’s hex code and/or the file extension of a malicious payload in order to bypass file validation checks and/or input sanitization. This behavior is commonly used when payload files are transferred (e.g., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and stored (e.g., [Upload Malware](https://attack.mitre.org/techniques/T1608/001)) so that adversaries may move their malware without triggering detections. Common non-executable file types and extensions, such as text files (`.txt`) and image files (`.jpg`, `.gif`, etc.) may be typically treated as benign. Based on this, adversaries may use a file extension to disguise malware, such as naming a PHP backdoor code with a file name of test.gif. A user may not know that a file is malicious due to the benign appearance and file extension. Polygot files, which are files that have multiple different file types and that function differently based on the application that will execute them, may also be used to disguise malicious malware and capabilities.(Citation: polygot_icedID)


[T1556.008] Modify Authentication Process: Network Provider DLL

Current version: 1.0

Description: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.(Citation: NPPSPY) Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.(Citation: NPLogonNotify) Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.(Citation: NPPSPY - Huntress)


[T1562.011] Impair Defenses: Spoof Security Alerting

Current version: 1.0

Description: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident. Rather than or in addition to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), an adversary can spoof positive affirmations that security tools are continuing to function even after legitimate security tools have been disabled (e.g., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)). An adversary can also present a “healthy” system status even after infection. This can be abused to enable further malicious activity by delaying defender responses. For example, adversaries may show a fake Windows Security GUI and tray icon with a “healthy” system status after Windows Defender and other system tools have been disabled.(Citation: BlackBasta)

Major Version Changes

[T1217] Browser Information Discovery

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may enumerate browser bookmarks to learn more abt1Adversaries may enumerate information about browsers to lear
>out compromised hosts. Browser bookmarks may reveal personal>n more about compromised environments. Data saved by browser
> information about users (ex: banking sites, interests, soci>s (such as bookmarks, accounts, and browsing history) may re
>al media, etc.) as well as details about internal network re>veal a variety of personal information about users (e.g., ba
>sources such as servers, tools/dashboards, or other related >nking sites, relationships/interests, social media, etc.) as
>infrastructure.  Browser bookmarks may also highlight additi> well as details about internal network resources such as se
>onal targets after an adversary has access to valid credenti>rvers, tools/dashboards, or other related infrastructure.(Ci
>als, especially [Credentials In Files](https://attack.mitre.>tation: Kaspersky Autofill)  Browser information may also hi
>org/techniques/T1552/001) associated with logins cached by a>ghlight additional targets after an adversary has access to 
> browser.  Specific storage locations vary based on platform>valid credentials, especially [Credentials In Files](https:/
> and/or application, but browser bookmarks are typically sto>/attack.mitre.org/techniques/T1552/001) associated with logi
>red in local files/databases.>ns cached by a browser.  Specific storage locations vary bas
 >ed on platform and/or application, but browser information i
 >s typically stored in local files and databases (e.g., `%APP
 >DATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2020-03-26 16:06:07.367000+00:002023-04-16 14:24:40.625000+00:00
nameBrowser Bookmark DiscoveryBrowser Information Discovery
descriptionAdversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Chrome Roaming Profiles', 'description': 'Chrome Enterprise and Education Help. (n.d.). Use Chrome Browser with Roaming User Profiles. Retrieved March 28, 2023.', 'url': 'https://support.google.com/chrome/a/answer/7349337'}
external_references{'source_name': 'Kaspersky Autofill', 'description': 'Golubev, S. (n.d.). How malware steals autofill data from browsers. Retrieved March 28, 2023.', 'url': 'https://www.kaspersky.com/blog/browser-data-theft/27871/'}
x_mitre_contributorsManikantan Srinivasan, NEC Corporation India
x_mitre_contributorsYinon Engelsman, Talon Cyber Security
x_mitre_contributorsYonatan Gotlib, Talon Cyber Security
x_mitre_data_sourcesCommand: Command Execution
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution
Minor Version Changes

[T1548] Abuse Elevation Control Mechanism

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2022-03-21 19:01:25.043000+00:002023-04-21 12:35:07.744000+00:00
x_mitre_data_sources[0]Command: Command ExecutionFile: File Metadata
x_mitre_data_sources[1]File: File ModificationProcess: OS API Execution
x_mitre_data_sources[2]Windows Registry: Windows Registry Key ModificationProcess: Process Creation
x_mitre_data_sources[3]Process: Process MetadataCommand: Command Execution
x_mitre_data_sources[4]Process: Process CreationWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[5]Process: OS API ExecutionProcess: Process Metadata
x_mitre_data_sources[6]File: File MetadataFile: File Modification
x_mitre_version1.01.1

[T1546.008] Event Triggered Execution: Accessibility Features

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
external_referencesComi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020.
dictionary_item_removed
STIX FieldOld valueNew Value
external_referencesCAPEC-558
values_changed
STIX FieldOld valueNew Value
modified2020-05-13 20:37:30.048000+00:002023-04-21 12:33:18.602000+00:00
external_references[1]['source_name']capecNarrator Accessibility Abuse
external_references[1]['url']https://capec.mitre.org/data/definitions/558.htmlhttps://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html
x_mitre_data_sources[0]File: File ModificationCommand: Command Execution
x_mitre_data_sources[1]File: File CreationWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[2]Windows Registry: Windows Registry Key ModificationFile: File Modification
x_mitre_data_sources[4]Command: Command ExecutionFile: File Creation
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'Narrator Accessibility Abuse', 'description': "Comi, G. (2019, October 19). Abusing Windows 10 Narrator's 'Feedback-Hub' URI for Fileless Persistence. Retrieved April 28, 2020.", 'url': 'https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html'}

[T1531] Account Access Removal

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may interrupt availability of system and networkt1Adversaries may interrupt availability of system and network
> resources by inhibiting access to accounts utilized by legi> resources by inhibiting access to accounts utilized by legi
>timate users. Accounts may be deleted, locked, or manipulate>timate users. Accounts may be deleted, locked, or manipulate
>d (ex: changed credentials) to remove access to accounts. Ad>d (ex: changed credentials) to remove access to accounts. Ad
>versaries may also subsequently log off and/or perform a [Sy>versaries may also subsequently log off and/or perform a [Sy
>stem Shutdown/Reboot](https://attack.mitre.org/techniques/T1>stem Shutdown/Reboot](https://attack.mitre.org/techniques/T1
>529) to set malicious changes into place.(Citation: CarbonBl>529) to set malicious changes into place.(Citation: CarbonBl
>ack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)  In W>ack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)  In W
>indows, [Net](https://attack.mitre.org/software/S0039) utili>indows, [Net](https://attack.mitre.org/software/S0039) utili
>ty, <code>Set-LocalUser</code> and <code>Set-ADAccountPasswo>ty, <code>Set-LocalUser</code> and <code>Set-ADAccountPasswo
>rd</code> [PowerShell](https://attack.mitre.org/techniques/T>rd</code> [PowerShell](https://attack.mitre.org/techniques/T
>1059/001) cmdlets may be used by adversaries to modify user >1059/001) cmdlets may be used by adversaries to modify user 
>accounts. In Linux, the <code>passwd</code> utility may be u>accounts. In Linux, the <code>passwd</code> utility may be u
>sed to change passwords. Accounts could also be disabled by >sed to change passwords. Accounts could also be disabled by 
>Group Policy.   Adversaries who use ransomware may first per>Group Policy.   Adversaries who use ransomware or similar at
>form this and other Impact behaviors, such as [Data Destruct>tacks may first perform this and other Impact behaviors, suc
>ion](https://attack.mitre.org/techniques/T1485) and [Defacem>h as [Data Destruction](https://attack.mitre.org/techniques/
>ent](https://attack.mitre.org/techniques/T1491), before comp>T1485) and [Defacement](https://attack.mitre.org/techniques/
>leting the [Data Encrypted for Impact](https://attack.mitre.>T1491), in order to impede incident response/recovery before
>org/techniques/T1486) objective. > completing the [Data Encrypted for Impact](https://attack.m
 >itre.org/techniques/T1486) objective. 
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Hubert Mank']
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 22:57:27.449000+00:002023-03-22 20:39:15.680000+00:00
descriptionAdversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, Set-LocalUser and Set-ADAccountPassword [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. In Linux, the passwd utility may be used to change passwords. Accounts could also be disabled by Group Policy. Adversaries who use ransomware may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, Set-LocalUser and Set-ADAccountPassword [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. In Linux, the passwd utility may be used to change passwords. Accounts could also be disabled by Group Policy. Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective.
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesUser Account: User Account Modification
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesUser Account: User Account Modification

[T1087] Account Discovery

Current version: 2.4

Version changed from: 2.3 → 2.4


Old Description
New Description
t1Adversaries may attempt to get a listing of accounts on a syt1Adversaries may attempt to get a listing of valid accounts, 
>stem or within an environment. This information can help adv>usernames, or email addresses on a system or within a compro
>ersaries determine which accounts exist to aid in follow-on >mised environment. This information can help adversaries det
>behavior.>ermine which accounts exist, which can aid in follow-on beha
 >vior such as brute-forcing, spear-phishing attacks, or accou
 >nt takeovers (e.g., [Valid Accounts](https://attack.mitre.or
 >g/techniques/T1078)).  Adversaries may use several methods t
 >o enumerate accounts, including abuse of existing tools, bui
 >lt-in commands, and potential misconfigurations that leak ac
 >count names and roles or permissions in the targeted environ
 >ment.  For examples, cloud environments typically provide ea
 >sily accessible interfaces to obtain user lists. On hosts, a
 >dversaries can use default [PowerShell](https://attack.mitre
 >.org/techniques/T1059/001) and other command line functional
 >ity to identify accounts. Information about email addresses 
 >and accounts may also be extracted by searching an infected 
 >system’s files.

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
external_referencesStepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
external_referencesCAPEC-575
values_changed
STIX FieldOld valueNew Value
modified2021-10-13 14:05:15.038000+00:002023-04-15 17:24:23.029000+00:00
descriptionAdversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)). Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment. For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system’s files.
external_references[1]['source_name']capecElastic - Koadiac Detection with EQL
external_references[1]['url']https://capec.mitre.org/data/definitions/575.htmlhttps://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql
x_mitre_data_sources[0]File: File AccessProcess: Process Creation
x_mitre_data_sources[2]Process: Process CreationFile: File Access
x_mitre_version2.32.4
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'}

[T1098] Account Manipulation

Current version: 2.5

Version changed from: 2.4 → 2.5

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-18 15:50:24.811000+00:002023-04-12 23:29:30.966000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[1]Group: Group ModificationCommand: Command Execution
x_mitre_data_sources[2]Process: Process CreationActive Directory: Active Directory Object Modification
x_mitre_data_sources[3]Active Directory: Active Directory Object ModificationGroup: Group Modification
x_mitre_data_sources[4]Command: Command ExecutionFile: File Modification
x_mitre_data_sources[5]File: File ModificationProcess: Process Creation
x_mitre_version2.42.5
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsNetwork

[T1583] Acquire Infrastructure

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may buy, lease, or rent infrastructure that can t1Adversaries may buy, lease, or rent infrastructure that can 
>be used during targeting. A wide variety of infrastructure e>be used during targeting. A wide variety of infrastructure e
>xists for hosting and orchestrating adversary operations. In>xists for hosting and orchestrating adversary operations. In
>frastructure solutions include physical or cloud servers, do>frastructure solutions include physical or cloud servers, do
>mains, and third-party web services.(Citation: TrendmicroHid>mains, and third-party web services.(Citation: TrendmicroHid
>eoutsLease) Additionally, botnets are available for rent or >eoutsLease) Additionally, botnets are available for rent or 
>purchase.  Use of these infrastructure solutions allows an a>purchase.  Use of these infrastructure solutions allows adve
>dversary to stage, launch, and execute an operation. Solutio>rsaries to stage, launch, and execute operations. Solutions 
>ns may help adversary operations blend in with traffic that >may help adversary operations blend in with traffic that is 
>is seen as normal, such as contact to third-party web servic>seen as normal, such as contacting third-party web services 
>es. Depending on the implementation, adversaries may use inf>or acquiring infrastructure to support [Proxy](https://attac
>rastructure that makes it difficult to physically tie back t>k.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus
>o them as well as utilize infrastructure that can be rapidly>) Depending on the implementation, adversaries may use infra
> provisioned, modified, and shut down.>structure that makes it difficult to physically tie back to 
 >them as well as utilize infrastructure that can be rapidly p
 >rovisioned, modified, and shut down.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_contributors['Shailesh Tiwary (Indian Army)']
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-17 15:45:02.209000+00:002023-03-02 21:34:46.139000+00:00
descriptionAdversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows an adversary to stage, launch, and execute an operation. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contact to third-party web services. Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
external_references[1]['source_name']TrendmicroHideoutsLeaseamnesty_nso_pegasus
external_references[1]['description']Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017.Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022.
external_references[1]['url']https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdfhttps://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/
external_references[2]['source_name']ThreatConnect Infrastructure Dec 2020Koczwara Beacon Hunting Sep 2021
external_references[2]['description']ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.
external_references[2]['url']https://threatconnect.com/blog/infrastructure-research-hunting/https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
external_references[3]['source_name']Mandiant SCANdalous Jul 2020TrendmicroHideoutsLease
external_references[3]['description']Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021.Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017.
external_references[3]['url']https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automationhttps://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf
external_references[4]['source_name']Koczwara Beacon Hunting Sep 2021Mandiant SCANdalous Jul 2020
external_references[4]['description']Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021.
external_references[4]['url']https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation
x_mitre_data_sources[1]Domain Name: Domain RegistrationDomain Name: Active DNS
x_mitre_data_sources[4]Domain Name: Active DNSDomain Name: Domain Registration
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'ThreatConnect Infrastructure Dec 2020', 'description': 'ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.', 'url': 'https://threatconnect.com/blog/infrastructure-research-hunting/'}

[T1098.001] Account Manipulation: Additional Cloud Credentials

Current version: 2.5

Version changed from: 2.4 → 2.5


Old Description
New Description
t1Adversaries may add adversary-controlled credentials to a clt1Adversaries may add adversary-controlled credentials to a cl
>oud account to maintain persistent access to victim accounts>oud account to maintain persistent access to victim accounts
> and instances within the environment.  For example, adversa> and instances within the environment.  For example, adversa
>ries may add credentials for Service Principals and Applicat>ries may add credentials for Service Principals and Applicat
>ions in addition to existing legitimate credentials in Azure>ions in addition to existing legitimate credentials in Azure
> AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat> AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat
>ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide>ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide
>o) These credentials include both x509 keys and passwords.(C>o) These credentials include both x509 keys and passwords.(C
>itation: Microsoft SolarWinds Customer Guidance) With suffic>itation: Microsoft SolarWinds Customer Guidance) With suffic
>ient permissions, there are a variety of ways to add credent>ient permissions, there are a variety of ways to add credent
>ials including the Azure Portal, Azure command line interfac>ials including the Azure Portal, Azure command line interfac
>e, and Azure or Az PowerShell modules.(Citation: Demystifyin>e, and Azure or Az PowerShell modules.(Citation: Demystifyin
>g Azure AD Service Principals)  In infrastructure-as-a-servi>g Azure AD Service Principals)  In infrastructure-as-a-servi
>ce (IaaS) environments, after gaining access through [Cloud >ce (IaaS) environments, after gaining access through [Cloud 
>Accounts](https://attack.mitre.org/techniques/T1078/004), ad>Accounts](https://attack.mitre.org/techniques/T1078/004), ad
>versaries may generate or import their own SSH keys using ei>versaries may generate or import their own SSH keys using ei
>ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</>ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</
>code> API in AWS or the <code>gcloud compute os-login ssh-ke>code> API in AWS or the <code>gcloud compute os-login ssh-ke
>ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi>ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi
>s allows persistent access to instances within the cloud env>s allows persistent access to instances within the cloud env
>ironment without further usage of the compromised cloud acco>ironment without further usage of the compromised cloud acco
>unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind>unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind
> the Scenes)  Adversaries may also use the <code>CreateAcces> the Scenes)  Adversaries may also use the <code>CreateAcces
>sKey</code> API in AWS or the <code>gcloud iam service-accou>sKey</code> API in AWS or the <code>gcloud iam service-accou
>nts keys create</code> command in GCP to add access keys to >nts keys create</code> command in GCP to add access keys to 
>an account. If the target account has different permissions >an account. If the target account has different permissions 
>from the requesting account, the adversary may also be able >from the requesting account, the adversary may also be able 
>to escalate their privileges in the environment (i.e. [Cloud>to escalate their privileges in the environment (i.e. [Cloud
> Accounts](https://attack.mitre.org/techniques/T1078/004)).(> Accounts](https://attack.mitre.org/techniques/T1078/004)).(
>Citation: Rhino Security Labs AWS Privilege Escalation)>Citation: Rhino Security Labs AWS Privilege Escalation)  In 
 >AWS environments, adversaries with the appropriate permissio
 >ns may also use the `sts:GetFederationToken` API call to cre
 >ate a temporary set of credentials tied to the permissions o
 >f the original user account. These credentials may remain va
 >lid for the duration of their lifetime even if the original 
 >account’s API credentials are deactivated. (Citation: Crowds
 >trike AWS User Federation Persistence)

Dropped Detections:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-24 15:20:47.020000+00:002023-04-12 21:30:31.151000+00:00
descriptionAdversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals) In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals) In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes) Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation) In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated. (Citation: Crowdstrike AWS User Federation Persistence)
external_references[1]['source_name']Expel IO Evil in AWSCrowdstrike AWS User Federation Persistence
external_references[1]['description']A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020. Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.
external_references[1]['url']https://expel.io/blog/finding-evil-in-aws/https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
external_references[2]['source_name']Demystifying Azure AD Service PrincipalsExpel IO Evil in AWS
external_references[2]['description']Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.
external_references[2]['url']https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/https://expel.io/blog/finding-evil-in-aws/
external_references[3]['source_name']GCP SSH Key AddDemystifying Azure AD Service Principals
external_references[3]['description']Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.
external_references[3]['url']https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/addhttps://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/
external_references[4]['source_name']Blue Cloud of Death VideoGCP SSH Key Add
external_references[4]['description']Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.
external_references[4]['url']https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add
external_references[5]['source_name']Blue Cloud of DeathBlue Cloud of Death Video
external_references[5]['description']Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.
external_references[5]['url']https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815
external_references[6]['source_name']Microsoft SolarWinds Customer GuidanceBlue Cloud of Death
external_references[6]['description']MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.
external_references[6]['url']https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1
external_references[7]['source_name']Expel Behind the ScenesMicrosoft SolarWinds Customer Guidance
external_references[7]['description']S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.
external_references[7]['url']https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
external_references[8]['source_name']Rhino Security Labs AWS Privilege EscalationExpel Behind the Scenes
external_references[8]['description']Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.
external_references[8]['url']https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version2.42.5
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Rhino Security Labs AWS Privilege Escalation', 'description': 'Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.', 'url': 'https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/'}
x_mitre_contributorsDylan
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesActive Directory: Active Directory Object Modification

[T1098.003] Account Manipulation: Additional Cloud Roles

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-24 15:21:19.955000+00:002023-04-14 22:48:50.142000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version2.12.2

[T1546.010] Event Triggered Execution: AppInit DLLs

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2020-11-10 18:29:31.076000+00:002023-04-21 12:33:45.568000+00:00
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesWindows Registry: Windows Registry Key Modification
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesWindows Registry: Windows Registry Key Modification

[T1550.001] Use Alternate Authentication Material: Application Access Token

Current version: 1.5

Version changed from: 1.4 → 1.5


Old Description
New Description
t1Adversaries may use stolen application access tokens to bypat1Adversaries may use stolen application access tokens to bypa
>ss the typical authentication process and access restricted >ss the typical authentication process and access restricted 
>accounts, information, or services on remote systems. These >accounts, information, or services on remote systems. These 
>tokens are typically stolen from users or services and used >tokens are typically stolen from users or services and used 
>in lieu of login credentials.  Application access tokens are>in lieu of login credentials.  Application access tokens are
> used to make authorized API requests on behalf of a user or> used to make authorized API requests on behalf of a user or
> service and are commonly used as a way to access resources > service and are commonly used to access resources in cloud,
>in cloud and container-based applications and software-as-a-> container-based applications, and software-as-a-service (Sa
>service (SaaS).(Citation: Auth0 - Why You Should Always Use >aS).(Citation: Auth0 - Why You Should Always Use Access Toke
>Access Tokens to Secure APIs Sept 2019)   In AWS and GCP env>ns to Secure APIs Sept 2019)   OAuth is one commonly impleme
>ironments, adversaries can trigger a request for a short-liv>nted framework that issues tokens to users for access to sys
>ed access token with the privileges of another user account.>tems. These frameworks are used collaboratively to verify th
>(Citation: Google Cloud Service Account Credentials)(Citatio>e user and determine what actions the user is allowed to per
>n: AWS Temporary Security Credentials) The adversary can the>form. Once identity is established, the token allows actions
>n use this token to request data or perform actions the orig> to be authorized, without passing the actual credentials of
>inal account could not. If permissions for this feature are > the user. Therefore, compromise of the token can grant the 
>misconfigured – for example, by allowing all users to reques>adversary access to resources of other sites through a malic
>t a token for a particular account - an adversary may be abl>ious application.(Citation: okta)  For example, with a cloud
>e to gain initial access to a Cloud Account or escalate thei>-based email service, once an OAuth access token is granted 
>r privileges.(Citation: Rhino Security Labs Enumerating AWS >to a malicious application, it can potentially gain long-ter
>Roles)  OAuth is one commonly implemented framework that iss>m access to features of the user account if a "refresh" toke
>ues tokens to users for access to systems. These frameworks >n enabling background access is awarded.(Citation: Microsoft
>are used collaboratively to verify the user and determine wh> Identity Platform Access 2019) With an OAuth access token a
>at actions the user is allowed to perform. Once identity is >n adversary can use the user-granted REST API to perform fun
>established, the token allows actions to be authorized, with>ctions such as email searching and contact enumeration.(Cita
>out passing the actual credentials of the user. Therefore, c>tion: Staaldraad Phishing with OAuth 2017)  Compromised acce
>ompromise of the token can grant the adversary access to res>ss tokens may be used as an initial step in compromising oth
>ources of other sites through a malicious application.(Citat>er services. For example, if a token grants access to a vict
>ion: okta)  For example, with a cloud-based email service on>im’s primary email, the adversary may be able to extend acce
>ce an OAuth access token is granted to a malicious applicati>ss to all other services which the target subscribes by trig
>on, it can potentially gain long-term access to features of >gering forgotten password routines. In AWS and GCP environme
>the user account if a "refresh" token enabling background ac>nts, adversaries can trigger a request for a short-lived acc
>cess is awarded.(Citation: Microsoft Identity Platform Acces>ess token with the privileges of another user account.(Citat
>s 2019) With an OAuth access token an adversary can use the >ion: Google Cloud Service Account Credentials)(Citation: AWS
>user-granted REST API to perform functions such as email sea> Temporary Security Credentials) The adversary can then use 
>rching and contact enumeration.(Citation: Staaldraad Phishin>this token to request data or perform actions the original a
>g with OAuth 2017)  Compromised access tokens may be used as>ccount could not. If permissions for this feature are miscon
> an initial step in compromising other services. For example>figured – for example, by allowing all users to request a to
>, if a token grants access to a victim’s primary email, the >ken for a particular account - an adversary may be able to g
>adversary may be able to extend access to all other services>ain initial access to a Cloud Account or escalate their priv
> which the target subscribes by triggering forgotten passwor>ileges.(Citation: Rhino Security Labs Enumerating AWS Roles)
>d routines. Direct API access through a token negates the ef>  Direct API access through a token negates the effectivenes
>fectiveness of a second authentication factor and may be imm>s of a second authentication factor and may be immune to int
>une to intuitive countermeasures like changing passwords. Ac>uitive countermeasures like changing passwords.  For example
>cess abuse over an API channel can be difficult to detect ev>, in AWS environments, an adversary who compromises a user’s
>en from the service provider end, as the access can still al> AWS API credentials may be able to use the `sts:GetFederati
>ign well with a legitimate workflow.>onToken` API call to create a federated user session, which 
 >will have the same permissions as the original user but may 
 >persist even if the original user credentials are deactivate
 >d.(Citation: Crowdstrike AWS User Federation Persistence) Ad
 >ditionally, access abuse over an API channel can be difficul
 >t to detect even from the service provider end, as the acces
 >s can still align well with a legitimate workflow.
Details
dictionary_item_added
STIX FieldOld valueNew Value
external_referencesStalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.
dictionary_item_removed
STIX FieldOld valueNew Value
external_referencesCAPEC-593
values_changed
STIX FieldOld valueNew Value
modified2022-10-21 17:01:05.286000+00:002023-04-15 00:29:43.297000+00:00
descriptionAdversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta) For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017) Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019) OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta) For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017) Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles) Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the `sts:GetFederationToken` API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.
external_references[1]['source_name']Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019Crowdstrike AWS User Federation Persistence
external_references[1]['description']Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019. Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.
external_references[1]['url']https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/
external_references[2]['source_name']AWS Logging IAM CallsAuth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019
external_references[2]['description']AWS. (n.d.). Logging IAM and AWS STS API calls with AWS CloudTrail. Retrieved April 1, 2022.Auth0. (n.d.). Why You Should Always Use Access Tokens to Secure APIs. Retrieved September 12, 2019.
external_references[2]['url']https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.htmlhttps://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/
external_references[3]['source_name']AWS Temporary Security CredentialsAWS Logging IAM Calls
external_references[3]['description']AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022.AWS. (n.d.). Logging IAM and AWS STS API calls with AWS CloudTrail. Retrieved April 1, 2022.
external_references[3]['url']https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.htmlhttps://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html
external_references[4]['source_name']Microsoft Identity Platform Access 2019AWS Temporary Security Credentials
external_references[4]['description']Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022.
external_references[4]['url']https://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokenshttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html
external_references[5]['source_name']Google Cloud Service Account CredentialsMicrosoft Identity Platform Access 2019
external_references[5]['description']Google Cloud. (2022, March 31). Creating short-lived service account credentials. Retrieved April 1, 2022.Cai, S., Flores, J., de Guzman, C., et. al.. (2019, August 27). Microsoft identity platform access tokens. Retrieved October 4, 2019.
external_references[5]['url']https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentialshttps://docs.microsoft.com/en-us/azure/active-directory/develop/access-tokens
external_references[6]['source_name']GCP Monitoring Service Account UsageGoogle Cloud Service Account Credentials
external_references[6]['description']Google Cloud. (2022, March 31). Monitor usage patterns for service accounts and keys . Retrieved April 1, 2022.Google Cloud. (2022, March 31). Creating short-lived service account credentials. Retrieved April 1, 2022.
external_references[6]['url']https://cloud.google.com/iam/docs/service-account-monitoringhttps://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials
external_references[7]['source_name']oktaGCP Monitoring Service Account Usage
external_references[7]['description']okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.Google Cloud. (2022, March 31). Monitor usage patterns for service accounts and keys . Retrieved April 1, 2022.
external_references[7]['url']https://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolenhttps://cloud.google.com/iam/docs/service-account-monitoring
external_references[8]['source_name']Rhino Security Labs Enumerating AWS Rolesokta
external_references[8]['description']Spencer Gietzen. (2018, August 8). Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’. Retrieved April 1, 2022.okta. (n.d.). What Happens If Your JWT Is Stolen?. Retrieved September 12, 2019.
external_references[8]['url']https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumerationhttps://developer.okta.com/blog/2018/06/20/what-happens-if-your-jwt-is-stolen
external_references[9]['source_name']Staaldraad Phishing with OAuth 2017Rhino Security Labs Enumerating AWS Roles
external_references[9]['description']Stalmans, E.. (2017, August 2). Phishing with OAuth and o365/Azure. Retrieved October 4, 2019.Spencer Gietzen. (2018, August 8). Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’. Retrieved April 1, 2022.
external_references[9]['url']https://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration
external_references[10]['source_name']capecStaaldraad Phishing with OAuth 2017
external_references[10]['url']https://capec.mitre.org/data/definitions/593.htmlhttps://staaldraad.github.io/2017/08/02/o356-phishing-with-oauth/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.41.5
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsDylan

[T1071] Application Layer Protocol

Current version: 2.1

Version changed from: 2.0 → 2.1


Old Description
New Description
t1Adversaries may communicate using application layer protocolt1Adversaries may communicate using OSI application layer prot
>s to avoid detection/network filtering by blending in with e>ocols to avoid detection/network filtering by blending in wi
>xisting traffic. Commands to the remote system, and often th>th existing traffic. Commands to the remote system, and ofte
>e results of those commands, will be embedded within the pro>n the results of those commands, will be embedded within the
>tocol traffic between the client and server.   Adversaries m> protocol traffic between the client and server.   Adversari
>ay utilize many different protocols, including those used fo>es may utilize many different protocols, including those use
>r web browsing, transferring files, electronic mail, or DNS.>d for web browsing, transferring files, electronic mail, or 
> For connections that occur internally within an enclave (su>DNS. For connections that occur internally within an enclave
>ch as those between a proxy or pivot node and other nodes), > (such as those between a proxy or pivot node and other node
>commonly used protocols are SMB, SSH, or RDP. >s), commonly used protocols are SMB, SSH, or RDP. 
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_contributors['Duane Michael']
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2020-10-21 16:35:45.986000+00:002023-04-11 14:35:41.468000+00:00
descriptionAdversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.
x_mitre_data_sources[0]Network Traffic: Network Traffic FlowNetwork Traffic: Network Traffic Content
x_mitre_data_sources[1]Network Traffic: Network Traffic ContentNetwork Traffic: Network Traffic Flow
x_mitre_version2.02.1

[T1010] Application Window Discovery

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may attempt to get a listing of open applicationt1Adversaries may attempt to get a listing of open application
> windows. Window listings could convey information about how> windows. Window listings could convey information about how
> the system is used or give context to information collected> the system is used.(Citation: Prevailion DarkWatchman 2021)
> by a keylogger.(Citation: Prevailion DarkWatchman 2021)> For example, information about application windows could be
 > used identify potential data to collect as well as identify
 >ing security tooling ([Security Software Discovery](https://
 >attack.mitre.org/techniques/T1518/001)) to evade.(Citation: 
 >ESET Grandoreiro April 2020)  Adversaries typically abuse sy
 >stem features for this type of enumeration. For example, the
 >y may gather information through native system features such
 > as [Command and Scripting Interpreter](https://attack.mitre
 >.org/techniques/T1059) commands and [Native API](https://att
 >ack.mitre.org/techniques/T1106) functions.

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 02:07:41.751000+00:002023-04-15 16:46:04.776000+00:00
descriptionAdversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.(Citation: Prevailion DarkWatchman 2021)Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
external_references[1]['source_name']Prevailion DarkWatchman 2021ESET Grandoreiro April 2020
external_references[1]['description']Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
external_references[1]['url']https://www.prevailion.com/darkwatchman-new-fileless-techniques/https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Prevailion DarkWatchman 2021', 'description': 'Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.', 'url': 'https://www.prevailion.com/darkwatchman-new-fileless-techniques/'}
x_mitre_data_sourcesCommand: Command Execution
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution

[T1560.001] Archive Collected Data: Archive via Utility

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may use utilities to compress and/or encrypt colt1Adversaries may use utilities to compress and/or encrypt col
>lected data prior to exfiltration. Many utilities include fu>lected data prior to exfiltration. Many utilities include fu
>nctionalities to compress, encrypt, or otherwise package dat>nctionalities to compress, encrypt, or otherwise package dat
>a into a format that is easier/more secure to transport.  Ad>a into a format that is easier/more secure to transport.  Ad
>versaries may abuse various utilities to compress or encrypt>versaries may abuse various utilities to compress or encrypt
> data before exfiltration. Some third party utilities may be> data before exfiltration. Some third party utilities may be
> preinstalled, such as <code>tar</code> on Linux and macOS o> preinstalled, such as <code>tar</code> on Linux and macOS o
>r <code>zip</code> on Windows systems. On Windows, <code>dia>r <code>zip</code> on Windows systems.   On Windows, <code>d
>ntz</code> or <code> makecab</code> may be used to package c>iantz</code> or <code> makecab</code> may be used to package
>ollected files into a cabinet (.cab) file. <code>diantz</cod> collected files into a cabinet (.cab) file. <code>diantz</c
>e> may also be used to download and compress files from remo>ode> may also be used to download and compress files from re
>te locations (i.e. [Remote Data Staging](https://attack.mitr>mote locations (i.e. [Remote Data Staging](https://attack.mi
>e.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) A>tre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas)
>dditionally, <code>xcopy</code> on Windows can copy files an> <code>xcopy</code> on Windows can copy files and directorie
>d directories with a variety of options.  Adversaries may us>s with a variety of options. Additionally, adversaries may u
>also third party utilities, such as 7-Zip, WinRAR, and Win>se [certutil](https://attack.mitre.org/software/S0160) to Ba
>Zip, to perform similar activities.(Citation: 7zip Homepage)>se64 encode collected data before exfiltration.   Adversarie
>(Citation: WinRAR Homepage)(Citation: WinZip Homepage)>s may use also third party utilities, such as 7-Zip, WinRAR,
 > and WinZip, to perform similar activities.(Citation: 7zip H
 >omepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepag
 >e)
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-20 17:17:48.612000+00:002023-04-14 19:28:21.394000+00:00
descriptionAdversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) Additionally, xcopy on Windows can copy files and directories with a variety of options. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems. On Windows, diantz or makecab may be used to package collected files into a cabinet (.cab) file. diantz may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) xcopy on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Command: Command ExecutionFile: File Creation
x_mitre_data_sources[2]File: File CreationCommand: Command Execution
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsMark Wee

[T1197] BITS Jobs

Current version: 1.4

Version changed from: 1.3 → 1.4

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-09-14 19:21:26.447000+00:002023-04-21 12:21:40.927000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution

[T1110] Brute Force

Current version: 2.5

Version changed from: 2.4 → 2.5

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 21:28:49.481000+00:002023-04-14 23:03:34.362000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]User Account: User Account AuthenticationApplication Log: Application Log Content
x_mitre_data_sources[2]Application Log: Application Log ContentUser Account: User Account Authentication
x_mitre_version2.42.5
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/49.html', 'external_id': 'CAPEC-49'}

[T1612] Build Image on Host

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may build a container image directly on a host tt1Adversaries may build a container image directly on a host t
>o bypass defenses that monitor for the retrieval of maliciou>o bypass defenses that monitor for the retrieval of maliciou
>s images from a public registry. A remote <code>build</code>>s images from a public registry. A remote <code>build</code>
> request may be sent to the Docker API that includes a Docke> request may be sent to the Docker API that includes a Docke
>rfile that pulls a vanilla base image, such as alpine, from >rfile that pulls a vanilla base image, such as alpine, from 
>a public or local registry and then builds a custom image up>a public or local registry and then builds a custom image up
>on it.(Citation: Docker Build Image)  An adversary may take >on it.(Citation: Docker Build Image)  An adversary may take 
>advantage of that <code>build</code> API to build a custom i>advantage of that <code>build</code> API to build a custom i
>mage on the host that includes malware downloaded from their>mage on the host that includes malware downloaded from their
> C2 server, and then they then may utilize [Deploy Container> C2 server, and then they may utilize [Deploy Container](htt
>](https://attack.mitre.org/techniques/T1610) using that cust>ps://attack.mitre.org/techniques/T1610) using that custom im
>om image.(Citation: Aqua Build Images on Hosts)(Citation: Aq>age.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Se
>ua Security Cloud Native Threat Report June 2021) If the bas>curity Cloud Native Threat Report June 2021) If the base ima
>e image is pulled from a public registry, defenses will like>ge is pulled from a public registry, defenses will likely no
>ly not detect the image as malicious since it’s a vanilla im>t detect the image as malicious since it’s a vanilla image. 
>age. If the base image already resides in a local registry, >If the base image already resides in a local registry, the p
>the pull may be considered even less suspicious since the im>ull may be considered even less suspicious since the image i
>age is already in the environment. >s already in the environment. 
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User', 'root']
values_changed
STIX FieldOld valueNew Value
modified2022-04-01 13:04:00.946000+00:002023-04-15 16:22:09.807000+00:00
descriptionAdversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.
external_references[1]['source_name']Docker Build ImageAqua Build Images on Hosts
external_references[1]['description']Docker. ( null). Docker Engine API v1.41 Reference - Build an Image. Retrieved March 30, 2021.Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.
external_references[1]['url']https://docs.docker.com/engine/api/v1.41/#operation/ImageBuildhttps://blog.aquasec.com/malicious-container-image-docker-container-host
external_references[2]['source_name']Aqua Build Images on HostsDocker Build Image
external_references[2]['description']Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.Docker. ( null). Docker Engine API v1.41 Reference - Build an Image. Retrieved March 30, 2021.
external_references[2]['url']https://blog.aquasec.com/malicious-container-image-docker-container-hosthttps://docs.docker.com/engine/api/v1.41/#operation/ImageBuild
x_mitre_data_sources[0]Network Traffic: Network Traffic ContentNetwork Traffic: Network Connection Creation
x_mitre_data_sources[1]Image: Image CreationNetwork Traffic: Network Traffic Flow
x_mitre_data_sources[2]Network Traffic: Network Traffic FlowImage: Image Creation
x_mitre_data_sources[3]Network Traffic: Network Connection CreationNetwork Traffic: Network Traffic Content
x_mitre_version1.21.3

[T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control

Current version: 2.1

Version changed from: 2.0 → 2.1

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 15:11:20.036000+00:002023-04-21 12:35:39.112000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version2.02.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution

[T1218.003] System Binary Proxy Execution: CMSTP

Current version: 2.1

Version changed from: 2.0 → 2.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2022-03-11 18:38:36.109000+00:002023-04-21 12:24:13.666000+00:00
external_references[1]['source_name']Microsoft Connection Manager Oct 2009Twitter CMSTP Usage Jan 2018
external_references[1]['description']Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018.Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018.
external_references[1]['url']https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)https://twitter.com/ItsReallyNick/status/958789644165894146
external_references[2]['source_name']Twitter CMSTP Usage Jan 2018Microsoft Connection Manager Oct 2009
external_references[2]['description']Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018.Microsoft. (2009, October 8). How Connection Manager Works. Retrieved April 11, 2018.
external_references[2]['url']https://twitter.com/ItsReallyNick/status/958789644165894146https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc786431(v=ws.10)
external_references[4]['source_name']Twitter CMSTP Jan 2018GitHub Ultimate AppLocker Bypass List
external_references[4]['description']Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018.Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018.
external_references[4]['url']https://twitter.com/NickTyrer/status/958450014111633408https://github.com/api0cradle/UltimateAppLockerByPassList
external_references[5]['source_name']GitHub Ultimate AppLocker Bypass ListEndurant CMSTP July 2018
external_references[5]['description']Moe, O. (2018, March 1). Ultimate AppLocker Bypass List. Retrieved April 10, 2018.Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.
external_references[5]['url']https://github.com/api0cradle/UltimateAppLockerByPassListhttp://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
external_references[6]['source_name']Endurant CMSTP July 2018Twitter CMSTP Jan 2018
external_references[6]['description']Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved August 6, 2018.Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018.
external_references[6]['url']http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/https://twitter.com/NickTyrer/status/958450014111633408
x_mitre_version2.02.1

[T1070.003] Indicator Removal: Clear Command History

Current version: 1.4

Version changed from: 1.3 → 1.4

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-09-01 21:58:56.496000+00:002023-04-07 17:20:44.770000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]File: File ModificationUser Account: User Account Authentication
x_mitre_data_sources[1]File: File DeletionCommand: Command Execution
x_mitre_data_sources[2]User Account: User Account AuthenticationFile: File Deletion
x_mitre_data_sources[3]Command: Command ExecutionFile: File Modification
x_mitre_version1.31.4

[T1070.008] Indicator Removal: Clear Mailbox Data

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may modify mail application data to remove evidet1Adversaries may modify mail and mail application data to rem
>nce of their activity. Email applications allow users and ot>ove evidence of their activity. Email applications allow use
>her programs to export and delete mailbox data via command l>rs and other programs to export and delete mailbox data via 
>ine tools or use of APIs. Mail application data can be email>command line tools or use of APIs. Mail application data can
>s or logs generated by the application or operating system, > be emails, email metadata, or logs generated by the applica
>such as export requests.   Adversaries may manipulate email >tion or operating system, such as export requests.   Adversa
>mailbox data to remove logs and artifacts, such as evidence >ries may manipulate emails and mailbox data to remove logs, 
>of [Phishing](https://attack.mitre.org/techniques/T1566)/[In>artifacts, and metadata, such as evidence of [Phishing](http
>ternal Spearphishing](https://attack.mitre.org/techniques/T1>s://attack.mitre.org/techniques/T1566)/[Internal Spearphishi
>534), [Email Collection](https://attack.mitre.org/techniques>ng](https://attack.mitre.org/techniques/T1534), [Email Colle
>/T1114), [Mail Protocols](https://attack.mitre.org/technique>ction](https://attack.mitre.org/techniques/T1114), [Mail Pro
>s/T1071/003) for command and control, or email-based exfiltr>tocols](https://attack.mitre.org/techniques/T1071/003) for c
>ation such as [Exfiltration Over Alternative Protocol](https>ommand and control, or email-based exfiltration such as [Exf
>://attack.mitre.org/techniques/T1048). For example, to remov>iltration Over Alternative Protocol](https://attack.mitre.or
>e evidence on Exchange servers adversaries have used the <co>g/techniques/T1048). For example, to remove evidence on Exch
>de>ExchangePowerShell</code> [PowerShell](https://attack.mit>ange servers adversaries have used the <code>ExchangePowerSh
>re.org/techniques/T1059/001) module, including <code>Remove->ell</code> [PowerShell](https://attack.mitre.org/techniques/
>MailboxExportRequest</code> to remove evidence of mailbox ex>T1059/001) module, including <code>Remove-MailboxExportReque
>ports.(Citation: Volexity SolarWinds)(Citation: ExchangePowe>st</code> to remove evidence of mailbox exports.(Citation: V
>rShell Module) On Linux and macOS, adversaries may also dele>olexity SolarWinds)(Citation: ExchangePowerShell Module) On 
>te emails through a command line utility called <code>mail</>Linux and macOS, adversaries may also delete emails through 
>code>  or use [AppleScript](https://attack.mitre.org/techniq>a command line utility called <code>mail</code>  or use [App
>ues/T1059/002) to interact with APIs on macOS.(Citation: Cyb>leScript](https://attack.mitre.org/techniques/T1059/002) to 
>ereason Cobalt Kitty 2017)(Citation: mailx man page)>interact with APIs on macOS.(Citation: Cybereason Cobalt Kit
 >ty 2017)(Citation: mailx man page)  Adversaries may also rem
 >ove emails and metadata/headers indicative of spam or suspic
 >ious activity (for example, through the use of organization-
 >wide transport rules) to reduce the likelihood of malicious 
 >emails being detected by security products.(Citation: Micros
 >oft OAuth Spam 2022)

New Mitigations:

New Detections:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Liran Ravich, CardinalOps']
values_changed
STIX FieldOld valueNew Value
modified2022-10-17 17:41:43.552000+00:002023-04-12 20:56:32.743000+00:00
descriptionAdversaries may modify mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails or logs generated by the application or operating system, such as export requests. Adversaries may manipulate email mailbox data to remove logs and artifacts, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page)Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests. Adversaries may manipulate emails and mailbox data to remove logs, artifacts, and metadata, such as evidence of [Phishing](https://attack.mitre.org/techniques/T1566)/[Internal Spearphishing](https://attack.mitre.org/techniques/T1534), [Email Collection](https://attack.mitre.org/techniques/T1114), [Mail Protocols](https://attack.mitre.org/techniques/T1071/003) for command and control, or email-based exfiltration such as [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). For example, to remove evidence on Exchange servers adversaries have used the ExchangePowerShell [PowerShell](https://attack.mitre.org/techniques/T1059/001) module, including Remove-MailboxExportRequest to remove evidence of mailbox exports.(Citation: Volexity SolarWinds)(Citation: ExchangePowerShell Module) On Linux and macOS, adversaries may also delete emails through a command line utility called mail or use [AppleScript](https://attack.mitre.org/techniques/T1059/002) to interact with APIs on macOS.(Citation: Cybereason Cobalt Kitty 2017)(Citation: mailx man page) Adversaries may also remove emails and metadata/headers indicative of spam or suspicious activity (for example, through the use of organization-wide transport rules) to reduce the likelihood of malicious emails being detected by security products.(Citation: Microsoft OAuth Spam 2022)
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft OAuth Spam 2022', 'description': 'Microsoft. (2023, September 22). Malicious OAuth applications abuse cloud email services to spread spam. Retrieved March 13, 2023.', 'url': 'https://www.microsoft.com/en-us/security/blog/2022/09/22/malicious-oauth-applications-used-to-compromise-email-servers-and-spread-spam/'}
x_mitre_data_sourcesProcess: Process Creation
x_mitre_data_sourcesApplication Log: Application Log Content
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation

[T1070.009] Indicator Removal: Clear Persistence

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may clear artifacts associated with previously et1Adversaries may clear artifacts associated with previously e
>stablished persistence on a host system to remove evidence o>stablished persistence on a host system to remove evidence o
>f their activity. This may involve various actions, such as >f their activity. This may involve various actions, such as 
>removing services, deleting executables, [Modify Registry](h>removing services, deleting executables, [Modify Registry](h
>ttps://attack.mitre.org/techniques/T1112), [Plist File Modif>ttps://attack.mitre.org/techniques/T1112), [Plist File Modif
>ication](https://attack.mitre.org/techniques/T1647), or othe>ication](https://attack.mitre.org/techniques/T1647), or othe
>r methods of cleanup to prevent defenders from collecting ev>r methods of cleanup to prevent defenders from collecting ev
>idence of their persistent presence.(Citation: Cylance Dust >idence of their persistent presence.(Citation: Cylance Dust 
>Storm)  In some instances, artifacts of persistence may also>Storm) Adversaries may also delete accounts previously creat
> be removed once an adversary’s persistence is executed in o>ed to maintain persistence (i.e. [Create Account](https://at
>rder to prevent errors with the new instance of the malware.>tack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco A
>(Citation: NCC Group Team9 June 2020)>ttack 2022)  In some instances, artifacts of persistence may
 > also be removed once an adversary’s persistence is executed
 > in order to prevent errors with the new instance of the mal
 >ware.(Citation: NCC Group Team9 June 2020)

New Detections:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Gavin Knapp']
values_changed
STIX FieldOld valueNew Value
modified2022-10-18 23:40:32.055000+00:002023-04-11 22:30:01.227000+00:00
descriptionAdversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022) In some instances, artifacts of persistence may also be removed once an adversary’s persistence is executed in order to prevent errors with the new instance of the malware.(Citation: NCC Group Team9 June 2020)
external_references[2]['source_name']NCC Group Team9 June 2020Talos - Cisco Attack 2022
external_references[2]['description']Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.Nick Biasini. (2022, August 10). Cisco Talos shares insights related to recent cyber attack on Cisco. Retrieved March 9, 2023.
external_references[2]['url']https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/https://blog.talosintelligence.com/recent-cyber-attack/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[7]Windows Registry: Windows Registry Key DeletionUser Account: User Account Deletion
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'NCC Group Team9 June 2020', 'description': 'Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.', 'url': 'https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/'}
x_mitre_data_sourcesCommand: Command Execution
x_mitre_data_sourcesWindows Registry: Windows Registry Key Deletion
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesCommand: Command Execution

[T1070.001] Indicator Removal: Clear Windows Event Logs

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may clear Windows Event Logs to hide the activitt1Adversaries may clear Windows Event Logs to hide the activit
>y of an intrusion. Windows Event Logs are a record of a comp>y of an intrusion. Windows Event Logs are a record of a comp
>uter's alerts and notifications. There are three system-defi>uter's alerts and notifications. There are three system-defi
>ned sources of events: System, Application, and Security, wi>ned sources of events: System, Application, and Security, wi
>th five event types: Error, Warning, Information, Success Au>th five event types: Error, Warning, Information, Success Au
>dit, and Failure Audit.  The event logs can be cleared with >dit, and Failure Audit.  The event logs can be cleared with 
>the following utility commands:  * <code>wevtutil cl system<>the following utility commands:  * <code>wevtutil cl system<
>/code> * <code>wevtutil cl application</code> * <code>wevtut>/code> * <code>wevtutil cl application</code> * <code>wevtut
>il cl security</code>  These logs may also be cleared throug>il cl security</code>  These logs may also be cleared throug
>h other mechanisms, such as the event viewer GUI or [PowerSh>h other mechanisms, such as the event viewer GUI or [PowerSh
>ell](https://attack.mitre.org/techniques/T1059/001).>ell](https://attack.mitre.org/techniques/T1059/001). For exa
 >mple, adversaries may use the PowerShell command <code>Remov
 >e-EventLog -LogName Security</code> to delete the Security E
 >ventLog and after reboot, disable future logging. Note: even
 >ts may still be generated and logged in the .evtx file betwe
 >en the time the command is run and the reboot.(Citation: dis
 >able_win_evt_logging)

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Lucas Heiligenstein']
values_changed
STIX FieldOld valueNew Value
modified2022-04-20 13:02:07.168000+00:002023-04-12 15:32:03.205000+00:00
descriptionAdversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. The event logs can be cleared with the following utility commands: * wevtutil cl system * wevtutil cl application * wevtutil cl security These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001).Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. The event logs can be cleared with the following utility commands: * wevtutil cl system * wevtutil cl application * wevtutil cl security These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)
external_references[1]['source_name']Microsoft Clear-EventLogdisable_win_evt_logging
external_references[1]['description']Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
external_references[1]['url']https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventloghttps://ptylu.github.io/content/report/report.html?report=25
external_references[2]['source_name']Microsoft EventLog.ClearMicrosoft Clear-EventLog
external_references[2]['description']Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.
external_references[2]['url']https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspxhttps://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog
external_references[3]['source_name']Microsoft wevtutil Oct 2017Microsoft EventLog.Clear
external_references[3]['description']Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.
external_references[3]['url']https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutilhttps://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Process: OS API ExecutionCommand: Command Execution
x_mitre_data_sources[2]Command: Command ExecutionProcess: OS API Execution
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft wevtutil Oct 2017', 'description': 'Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.', 'url': 'https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil'}

[T1115] Clipboard Data

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may collect data stored in the clipboard from ust1Adversaries may collect data stored in the clipboard from us
>ers copying information within or between applications.   In>ers copying information within or between applications.   Fo
> Windows, Applications can access clipboard data by using th>r example, on Windows adversaries can access clipboard data 
>e Windows API.(Citation: MSDN Clipboard) OSX provides a nati>by using <code>clip.exe</code> or <code>Get-Clipboard</code>
>ve command, <code>pbpaste</code>, to grab clipboard contents>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citat
>.(Citation: Operating with EmPyre)>ion: CISA_AA21_200B) Additionally, adversaries may monitor t
 >hen replace users’ clipboard with their data (e.g., [Transmi
 >tted Data Manipulation](https://attack.mitre.org/techniques/
 >T1565/002)).(Citation: mining_ruby_reversinglabs)  macOS and
 > Linux also have commands, such as <code>pbpaste</code>, to 
 >grab clipboard contents.(Citation: Operating with EmPyre)

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
external_referencesCISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.
dictionary_item_removed
STIX FieldOld valueNew Value
external_referencesCAPEC-637
values_changed
STIX FieldOld valueNew Value
modified2020-04-23 18:35:58.230000+00:002023-04-14 21:51:47.277000+00:00
descriptionAdversaries may collect data stored in the clipboard from users copying information within or between applications. In Windows, Applications can access clipboard data by using the Windows API.(Citation: MSDN Clipboard) OSX provides a native command, pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)
external_references[1]['source_name']capecCISA_AA21_200B
external_references[1]['url']https://capec.mitre.org/data/definitions/637.htmlhttps://www.cisa.gov/uscert/ncas/alerts/aa21-200b
external_references[2]['source_name']MSDN Clipboardmining_ruby_reversinglabs
external_references[2]['description']Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.
external_references[2]['url']https://msdn.microsoft.com/en-us/library/ms649012https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems
external_references[3]['source_name']Operating with EmPyreclip_win_server
external_references[3]['description']rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.
external_references[3]['url']https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'MSDN Clipboard', 'description': 'Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.', 'url': 'https://msdn.microsoft.com/en-us/library/ms649012'}
external_references{'source_name': 'Operating with EmPyre', 'description': 'rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.', 'url': 'https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363'}

[T1136.003] Create Account: Cloud Account

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may create a cloud account to maintain access tot1Adversaries may create a cloud account to maintain access to
> victim systems. With a sufficient level of access, such acc> victim systems. With a sufficient level of access, such acc
>ounts may be used to establish secondary credentialed access>ounts may be used to establish secondary credentialed access
> that does not require persistent remote access tools to be > that does not require persistent remote access tools to be 
>deployed on the system.(Citation: Microsoft O365 Admin Roles>deployed on the system.(Citation: Microsoft O365 Admin Roles
>)(Citation: Microsoft Support O365 Add Another Admin, Octobe>)(Citation: Microsoft Support O365 Add Another Admin, Octobe
>r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create >r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create 
>Cloud Identity Users)(Citation: Microsoft Azure AD Users)  A>Cloud Identity Users)(Citation: Microsoft Azure AD Users)  A
>dversaries may create accounts that only have access to spec>dversaries may create accounts that only have access to spec
>ific cloud services, which can reduce the chance of detectio>ific cloud services, which can reduce the chance of detectio
>n.>n.  Once an adversary has created a cloud account, they can 
 >then manipulate that account to ensure persistence and allow
 > access to additional resources - for example, by adding [Ad
 >ditional Cloud Credentials](https://attack.mitre.org/techniq
 >ues/T1098/001) or assigning [Additional Cloud Roles](https:/
 >/attack.mitre.org/techniques/T1098/003).
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-07 13:09:30.819000+00:002023-03-06 21:24:56.669000+00:00
descriptionAdversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users) Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection. Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.21.3

[T1078.004] Valid Accounts: Cloud Accounts

Current version: 1.5

Version changed from: 1.4 → 1.5


Old Description
New Description
t1Adversaries may obtain and abuse credentials of a cloud accot1Adversaries may obtain and abuse credentials of a cloud acco
>unt as a means of gaining Initial Access, Persistence, Privi>unt as a means of gaining Initial Access, Persistence, Privi
>lege Escalation, or Defense Evasion. Cloud accounts are thos>lege Escalation, or Defense Evasion. Cloud accounts are thos
>e created and configured by an organization for use by users>e created and configured by an organization for use by users
>, remote support, services, or for administration of resourc>, remote support, services, or for administration of resourc
>es within a cloud service provider or SaaS application. In s>es within a cloud service provider or SaaS application. In s
>ome cases, cloud accounts may be federated with traditional >ome cases, cloud accounts may be federated with traditional 
>identity management system, such as Window Active Directory.>identity management systems, such as Windows Active Director
>(Citation: AWS Identity Federation)(Citation: Google Federat>y.(Citation: AWS Identity Federation)(Citation: Google Feder
>ing GC)(Citation: Microsoft Deploying AD Federation)  Compro>ating GC)(Citation: Microsoft Deploying AD Federation)  Comp
>mised credentials for cloud accounts can be used to harvest >romised credentials for cloud accounts can be used to harves
>sensitive data from online storage accounts and databases. A>t sensitive data from online storage accounts and databases.
>ccess to cloud accounts can also be abused to gain Initial A> Access to cloud accounts can also be abused to gain Initial
>ccess to a network by abusing a [Trusted Relationship](https> Access to a network by abusing a [Trusted Relationship](htt
>://attack.mitre.org/techniques/T1199). Similar to [Domain Ac>ps://attack.mitre.org/techniques/T1199). Similar to [Domain 
>counts](https://attack.mitre.org/techniques/T1078/002), comp>Accounts](https://attack.mitre.org/techniques/T1078/002), co
>romise of federated cloud accounts may allow adversaries to >mpromise of federated cloud accounts may allow adversaries t
>more easily move laterally within an environment.  Once a cl>o more easily move laterally within an environment.  Once a 
>oud account is compromised, an adversary may perform [Accoun>cloud account is compromised, an adversary may perform [Acco
>t Manipulation](https://attack.mitre.org/techniques/T1098) ->unt Manipulation](https://attack.mitre.org/techniques/T1098)
> for example, by adding [Additional Cloud Roles](https://att> - for example, by adding [Additional Cloud Roles](https://a
>ack.mitre.org/techniques/T1098/003) - to maintain persistenc>ttack.mitre.org/techniques/T1098/003) - to maintain persiste
>e and potentially escalate their privileges.>nce and potentially escalate their privileges.

New Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 20:23:33.894000+00:002023-03-21 13:17:14.441000+00:00
descriptionAdversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment. Once a cloud account is compromised, an adversary may perform [Account Manipulation](https://attack.mitre.org/techniques/T1098) - for example, by adding [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) - to maintain persistence and potentially escalate their privileges.Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment. Once a cloud account is compromised, an adversary may perform [Account Manipulation](https://attack.mitre.org/techniques/T1098) - for example, by adding [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) - to maintain persistence and potentially escalate their privileges.
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[1]User Account: User Account AuthenticationLogon Session: Logon Session Creation
x_mitre_data_sources[2]Logon Session: Logon Session CreationUser Account: User Account Authentication
x_mitre_version1.41.5

[T1069.003] Permission Groups Discovery: Cloud Groups

Current version: 1.4

Version changed from: 1.3 → 1.4


Old Description
New Description
t1Adversaries may attempt to find cloud groups and permission t1Adversaries may attempt to find cloud groups and permission 
>settings. The knowledge of cloud permission groups can help >settings. The knowledge of cloud permission groups can help 
>adversaries determine the particular roles of users and grou>adversaries determine the particular roles of users and grou
>ps within an environment, as well as which users are associa>ps within an environment, as well as which users are associa
>ted with a particular group.  With authenticated access ther>ted with a particular group.  With authenticated access ther
>e are several tools that can be used to find permissions gro>e are several tools that can be used to find permissions gro
>ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be >ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be 
>used to obtain roles and permissions groups for Exchange and>used to obtain roles and permissions groups for Exchange and
> Office 365 accounts (Citation: Microsoft Msolrole)(Citation> Office 365 accounts (Citation: Microsoft Msolrole)(Citation
>: GitHub Raindance).  Azure CLI (AZ CLI) and the Google Clou>: GitHub Raindance).  Azure CLI (AZ CLI) and the Google Clou
>d Identity Provider API also provide interfaces to obtain pe>d Identity Provider API also provide interfaces to obtain pe
>rmissions groups. The command <code>az ad user get-member-gr>rmissions groups. The command <code>az ad user get-member-gr
>oups</code> will list groups associated to a user account fo>oups</code> will list groups associated to a user account fo
>r Azure while the API endpoint <code>GET https://cloudidenti>r Azure while the API endpoint <code>GET https://cloudidenti
>ty.googleapis.com/v1/groups</code> lists group resources ava>ty.googleapis.com/v1/groups</code> lists group resources ava
>ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit>ilable to a user for Google.(Citation: Microsoft AZ CLI)(Cit
>ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: >ation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: 
>Google Cloud Identity API Documentation)  Adversaries may at>Google Cloud Identity API Documentation) In AWS, the command
>tempt to list ACLs for objects to determine the owner and ot>s `ListRolePolicies` and `ListAttachedRolePolicies` allow us
>her accounts with access to the object, for example, via the>ers to enumerate the policies attached to a role.(Citation: 
> AWS <code>GetBucketAcl</code> API (Citation: AWS Get Bucket>Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022
> ACL). Using this information an adversary can target accoun> Adversaries may attempt to list ACLs for objects to deter
>ts with permissions to a given object or leverage accounts t>mine the owner and other accounts with access to the object,
>hey have already compromised to access the object.> for example, via the AWS <code>GetBucketAcl</code> API (Cit
 >ation: AWS Get Bucket ACL). Using this information an advers
 >ary can target accounts with permissions to a given object o
 >r leverage accounts they have already compromised to access 
 >the object.
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 02:44:58.838000+00:002023-03-21 13:33:40.625000+00:00
descriptionAdversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance). Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) In AWS, the commands `ListRolePolicies` and `ListAttachedRolePolicies` allow users to enumerate the policies attached to a role.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.
external_references[2]['source_name']Black Hills Red Teaming MS AD Azure, 2018Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022
external_references[2]['description']Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.
external_references[2]['url']https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
external_references[3]['source_name']Google Cloud Identity API DocumentationBlack Hills Red Teaming MS AD Azure, 2018
external_references[3]['description']Google. (n.d.). Retrieved March 16, 2021.Felch, M.. (2018, August 31). Red Teaming Microsoft Part 1 Active Directory Leaks via Azure. Retrieved October 6, 2019.
external_references[3]['url']https://cloud.google.com/identity/docs/reference/resthttps://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
external_references[4]['source_name']Microsoft AZ CLIGoogle Cloud Identity API Documentation
external_references[4]['description']Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.Google. (n.d.). Retrieved March 16, 2021.
external_references[4]['url']https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latesthttps://cloud.google.com/identity/docs/reference/rest
external_references[5]['source_name']Microsoft MsolroleMicrosoft AZ CLI
external_references[5]['description']Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.Microsoft. (n.d.). az ad user. Retrieved October 6, 2019.
external_references[5]['url']https://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest
external_references[6]['source_name']GitHub RaindanceMicrosoft Msolrole
external_references[6]['description']Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.Microsoft. (n.d.). Get-MsolRole. Retrieved October 6, 2019.
external_references[6]['url']https://github.com/True-Demon/raindancehttps://docs.microsoft.com/en-us/powershell/module/msonline/get-msolrole?view=azureadps-1.0
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Group: Group EnumerationCommand: Command Execution
x_mitre_data_sources[2]Command: Command ExecutionApplication Log: Application Log Content
x_mitre_data_sources[4]Application Log: Application Log ContentGroup: Group Enumeration
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'GitHub Raindance', 'description': 'Stringer, M.. (2018, November 21). RainDance. Retrieved October 6, 2019.', 'url': 'https://github.com/True-Demon/raindance'}

[T1552.005] Unsecured Credentials: Cloud Instance Metadata API

Current version: 1.4

Version changed from: 1.3 → 1.4

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2022-03-08 21:37:23.589000+00:002023-03-21 13:56:27.910000+00:00
external_references[2]['source_name']Krebs Capital One August 2019RedLock Instance Metadata API 2018
external_references[2]['description']Krebs, B.. (2019, August 19). What We Can Learn from the Capital One Hack. Retrieved March 25, 2020.Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019.
external_references[2]['url']https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse
external_references[3]['source_name']RedLock Instance Metadata API 2018Krebs Capital One August 2019
external_references[3]['description']Higashi, Michael. (2018, May 15). Instance Metadata API: A Modern Day Trojan Horse. Retrieved July 16, 2019.Krebs, B.. (2019, August 19). What We Can Learn from the Capital One Hack. Retrieved March 25, 2020.
external_references[3]['url']https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horsehttps://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
x_mitre_version1.31.4

[T1526] Cloud Service Discovery

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1An adversary may attempt to enumerate the cloud services runt1An adversary may attempt to enumerate the cloud services run
>ning on a system after gaining access. These methods can dif>ning on a system after gaining access. These methods can dif
>fer from platform-as-a-service (PaaS), to infrastructure-as->fer from platform-as-a-service (PaaS), to infrastructure-as-
>a-service (IaaS), or software-as-a-service (SaaS). Many serv>a-service (IaaS), or software-as-a-service (SaaS). Many serv
>ices exist throughout the various cloud providers and can in>ices exist throughout the various cloud providers and can in
>clude Continuous Integration and Continuous Delivery (CI/CD)>clude Continuous Integration and Continuous Delivery (CI/CD)
>, Lambda Functions, Azure AD, etc.   Adversaries maattempt>, Lambda Functions, Azure AD, etc. Themay also include sec
> to discover information about the services enabled througho>urity services, such as AWS GuardDuty and Microsoft Defender
>ut the environment. Azure tools and APIs, such as the Azure > for Cloud, and logging services, such as AWS CloudTrail and
>AD Graph API and Azure Resource Manager API, can enumerate r> Google Cloud Audit Logs.  Adversaries may attempt to discov
>esources and services, including applications, management gr>er information about the services enabled throughout the env
>oups, resources and policy definitions, and their relationsh>ironment. Azure tools and APIs, such as the Azure AD Graph A
>ips that are accessible by an identity.(Citation: Azure - Re>PI and Azure Resource Manager API, can enumerate resources a
>source Manager API)(Citation: Azure AD Graph API)  Stormspot>nd services, including applications, management groups, reso
>ter is an open source tool for enumerating and constructing >urces and policy definitions, and their relationships that a
>a graph for Azure resources and services, and Pacu is an ope>re accessible by an identity.(Citation: Azure - Resource Man
>n source AWS exploitation framework that supports several me>ager API)(Citation: Azure AD Graph API)  For example, Storms
>thods for discovering cloud services.(Citation: Azure - Stor>potter is an open source tool for enumerating and constructi
>mspotter)(Citation: GitHub Pacu)>ng a graph for Azure resources and services, and Pacu is an 
 >open source AWS exploitation framework that supports several
 > methods for discovering cloud services.(Citation: Azure - S
 >tormspotter)(Citation: GitHub Pacu)  Adversaries may use the
 > information gained to shape follow-on behaviors, such as ta
 >rgeting data or credentials from enumerated services or evad
 >ing identified defenses through [Disable or Modify Tools](ht
 >tps://attack.mitre.org/techniques/T1562/001) or [Disable Clo
 >ud Logs](https://attack.mitre.org/techniques/T1562/008).
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-03-16 12:57:03.837000+00:002023-04-11 20:33:55.356000+00:00
descriptionAn adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API) For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu) Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008).
external_references[1]['source_name']Azure - Resource Manager APIAzure AD Graph API
external_references[1]['description']Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020.Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020.
external_references[1]['url']https://docs.microsoft.com/en-us/rest/api/resources/https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overview
external_references[2]['source_name']Azure AD Graph APIAzure - Resource Manager API
external_references[2]['description']Microsoft. (2016, March 26). Operations overview | Graph API concepts. Retrieved June 18, 2020.Microsoft. (2019, May 20). Azure Resource Manager. Retrieved June 17, 2020.
external_references[2]['url']https://docs.microsoft.com/en-us/previous-versions/azure/ad/graph/howto/azure-ad-graph-api-operations-overviewhttps://docs.microsoft.com/en-us/rest/api/resources/
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsThanabodi

[T1059] Command and Scripting Interpreter

Current version: 2.4

Version changed from: 2.3 → 2.4

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 18:31:48.827000+00:002023-03-27 16:43:58.795000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Process: Process CreationCommand: Command Execution
x_mitre_data_sources[1]Module: Module LoadProcess: Process Creation
x_mitre_data_sources[3]Script: Script ExecutionModule: Module Load
x_mitre_data_sources[4]Command: Command ExecutionScript: Script Execution
x_mitre_version2.32.4
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsOffice 365
x_mitre_platformsAzure AD
x_mitre_platformsIaaS
x_mitre_platformsGoogle Workspace

[T1218.001] System Binary Proxy Execution: Compiled HTML File

Current version: 2.1

Version changed from: 2.0 → 2.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2022-03-11 18:59:36.836000+00:002023-04-21 12:23:17.694000+00:00
external_references[1]['source_name']Microsoft HTML Help May 2018Microsoft CVE-2017-8625 Aug 2017
external_references[1]['description']Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved October 3, 2018.Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer Security Feature Bypass Vulnerability. Retrieved October 3, 2018.
external_references[1]['url']https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdkhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625
external_references[2]['source_name']Microsoft HTML Help ActiveXMicrosoft HTML Help May 2018
external_references[2]['description']Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved October 3, 2018.Microsoft. (2018, May 30). Microsoft HTML Help 1.4. Retrieved October 3, 2018.
external_references[2]['url']https://msdn.microsoft.com/windows/desktop/ms644670https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk
external_references[4]['source_name']MsitPros CHM Aug 2017Microsoft HTML Help ActiveX
external_references[4]['description']Moe, O. (2017, August 13). Bypassing Device guard UMCI using CHM – CVE-2017-8625. Retrieved October 3, 2018.Microsoft. (n.d.). HTML Help ActiveX Control Overview. Retrieved October 3, 2018.
external_references[4]['url']https://msitpros.com/?p=3909https://msdn.microsoft.com/windows/desktop/ms644670
external_references[5]['source_name']Microsoft CVE-2017-8625 Aug 2017MsitPros CHM Aug 2017
external_references[5]['description']Microsoft. (2017, August 8). CVE-2017-8625 - Internet Explorer Security Feature Bypass Vulnerability. Retrieved October 3, 2018.Moe, O. (2017, August 13). Bypassing Device guard UMCI using CHM – CVE-2017-8625. Retrieved October 3, 2018.
external_references[5]['url']https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625https://msitpros.com/?p=3909
x_mitre_version2.02.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation

[T1546.015] Event Triggered Execution: Component Object Model Hijacking

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2020-11-10 18:19:44.750000+00:002023-04-21 12:34:29.402000+00:00
external_references[1]['source_name']Microsoft Component Object ModelElastic COM Hijacking
external_references[1]['description']Microsoft. (n.d.). The Component Object Model. Retrieved August 18, 2016.Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting Persistence & Evasion with the COM. Retrieved September 15, 2016.
external_references[1]['url']https://msdn.microsoft.com/library/ms694363.aspxhttps://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-com
external_references[3]['source_name']Elastic COM HijackingMicrosoft Component Object Model
external_references[3]['description']Ewing, P. Strom, B. (2016, September 15). How to Hunt: Detecting Persistence & Evasion with the COM. Retrieved September 15, 2016.Microsoft. (n.d.). The Component Object Model. Retrieved August 18, 2016.
external_references[3]['url']https://www.elastic.co/blog/how-hunt-detecting-persistence-evasion-comhttps://msdn.microsoft.com/library/ms694363.aspx
x_mitre_data_sources[0]Command: Command ExecutionModule: Module Load
x_mitre_data_sources[1]Process: Process CreationCommand: Command Execution
x_mitre_data_sources[3]Module: Module LoadProcess: Process Creation
x_mitre_version1.01.1

[T1586] Compromise Accounts

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may compromise accounts with services that can bt1Adversaries may compromise accounts with services that can b
>e used during targeting. For operations incorporating social>e used during targeting. For operations incorporating social
> engineering, the utilization of an online persona may be im> engineering, the utilization of an online persona may be im
>portant. Rather than creating and cultivating accounts (i.e.>portant. Rather than creating and cultivating accounts (i.e.
> [Establish Accounts](https://attack.mitre.org/techniques/T1> [Establish Accounts](https://attack.mitre.org/techniques/T1
>585)), adversaries may compromise existing accounts. Utilizi>585)), adversaries may compromise existing accounts. Utilizi
>ng an existing persona may engender a level of trust in a po>ng an existing persona may engender a level of trust in a po
>tential victim if they have a relationship, or knowledge of,>tential victim if they have a relationship, or knowledge of,
> the compromised persona.   A variety of methods exist for c> the compromised persona.   A variety of methods exist for c
>ompromising accounts, such as gathering credentials via [Phi>ompromising accounts, such as gathering credentials via [Phi
>shing for Information](https://attack.mitre.org/techniques/T>shing for Information](https://attack.mitre.org/techniques/T
>1598), purchasing credentials from third-party sites, or b>1598), purchasing credentials from third-party sites, brute 
>brute forcing credentials (ex: password reuse from breach cr>forcing credentials (ex: password reuse from breach credenti
>edential dumps).(Citation: AnonHBGary) Prior to compromising>al dumps), or paying employees, suppliers or business partne
> accounts, adversaries may conduct Reconnaissance to inform >rs for access to credentials.(Citation: AnonHBGary)(Citation
>decisions about which accounts to compromise to further thei>: Microsoft DEV-0537) Prior to compromising accounts, advers
>r operation.  Personas may exist on a single site or across >aries may conduct Reconnaissance to inform decisions about w
>multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc>hich accounts to compromise to further their operation.  Per
>.). Compromised accounts may require additional development,>sonas may exist on a single site or across multiple sites (e
> this could include filling out or modifying profile informa>x: Facebook, LinkedIn, Twitter, Google, etc.). Compromised a
>tion, further developing social networks, or incorporating p>ccounts may require additional development, this could inclu
>hotos.  Adversaries may directly leverage compromised email >de filling out or modifying profile information, further dev
>accounts for [Phishing for Information](https://attack.mitre>eloping social networks, or incorporating photos.  Adversari
>.org/techniques/T1598) or [Phishing](https://attack.mitre.or>es may directly leverage compromised email accounts for [Phi
>g/techniques/T1566).>shing for Information](https://attack.mitre.org/techniques/T
 >1598) or [Phishing](https://attack.mitre.org/techniques/T156
 >6).
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-16 17:15:12.428000+00:002023-04-11 01:08:56.774000+00:00
descriptionAdversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. A variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos. Adversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).
x_mitre_data_sources[0]Persona: Social MediaNetwork Traffic: Network Traffic Content
x_mitre_data_sources[1]Network Traffic: Network Traffic ContentPersona: Social Media
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'}

[T1584] Compromise Infrastructure

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may compromise third-party infrastructure that ct1Adversaries may compromise third-party infrastructure that c
>an be used during targeting. Infrastructure solutions includ>an be used during targeting. Infrastructure solutions includ
>e physical or cloud servers, domains, and third-party web an>e physical or cloud servers, domains, and third-party web an
>d DNS services. Instead of buying, leasing, or renting infra>d DNS services. Instead of buying, leasing, or renting infra
>structure an adversary may compromise infrastructure and use>structure an adversary may compromise infrastructure and use
> it during other phases of the adversary lifecycle.(Citation> it during other phases of the adversary lifecycle.(Citation
>: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio>: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio
>n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens >n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens 
>Part 2) Additionally, adversaries may compromise numerous ma>Part 2) Additionally, adversaries may compromise numerous ma
>chines to form a botnet they can leverage.  Use of compromis>chines to form a botnet they can leverage.  Use of compromis
>ed infrastructure allows an adversary to stage, launch, and >ed infrastructure allows adversaries to stage, launch, and e
>execute an operation. Compromised infrastructure can help ad>xecute operations. Compromised infrastructure can help adver
>versary operations blend in with traffic that is seen as nor>sary operations blend in with traffic that is seen as normal
>mal, such as contact with high reputation or trusted sites. >, such as contact with high reputation or trusted sites. For
>For example, adversaries may leverage compromised infrastruc> example, adversaries may leverage compromised infrastructur
>ture (potentially also in conjunction with [Digital Certific>e (potentially also in conjunction with [Digital Certificate
>ates](https://attack.mitre.org/techniques/T1588/004)) to fur>s](https://attack.mitre.org/techniques/T1588/004)) to furthe
>ther blend in and support staged information gathering and/o>r blend in and support staged information gathering and/or [
>r [Phishing](https://attack.mitre.org/techniques/T1566) camp>Phishing](https://attack.mitre.org/techniques/T1566) campaig
>aigns.(Citation: FireEye DNS Hijack 2019)   By using comprom>ns.(Citation: FireEye DNS Hijack 2019) Additionally, adversa
>ised infrastructure, adversaries may make it difficult to ti>ries may also compromise infrastructure to support [Proxy](h
>e their actions back to them. Prior to targeting, adversarie>ttps://attack.mitre.org/techniques/T1090).(Citation: amnesty
>s may compromise the infrastructure of other adversaries.(Ci>_nso_pegasus)  By using compromised infrastructure, adversar
>tation: NSA NCSC Turla OilRig)>ies may make it difficult to tie their actions back to them.
 > Prior to targeting, adversaries may compromise the infrastr
 >ucture of other adversaries.(Citation: NSA NCSC Turla OilRig
 >)
Details
values_changed
STIX FieldOld valueNew Value
modified2022-07-26 23:33:26.352000+00:002023-04-12 13:32:15.704000+00:00
descriptionAdversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows an adversary to stage, launch, and execute an operation. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage. Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus) By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)
external_references[1]['source_name']FireEye DNS Hijack 2019amnesty_nso_pegasus
external_references[1]['description']Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022.
external_references[1]['url']https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.htmlhttps://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/
external_references[2]['source_name']ICANNDomainNameHijackingFireEye DNS Hijack 2019
external_references[2]['description']ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.
external_references[2]['url']https://www.icann.org/groups/ssac/documents/sac-007-enhttps://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html
external_references[3]['source_name']Koczwara Beacon Hunting Sep 2021ICANNDomainNameHijacking
external_references[3]['description']Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.
external_references[3]['url']https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2https://www.icann.org/groups/ssac/documents/sac-007-en
external_references[4]['source_name']Mandiant APT1Koczwara Beacon Hunting Sep 2021
external_references[4]['description']Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.
external_references[4]['url']https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdfhttps://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
external_references[5]['source_name']Talos DNSpionage Nov 2018Mandiant APT1
external_references[5]['description']Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
external_references[5]['url']https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.htmlhttps://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
external_references[6]['source_name']NSA NCSC Turla OilRigTalos DNSpionage Nov 2018
external_references[6]['description']NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.
external_references[6]['url']https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdfhttps://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html
external_references[7]['source_name']Mandiant SCANdalous Jul 2020NSA NCSC Turla OilRig
external_references[7]['description']Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021.NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.
external_references[7]['url']https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automationhttps://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf
external_references[8]['source_name']ThreatConnect Infrastructure Dec 2020Mandiant SCANdalous Jul 2020
external_references[8]['description']ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021.
external_references[8]['url']https://threatconnect.com/blog/infrastructure-research-hunting/https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation
external_references[9]['source_name']FireEye EPS Awakens Part 2ThreatConnect Infrastructure Dec 2020
external_references[9]['description']Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.
external_references[9]['url']https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.htmlhttps://threatconnect.com/blog/infrastructure-research-hunting/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Domain Name: Active DNSInternet Scan: Response Content
x_mitre_data_sources[2]Internet Scan: Response ContentDomain Name: Domain Registration
x_mitre_data_sources[4]Domain Name: Domain RegistrationDomain Name: Active DNS
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'FireEye EPS Awakens Part 2', 'description': 'Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.', 'url': 'https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html'}
x_mitre_contributorsShailesh Tiwary (Indian Army)

[T1552.007] Unsecured Credentials: Container API

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User', 'Administrator']
values_changed
STIX FieldOld valueNew Value
modified2022-04-01 13:11:10.849000+00:002023-04-15 16:11:25.409000+00:00
external_references[1]['source_name']Docker APIUnit 42 Unsecured Docker Daemons
external_references[1]['description']Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved March 31, 2021.Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.
external_references[1]['url']https://docs.docker.com/engine/api/v1.41/https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/
external_references[2]['source_name']Kubernetes APIDocker API
external_references[2]['description']The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved March 31, 2021.
external_references[2]['url']https://kubernetes.io/docs/concepts/overview/kubernetes-api/https://docs.docker.com/engine/api/v1.41/
external_references[3]['source_name']Unit 42 Unsecured Docker DaemonsKubernetes API
external_references[3]['description']Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.
external_references[3]['url']https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/https://kubernetes.io/docs/concepts/overview/kubernetes-api/
x_mitre_version1.11.2

[T1609] Container Administration Command

Current version: 1.2

Version changed from: 1.1 → 1.2

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2022-04-01 13:16:14.786000+00:002023-04-15 16:03:19.642000+00:00
external_references[1]['source_name']Docker Daemon CLIDocker Exec
external_references[1]['description']Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.
external_references[1]['url']https://docs.docker.com/engine/reference/commandline/dockerd/https://docs.docker.com/engine/reference/commandline/exec/
external_references[2]['source_name']Kubernetes APIDocker Entrypoint
external_references[2]['description']The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.
external_references[2]['url']https://kubernetes.io/docs/concepts/overview/kubernetes-api/https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime
external_references[3]['source_name']Kubernetes KubeletDocker Daemon CLI
external_references[3]['description']The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021.Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.
external_references[3]['url']https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/https://docs.docker.com/engine/reference/commandline/dockerd/
external_references[4]['source_name']Docker EntrypointKubectl Exec Get Shell
external_references[4]['description']Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021.
external_references[4]['url']https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtimehttps://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/
external_references[5]['source_name']Docker ExecKubernetes Kubelet
external_references[5]['description']Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021.
external_references[5]['url']https://docs.docker.com/engine/reference/commandline/exec/https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
external_references[6]['source_name']Kubectl Exec Get ShellKubernetes API
external_references[6]['description']The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021.The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.
external_references[6]['url']https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/https://kubernetes.io/docs/concepts/overview/kubernetes-api/
x_mitre_version1.11.2

[T1053.007] Scheduled Task/Job: Container Orchestration Job

Current version: 1.3

Version changed from: 1.2 → 1.3

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2022-04-01 13:06:58.794000+00:002023-04-15 16:23:05.392000+00:00
external_references[1]['source_name']Kubernetes JobsKubernetes CronJob
external_references[1]['description']The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March 30, 2021.The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved March 29, 2021.
external_references[1]['url']https://kubernetes.io/docs/concepts/workloads/controllers/job/https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
external_references[2]['source_name']Kubernetes CronJobKubernetes Jobs
external_references[2]['description']The Kubernetes Authors. (n.d.). Kubernetes CronJob. Retrieved March 29, 2021.The Kubernetes Authors. (n.d.). Kubernetes Jobs. Retrieved March 30, 2021.
external_references[2]['url']https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/https://kubernetes.io/docs/concepts/workloads/controllers/job/
x_mitre_data_sources[0]File: File CreationScheduled Job: Scheduled Job Creation
x_mitre_data_sources[2]Scheduled Job: Scheduled Job CreationFile: File Creation
x_mitre_version1.21.3

[T1613] Container and Resource Discovery

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-04-12 18:22:05.737000+00:002023-04-15 16:08:50.706000+00:00
x_mitre_version1.01.1

[T1136] Create Account

Current version: 2.3

Version changed from: 2.2 → 2.3

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['Administrator']
values_changed
STIX FieldOld valueNew Value
modified2021-08-12 13:04:14.534000+00:002023-04-12 23:24:48.840000+00:00
x_mitre_version2.22.3
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsAustin Clark, @c2defense
x_mitre_data_sourcesProcess: Process Creation
x_mitre_platformsNetwork
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation

[T1134.002] Access Token Manipulation: Create Process with Token

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may create a new process with a different token t1Adversaries may create a new process with an existing token 
>to escalate privileges and bypass access controls. Processes>to escalate privileges and bypass access controls. Processes
> can be created with the token and resulting security contex> can be created with the token and resulting security contex
>t of another user using features such as <code>CreateProcess>t of another user using features such as <code>CreateProcess
>WithTokenW</code> and <code>runas</code>.(Citation: Microsof>WithTokenW</code> and <code>runas</code>.(Citation: Microsof
>t RunAs)  Creating processes with a different token may requ>t RunAs)  Creating processes with a token not associated wit
>ire the credentials of the target user, specific privileges >h the current user may require the credentials of the target
>to impersonate that user, or access to the token to be used > user, specific privileges to impersonate that user, or acce
>(ex: gathered via other means such as [Token Impersonation/T>ss to the token to be used. For example, the token could be 
>heft](https://attack.mitre.org/techniques/T1134/001) or [Mak>duplicated via [Token Impersonation/Theft](https://attack.mi
>e and Impersonate Token](https://attack.mitre.org/techniques>tre.org/techniques/T1134/001) or created via [Make and Imper
>/T1134/003)).>sonate Token](https://attack.mitre.org/techniques/T1134/003)
 > before being used to create a process.  While this techniqu
 >e is distinct from [Token Impersonation/Theft](https://attac
 >k.mitre.org/techniques/T1134/001), the techniques can be use
 >d in conjunction where a token is duplicated and then used t
 >o create a new process.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-17 14:51:48.978000+00:002023-04-11 21:14:37.714000+00:00
descriptionAdversaries may create a new process with a different token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs) Creating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used (ex: gathered via other means such as [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003)).Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
external_references[1]['source_name']Microsoft RunAsMicrosoft Command-line Logging
external_references[1]['description']Microsoft. (2016, August 31). Runas. Retrieved October 1, 2021.Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.
external_references[1]['url']https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing
external_references[2]['source_name']Microsoft Command-line LoggingMicrosoft RunAs
external_references[2]['description']Mathers, B. (2017, March 7). Command line process auditing. Retrieved April 21, 2017.Microsoft. (2016, August 31). Runas. Retrieved October 1, 2021.
external_references[2]['url']https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditinghttps://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)
x_mitre_data_sources[0]Command: Command ExecutionProcess: OS API Execution
x_mitre_data_sources[1]Process: OS API ExecutionCommand: Command Execution
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsJonny Johnson

[T1110.004] Brute Force: Credential Stuffing

Current version: 1.3

Version changed from: 1.2 → 1.3

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
external_referencesUS-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
external_referencesCAPEC-600
values_changed
STIX FieldOld valueNew Value
modified2021-04-06 12:31:06.695000+00:002023-04-14 23:05:16.857000+00:00
external_references[1]['source_name']capecUS-CERT TA18-068A 2018
external_references[1]['url']https://capec.mitre.org/data/definitions/600.htmlhttps://www.us-cert.gov/ncas/alerts/TA18-086A
x_mitre_data_sources[0]User Account: User Account AuthenticationApplication Log: Application Log Content
x_mitre_data_sources[1]Application Log: Application Log ContentUser Account: User Account Authentication
x_mitre_version1.21.3
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'US-CERT TA18-068A 2018', 'description': 'US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-086A'}

[T1589.001] Gather Victim Identity Information: Credentials

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may gather credentials that can be used during tt1Adversaries may gather credentials that can be used during t
>argeting. Account credentials gathered by adversaries may be>argeting. Account credentials gathered by adversaries may be
> those directly associated with the target victim organizati> those directly associated with the target victim organizati
>on or attempt to take advantage of the tendency for users to>on or attempt to take advantage of the tendency for users to
> use the same passwords across personal and business account> use the same passwords across personal and business account
>s.  Adversaries may gather credentials from potential victim>s.  Adversaries may gather credentials from potential victim
>s in various ways, such as direct elicitation via [Phishing >s in various ways, such as direct elicitation via [Phishing 
>for Information](https://attack.mitre.org/techniques/T1598).>for Information](https://attack.mitre.org/techniques/T1598).
> Adversaries may also compromise sites then include maliciou> Adversaries may also compromise sites then add malicious co
>s content designed to collect website authentication cookies>ntent designed to collect website authentication cookies fro
> from visitors.(Citation: ATT ScanBox) Credential informatio>m visitors.(Citation: ATT ScanBox) Credential information ma
>n may also be exposed to adversaries via leaks to online or >y also be exposed to adversaries via leaks to online or othe
>other accessible data sets (ex: [Search Engines](https://att>r accessible data sets (ex: [Search Engines](https://attack.
>ack.mitre.org/techniques/T1593/002), breach dumps, code repo>mitre.org/techniques/T1593/002), breach dumps, code reposito
>sitories, etc.).(Citation: Register Deloitte)(Citation: Regi>ries, etc.).(Citation: Register Deloitte)(Citation: Register
>ster Uber)(Citation: Detectify Slack Tokens)(Citation: Forbe> Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes Gi
>s GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHu>tHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gi
>b Gitrob)(Citation: CNET Leaks) Adversaries may also purchas>trob)(Citation: CNET Leaks) Adversaries may also purchase cr
>e credentials from dark web or other black-markets. Gatherin>edentials from dark web or other black-markets. Finally, whe
>g this information may reveal opportunities for other forms >re multi-factor authentication (MFA) based on out-of-band co
>of reconnaissance (ex: [Search Open Websites/Domains](https:>mmunications is in use, adversaries may compromise a service
>//attack.mitre.org/techniques/T1593) or [Phishing for Inform> provider to gain access to MFA codes and one-time passwords
>ation](https://attack.mitre.org/techniques/T1598)), establis> (OTP).(Citation: Okta Scatter Swine 2022)  Gathering this i
>hing operational resources (ex: [Compromise Accounts](https:>nformation may reveal opportunities for other forms of recon
>//attack.mitre.org/techniques/T1586)), and/or initial access>naissance (ex: [Search Open Websites/Domains](https://attack
> (ex: [External Remote Services](https://attack.mitre.org/te>.mitre.org/techniques/T1593) or [Phishing for Information](h
>chniques/T1133) or [Valid Accounts](https://attack.mitre.org>ttps://attack.mitre.org/techniques/T1598)), establishing ope
>/techniques/T1078)).>rational resources (ex: [Compromise Accounts](https://attack
 >.mitre.org/techniques/T1586)), and/or initial access (ex: [E
 >xternal Remote Services](https://attack.mitre.org/techniques
 >/T1133) or [Valid Accounts](https://attack.mitre.org/techniq
 >ues/T1078)). 
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-04-15 03:26:44.352000+00:002023-04-14 23:29:10.396000+00:00
descriptionAdversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts. Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Finally, where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
external_references[2]['source_name']Register DeloitteDetectify Slack Tokens
external_references[2]['description']Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020.
external_references[2]['url']https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/
external_references[3]['source_name']Register UberGitHub truffleHog
external_references[3]['description']McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020.Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020.
external_references[3]['url']https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/https://github.com/dxa4481/truffleHog
external_references[4]['source_name']Detectify Slack TokensRegister Uber
external_references[4]['description']Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020.McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020.
external_references[4]['url']https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/
external_references[5]['source_name']Forbes GitHub CredsGitHub Gitrob
external_references[5]['description']Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020.Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020.
external_references[5]['url']https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196https://github.com/michenriksen/gitrob
external_references[6]['source_name']GitHub truffleHogCNET Leaks
external_references[6]['description']Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020.Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.
external_references[6]['url']https://github.com/dxa4481/truffleHoghttps://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/
external_references[7]['source_name']GitHub GitrobOkta Scatter Swine 2022
external_references[7]['description']Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020.Okta. (2022, August 25). Detecting Scatter Swine: Insights into a Relentless Phishing Campaign. Retrieved February 24, 2023.
external_references[7]['url']https://github.com/michenriksen/gitrobhttps://sec.okta.com/scatterswine
external_references[8]['source_name']CNET LeaksForbes GitHub Creds
external_references[8]['description']Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020.
external_references[8]['url']https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Register Deloitte', 'description': "Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.", 'url': 'https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/'}

[T1132] Data Encoding

Current version: 1.2

Version changed from: 1.1 → 1.2

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2020-03-14 23:39:50.338000+00:002023-04-21 12:20:20.711000+00:00
external_references[1]['source_name']Wikipedia Binary-to-text EncodingUniversity of Birmingham C2
external_references[1]['description']Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
external_references[1]['url']https://en.wikipedia.org/wiki/Binary-to-text_encodinghttps://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
external_references[2]['source_name']Wikipedia Character EncodingWikipedia Binary-to-text Encoding
external_references[2]['description']Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.
external_references[2]['url']https://en.wikipedia.org/wiki/Character_encodinghttps://en.wikipedia.org/wiki/Binary-to-text_encoding
external_references[3]['source_name']University of Birmingham C2Wikipedia Character Encoding
external_references[3]['description']Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.
external_references[3]['url']https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdfhttps://en.wikipedia.org/wiki/Character_encoding
x_mitre_version1.11.2

[T1005] Data from Local System

Current version: 1.6

Version changed from: 1.5 → 1.6


Old Description
New Description
t1Adversaries may search local system sources, such as file syt1Adversaries may search local system sources, such as file sy
>stems and configuration files or local databases, to find fi>stems and configuration files or local databases, to find fi
>les of interest and sensitive data prior to Exfiltration.  A>les of interest and sensitive data prior to Exfiltration.  A
>dversaries may do this using a [Command and Scripting Interp>dversaries may do this using a [Command and Scripting Interp
>reter](https://attack.mitre.org/techniques/T1059), such as [>reter](https://attack.mitre.org/techniques/T1059), such as [
>cmd](https://attack.mitre.org/software/S0106) as well as a [>cmd](https://attack.mitre.org/software/S0106) as well as a [
>Network Device CLI](https://attack.mitre.org/techniques/T105>Network Device CLI](https://attack.mitre.org/techniques/T105
>9/008), which have functionality to interact with the file s>9/008), which have functionality to interact with the file s
>ystem to gather information. Adversaries may also use [Autom>ystem to gather information.(Citation: show_run_config_cmd_c
>ated Collection](https://attack.mitre.org/techniques/T1119) >isco) Adversaries may also use [Automated Collection](https:
>on the local system. >//attack.mitre.org/techniques/T1119) on the local system. 

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-19 21:55:54.866000+00:002023-04-12 23:54:39.466000+00:00
descriptionAdversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information. Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system. Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
external_references[1]['source_name']Mandiant APT41 Global Intrusion show_run_config_cmd_cisco
external_references[1]['description']Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.Cisco. (2022, August 16). show running-config - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022.
external_references[1]['url']https://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploitshttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_protocols_through_showmon.html#wp2760878733
external_references[2]['source_name']US-CERT-TA18-106AMandiant APT41 Global Intrusion
external_references[2]['description']US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.
external_references[2]['url']https://www.us-cert.gov/ncas/alerts/TA18-106Ahttps://www.mandiant.com/resources/apt41-initiates-global-intrusion-campaign-using-multiple-exploits
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Process: OS API ExecutionCommand: Command Execution
x_mitre_data_sources[1]File: File AccessProcess: Process Creation
x_mitre_data_sources[2]Process: Process CreationFile: File Access
x_mitre_data_sources[3]Script: Script ExecutionProcess: OS API Execution
x_mitre_data_sources[4]Command: Command ExecutionScript: Script Execution
x_mitre_detectionMonitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to collect files such as configuration files with built-in features native to the network device platform.(Citation: Mandiant APT41 Global Intrusion )(Citation: US-CERT-TA18-106A) Monitor CLI activity for unexpected or unauthorized use commands being run by non-standard users from non-standard locations. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). For network infrastructure devices, collect AAA logging to monitor `show` commands that view configuration files.
x_mitre_version1.51.6
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'US-CERT-TA18-106A', 'description': 'US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-106A'}

[T1140] Deobfuscate/Decode Files or Information

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may use [Obfuscated Files or Information](https:t1Adversaries may use [Obfuscated Files or Information](https:
>//attack.mitre.org/techniques/T1027) to hide artifacts of an>//attack.mitre.org/techniques/T1027) to hide artifacts of an
> intrusion from analysis. They may require separate mechanis> intrusion from analysis. They may require separate mechanis
>ms to decode or deobfuscate that information depending on ho>ms to decode or deobfuscate that information depending on ho
>w they intend to use it. Methods for doing that include buil>w they intend to use it. Methods for doing that include buil
>t-in functionality of malware or by using utilities present >t-in functionality of malware or by using utilities present 
>on the system.  One such example is use of [certutil](https:>on the system.  One such example is the use of [certutil](ht
>//attack.mitre.org/software/S0160) to decode a remote access>tps://attack.mitre.org/software/S0160) to decode a remote ac
> tool portable executable file that has been hidden inside a>cess tool portable executable file that has been hidden insi
> certificate file. (Citation: Malwarebytes Targeted Attack a>de a certificate file.(Citation: Malwarebytes Targeted Attac
>gainst Saudi Arabia) Another example is using the Windows <c>k against Saudi Arabia) Another example is using the Windows
>ode>copy /b</code> command to reassemble binary fragments in> <code>copy /b</code> command to reassemble binary fragments
>to a malicious payload. (Citation: Carbon Black Obfuscation > into a malicious payload.(Citation: Carbon Black Obfuscatio
>Sept 2016)  Sometimes a user's action may be required to ope>n Sept 2016)  Sometimes a user's action may be required to o
>n it for deobfuscation or decryption as part of [User Execut>pen it for deobfuscation or decryption as part of [User Exec
>ion](https://attack.mitre.org/techniques/T1204). The user ma>ution](https://attack.mitre.org/techniques/T1204). The user 
>y also be required to input a password to open a password pr>may also be required to input a password to open a password 
>otected compressed/encrypted file that was provided by the a>protected compressed/encrypted file that was provided by the
>dversary. (Citation: Volexity PowerDuke November 2016)> adversary. (Citation: Volexity PowerDuke November 2016)

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-05-05 04:05:42.508000+00:002023-04-21 12:21:06.026000+00:00
descriptionAdversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file. (Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload. (Citation: Carbon Black Obfuscation Sept 2016) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system. One such example is the use of [certutil](https://attack.mitre.org/software/S0160) to decode a remote access tool portable executable file that has been hidden inside a certificate file.(Citation: Malwarebytes Targeted Attack against Saudi Arabia) Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.(Citation: Carbon Black Obfuscation Sept 2016) Sometimes a user's action may be required to open it for deobfuscation or decryption as part of [User Execution](https://attack.mitre.org/techniques/T1204). The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary. (Citation: Volexity PowerDuke November 2016)
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation

[T1610] Deploy Container

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User', 'root']
values_changed
STIX FieldOld valueNew Value
modified2022-04-01 13:14:58.939000+00:002023-04-15 16:13:40.232000+00:00
external_references[1]['source_name']Docker Containers APIAqua Build Images on Hosts
external_references[1]['description']Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021.Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.
external_references[1]['url']https://docs.docker.com/engine/api/v1.41/#tag/Containerhttps://blog.aquasec.com/malicious-container-image-docker-container-host
external_references[2]['source_name']Kubernetes DashboardDocker Containers API
external_references[2]['description']The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021.
external_references[2]['url']https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/https://docs.docker.com/engine/api/v1.41/#tag/Container
external_references[4]['source_name']Aqua Build Images on HostsKubernetes Dashboard
external_references[4]['description']Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.
external_references[4]['url']https://blog.aquasec.com/malicious-container-image-docker-container-hosthttps://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/
x_mitre_data_sources[1]Container: Container CreationApplication Log: Application Log Content
x_mitre_data_sources[3]Application Log: Application Log ContentContainer: Container Creation
x_mitre_version1.11.2

[T1098.005] Account Manipulation: Device Registration

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may register a device to an adversary-controlledt1Adversaries may register a device to an adversary-controlled
> account. Devices may be registered in a multifactor authent> account. Devices may be registered in a multifactor authent
>ication (MFA) system, which handles authentication to the ne>ication (MFA) system, which handles authentication to the ne
>twork, or in a device management system, which handles devic>twork, or in a device management system, which handles devic
>e access and compliance.  MFA systems, such as Duo or Okta, >e access and compliance.  MFA systems, such as Duo or Okta, 
>allow users to associate devices with their accounts in orde>allow users to associate devices with their accounts in orde
>r to complete MFA requirements. An adversary that compromise>r to complete MFA requirements. An adversary that compromise
>s a user’s credentials may enroll a new device in order to b>s a user’s credentials may enroll a new device in order to b
>ypass initial MFA requirements and gain persistent access to>ypass initial MFA requirements and gain persistent access to
> a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar> a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar
>kReading FireEye SolarWinds)  Similarly, an adversary with e>kReading FireEye SolarWinds) In some cases, the MFA self-enr
>xisting access to a network may register a device to Azure A>ollment process may require only a username and password to 
>D and/or its device management system, Microsoft Intune, in >enroll the account's first device or to enroll a device to a
>order to access sensitive data or resources while bypassing >n inactive account. (Citation: Mandiant APT29 Microsoft 365 
>conditional access policies.(Citation: AADInternals - Device>2022)  Similarly, an adversary with existing access to a net
> Registration)(Citation: AADInternals - Conditional Access B>work may register a device to Azure AD and/or its device man
>ypass)(Citation: Microsoft DEV-0537)   Devices registered in>agement system, Microsoft Intune, in order to access sensiti
> Azure AD may be able to conduct [Internal Spearphishing](ht>ve data or resources while bypassing conditional access poli
>tps://attack.mitre.org/techniques/T1534) campaigns via intra>cies.(Citation: AADInternals - Device Registration)(Citation
>-organizational emails, which are less likely to be treated >: AADInternals - Conditional Access Bypass)(Citation: Micros
>as suspicious by the email client.(Citation: Microsoft - Dev>oft DEV-0537)   Devices registered in Azure AD may be able t
>ice Registration) Additionally, an adversary may be able to >o conduct [Internal Spearphishing](https://attack.mitre.org/
>perform a [Service Exhaustion Flood](https://attack.mitre.or>techniques/T1534) campaigns via intra-organizational emails,
>g/techniques/T1499/002) on an Azure AD tenant by registering> which are less likely to be treated as suspicious by the em
> a large number of devices.(Citation: AADInternals - BPRT)>ail client.(Citation: Microsoft - Device Registration) Addit
 >ionally, an adversary may be able to perform a [Service Exha
 >ustion Flood](https://attack.mitre.org/techniques/T1499/002)
 > on an Azure AD tenant by registering a large number of devi
 >ces.(Citation: AADInternals - BPRT)
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-25 16:26:53.204000+00:002023-04-20 18:14:17.197000+00:00
descriptionAdversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537) Devices registered in Azure AD may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Azure AD tenant by registering a large number of devices.(Citation: AADInternals - BPRT)Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance. MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022) Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537) Devices registered in Azure AD may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Azure AD tenant by registering a large number of devices.(Citation: AADInternals - BPRT)
external_references[2]['source_name']AADInternals - Conditional Access BypassMandiant APT29 Microsoft 365 2022
external_references[2]['description']Dr. Nestori Syynimaa. (2020, September 6). Bypassing conditional access by faking device compliance. Retrieved March 4, 2022.Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023.
external_references[2]['url']https://o365blog.com/post/mdmhttps://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft
external_references[3]['source_name']AADInternals - BPRTAADInternals - Conditional Access Bypass
external_references[3]['description']Dr. Nestori Syynimaa. (2021, January 31). BPRT unleashed: Joining multiple devices to Azure AD and Intune. Retrieved March 4, 2022.Dr. Nestori Syynimaa. (2020, September 6). Bypassing conditional access by faking device compliance. Retrieved March 4, 2022.
external_references[3]['url']https://o365blog.com/post/bprt/https://o365blog.com/post/mdm
external_references[4]['source_name']AADInternals - Device RegistrationAADInternals - BPRT
external_references[4]['description']Dr. Nestori Syynimaa. (2021, March 3). Deep-dive to Azure AD device join. Retrieved March 9, 2022.Dr. Nestori Syynimaa. (2021, January 31). BPRT unleashed: Joining multiple devices to Azure AD and Intune. Retrieved March 4, 2022.
external_references[4]['url']https://o365blog.com/post/devices/https://o365blog.com/post/bprt/
external_references[5]['source_name']DarkReading FireEye SolarWindsAADInternals - Device Registration
external_references[5]['description']Kelly Jackson Higgins. (2021, January 7). FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack. Retrieved April 18, 2022.Dr. Nestori Syynimaa. (2021, March 3). Deep-dive to Azure AD device join. Retrieved March 9, 2022.
external_references[5]['url']https://www.darkreading.com/threat-intelligence/fireeye-s-mandia-severity-zero-alert-led-to-discovery-of-solarwinds-attackhttps://o365blog.com/post/devices/
external_references[6]['source_name']Microsoft - Device RegistrationDarkReading FireEye SolarWinds
external_references[6]['description']Microsoft 365 Defender Threat Intelligence Team. (2022, January 26). Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA. Retrieved March 4, 2022.Kelly Jackson Higgins. (2021, January 7). FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack. Retrieved April 18, 2022.
external_references[6]['url']https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfahttps://www.darkreading.com/threat-intelligence/fireeye-s-mandia-severity-zero-alert-led-to-discovery-of-solarwinds-attack
external_references[7]['source_name']Microsoft DEV-0537Microsoft - Device Registration
external_references[7]['description']Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.Microsoft 365 Defender Threat Intelligence Team. (2022, January 26). Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA. Retrieved March 4, 2022.
external_references[7]['url']https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]User Account: User Account ModificationActive Directory: Active Directory Object Creation
x_mitre_data_sources[1]Active Directory: Active Directory Object CreationUser Account: User Account Modification
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'}
x_mitre_contributorsJoe Gumke, U.S. Bank

[T1562.008] Impair Defenses: Disable Cloud Logs

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1An adversary may disable cloud logging capabilities and intet1An adversary may disable cloud logging capabilities and inte
>grations to limit what data is collected on their activities>grations to limit what data is collected on their activities
> and avoid detection.   Cloud environments allow for collect> and avoid detection. Cloud environments allow for collectio
>ion and analysis of audit and application logs that provide >n and analysis of audit and application logs that provide in
>insight into what activities a user does within the environm>sight into what activities a user does within the environmen
>ent. If an adversary has sufficient permissions, they can di>t. If an adversary has sufficient permissions, they can disa
>sable logging to avoid detection of their activities. For ex>ble logging to avoid detection of their activities.  For exa
>ample, in AWS an adversary may disable CloudWatch/CloudTrail>mple, in AWS an adversary may disable CloudWatch/CloudTrail 
> integrations prior to conducting further malicious activity>integrations prior to conducting further malicious activity.
>.(Citation: Following the CloudTrail: Generating strong AWS >(Citation: Following the CloudTrail: Generating strong AWS s
>security signals with Sumo Logic)>ecurity signals with Sumo Logic) In Office 365, an adversary
 > may disable logging on mail collection activities for speci
 >fic users by using the `Set-MailboxAuditBypassAssociation` c
 >mdlet, by disabling M365 Advanced Auditing for the user, or 
 >by downgrading the user’s license from an Enterprise E5 to a
 >n Enterprise E3 license.(Citation: Dark Reading Microsoft 36
 >5 Attacks 2021)

New Detections:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2022-03-08 21:55:27.505000+00:002023-04-20 18:13:50.277000+00:00
descriptionAn adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic)An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading Microsoft 365 Attacks 2021)
external_references[1]['source_name']Following the CloudTrail: Generating strong AWS security signals with Sumo LogicStopping CloudTrail from Sending Events to CloudWatch Logs
external_references[1]['description']Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020.Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020.
external_references[1]['url']https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html
external_references[2]['source_name']Stopping CloudTrail from Sending Events to CloudWatch LogsFollowing the CloudTrail: Generating strong AWS security signals with Sumo Logic
external_references[2]['description']Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020.Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020.
external_references[2]['url']https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.htmlhttps://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/
external_references[4]['source_name']az monitor diagnostic-settingsDark Reading Microsoft 365 Attacks 2021
external_references[4]['description']Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020.Kelly Sheridan. (2021, August 5). Incident Responders Explore Microsoft 365 Attacks in the Wild. Retrieved March 17, 2023.
external_references[4]['url']https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_deletehttps://www.darkreading.com/threat-intelligence/incident-responders-explore-microsoft-365-attacks-in-the-wild/d/d-id/1341591
x_mitre_detectionMonitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled.Monitor logs for API calls to disable logging. In AWS, monitor for: StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled.
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'az monitor diagnostic-settings', 'description': 'Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020.', 'url': 'https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete'}
x_mitre_contributorsJoe Gumke, U.S. Bank
x_mitre_data_sourcesUser Account: User Account Modification
x_mitre_platformsSaaS
x_mitre_platformsGoogle Workspace
x_mitre_platformsAzure AD
x_mitre_platformsOffice 365

[T1562.002] Impair Defenses: Disable Windows Event Logging

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may disable Windows event logging to limit data t1Adversaries may disable Windows event logging to limit data 
>that can be leveraged for detections and audits. Windows eve>that can be leveraged for detections and audits. Windows eve
>nt logs record user and system activity such as login attemp>nt logs record user and system activity such as login attemp
>ts, process creation, and much more.(Citation: Windows Log E>ts, process creation, and much more.(Citation: Windows Log E
>vents) This data is used by security tools and analysts to g>vents) This data is used by security tools and analysts to g
>enerate detections.  The EventLog service maintains event lo>enerate detections.  The EventLog service maintains event lo
>gs from various system components and applications.(Citation>gs from various system components and applications.(Citation
>: EventLog_Core_Technologies) By default, the service automa>: EventLog_Core_Technologies) By default, the service automa
>tically starts when a system powers on. An audit policy, mai>tically starts when a system powers on. An audit policy, mai
>ntained by the Local Security Policy (secpol.msc), defines w>ntained by the Local Security Policy (secpol.msc), defines w
>hich system events the EventLog service logs. Security audit>hich system events the EventLog service logs. Security audit
> policy settings can be changed by running secpol.msc, then > policy settings can be changed by running secpol.msc, then 
>navigating to <code>Security Settings\Local Policies\Audit P>navigating to <code>Security Settings\Local Policies\Audit P
>olicy</code> for basic audit policy settings or <code>Securi>olicy</code> for basic audit policy settings or <code>Securi
>ty Settings\Advanced Audit Policy Configuration</code> for a>ty Settings\Advanced Audit Policy Configuration</code> for a
>dvanced audit policy settings.(Citation: Audit_Policy_Micros>dvanced audit policy settings.(Citation: Audit_Policy_Micros
>oft)(Citation: Advanced_sec_audit_policy_settings) <code>aud>oft)(Citation: Advanced_sec_audit_policy_settings) <code>aud
>itpol.exe</code> may also be used to set audit policies.(Cit>itpol.exe</code> may also be used to set audit policies.(Cit
>ation: auditpol)  Adversaries may target system-wide logging>ation: auditpol)  Adversaries may target system-wide logging
> or just that of a particular application. For example, the > or just that of a particular application. For example, the 
>EventLog service may be disabled using the following PowerSh>Windows EventLog service may be disabled using the <code>Set
>ell line: <code>Stop-Service -Name EventLog</code>.(Citation>-Service -Name EventLog -Status Stopped</code> or <code>sc c
>: Disable_Win_Event_Logging) Additionally, adversaries may u>onfig eventlog start=disabled</code> commands (followed by m
>se <code>auditpol</code> and its sub-commands in a command p>anually stopping the service using <code>Stop-Service  -Name
>rompt to disable auditing or clear the audit policy. To enab> EventLog</code>).(Citation: Disable_Win_Event_Logging)(Cita
>le or disable a specified setting or audit category, adversa>tion: disable_win_evt_logging) Additionally, the service may
>ries may use the <code>/success</code> or <code>/failure</co> be disabled by modifying the “Start” value in <code>HKEY_LO
>de> parameters. For example, <code>auditpol /set /category:”>CAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog</code
>Account Logon” /success:disable /failure:disable</code> turn>then restarting the system for the change to take effect.(
>s off auditing for the Account Logon category.(Citation: aud>Citation: disable_win_evt_logging)  There are several ways t
>itpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clea>o disable the EventLog service via registry key modification
>r the audit policy, adversaries may run the following lines:>. First, without Administrator privileges, adversaries may m
> <code>auditpol /clear /y</code> or <code>auditpol /remove />odify the "Start" value in the key <code>HKEY_LOCAL_MACHINE\
>allusers</code>.(Citation: T1562.002_redcanaryco)  By disabl>SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Sec
>ing Windows event logging, adversaries can operate while lea>urity</code>, then reboot the system to disable the Security
>ving less evidence of a compromise behind.> EventLog.(Citation: winser19_file_overwrite_bug_twitter) Se
 >cond, with Administrator privilege, adversaries may modify t
 >he same values in <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentCon
 >trolSet\Control\WMI\Autologger\EventLog-System</code> and <c
 >ode>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\
 >Autologger\EventLog-Application</code> to disable the entire
 > EventLog.(Citation: disable_win_evt_logging)  Additionally,
 > adversaries may use <code>auditpol</code> and its sub-comma
 >nds in a command prompt to disable auditing or clear the aud
 >it policy. To enable or disable a specified setting or audit
 > category, adversaries may use the <code>/success</code> or 
 ><code>/failure</code> parameters. For example, <code>auditpo
 >l /set /category:”Account Logon” /success:disable /failure:d
 >isable</code> turns off auditing for the Account Logon categ
 >ory.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_re
 >dcanaryco) To clear the audit policy, adversaries may run th
 >e following lines: <code>auditpol /clear /y</code> or <code>
 >auditpol /remove /allusers</code>.(Citation: T1562.002_redca
 >naryco)  By disabling Windows event logging, adversaries can
 > operate while leaving less evidence of a compromise behind.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['Administrator']
values_changed
STIX FieldOld valueNew Value
modified2021-10-19 13:37:30.534000+00:002023-03-17 23:24:19.730000+00:00
descriptionAdversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol) Adversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.(Citation: Disable_Win_Event_Logging) Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco) By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections. The EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol) Adversaries may target system-wide logging or just that of a particular application. For example, the Windows EventLog service may be disabled using the Set-Service -Name EventLog -Status Stopped or sc config eventlog start=disabled commands (followed by manually stopping the service using Stop-Service -Name EventLog).(Citation: Disable_Win_Event_Logging)(Citation: disable_win_evt_logging) Additionally, the service may be disabled by modifying the “Start” value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog then restarting the system for the change to take effect.(Citation: disable_win_evt_logging) There are several ways to disable the EventLog service via registry key modification. First, without Administrator privileges, adversaries may modify the "Start" value in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Security, then reboot the system to disable the Security EventLog.(Citation: winser19_file_overwrite_bug_twitter) Second, with Administrator privilege, adversaries may modify the same values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application to disable the entire EventLog.(Citation: disable_win_evt_logging) Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco) By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.
external_references[1]['source_name']Windows Log EventsDisable_Win_Event_Logging
external_references[1]['description']Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020. dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021.
external_references[1]['url']https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging
external_references[2]['source_name']EventLog_Core_Technologiesdef_ev_win_event_logging
external_references[2]['description']Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021.Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021.
external_references[2]['url']https://www.coretechnologies.com/blog/windows-services/eventlog/https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
external_references[3]['source_name']Audit_Policy_MicrosoftEventLog_Core_Technologies
external_references[3]['description']Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021.Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021.
external_references[3]['url']https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policyhttps://www.coretechnologies.com/blog/windows-services/eventlog/
external_references[4]['source_name']Advanced_sec_audit_policy_settingsAudit_Policy_Microsoft
external_references[4]['description']Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021.Daniel Simpson. (2017, April 19). Audit Policy. Retrieved September 13, 2021.
external_references[4]['url']https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settingshttps://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy
external_references[5]['source_name']auditpolWindows Log Events
external_references[5]['description']Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021.Franklin Smith. (n.d.). Windows Security Log Events. Retrieved February 21, 2020.
external_references[5]['url']https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpolhttps://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
external_references[6]['source_name']Disable_Win_Event_Loggingdisable_win_evt_logging
external_references[6]['description'] dmcxblue. (n.d.). Disable Windows Event Logging. Retrieved September 10, 2021.Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
external_references[6]['url']https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logginghttps://ptylu.github.io/content/report/report.html?report=25
external_references[7]['source_name']auditpol.exe_STRONTICauditpol
external_references[7]['description']STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.Jason Gerend, et al. (2017, October 16). auditpol. Retrieved September 1, 2021.
external_references[7]['url']https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.htmlhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol
external_references[8]['source_name']T1562.002_redcanarycowinser19_file_overwrite_bug_twitter
external_references[8]['description']redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021.Naceri, A. (2021, November 7). Windows Server 2019 file overwrite bug. Retrieved April 7, 2022.
external_references[8]['url']https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.mdhttps://web.archive.org/web/20211107115646/https://twitter.com/klinix5/status/1457316029114327040
external_references[9]['source_name']def_ev_win_event_loggingT1562.002_redcanaryco
external_references[9]['description']Chandel, R. (2021, April 22). Defense Evasion: Windows Event Logging (T1562.002). Retrieved September 14, 2021.redcanaryco. (2021, September 3). T1562.002 - Disable Windows Event Logging. Retrieved September 13, 2021.
external_references[9]['url']https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md
external_references[10]['source_name']evt_log_tamperingAdvanced_sec_audit_policy_settings
external_references[10]['description']svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.Simpson, D. et al. (2017, April 19). Advanced security audit policy settings. Retrieved September 14, 2021.
external_references[10]['url']https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335chttps://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings
x_mitre_data_sources[0]Command: Command ExecutionSensor Health: Host Status
x_mitre_data_sources[1]Sensor Health: Host StatusScript: Script Execution
x_mitre_data_sources[3]Script: Script ExecutionWindows Registry: Windows Registry Key Creation
x_mitre_data_sources[5]Windows Registry: Windows Registry Key CreationCommand: Command Execution
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'auditpol.exe_STRONTIC', 'description': 'STRONTIC. (n.d.). auditpol.exe. Retrieved September 9, 2021.', 'url': 'https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html'}
external_references{'source_name': 'evt_log_tampering', 'description': 'svch0st. (2020, September 30). Event Log Tampering Part 1: Disrupting the EventLog Service. Retrieved September 14, 2021.', 'url': 'https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c'}
x_mitre_contributorsLucas Heiligenstein

[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may disable or modify a firewall within a cloud t1Adversaries may disable or modify a firewall within a cloud 
>environment to bypass controls that limit access to cloud re>environment to bypass controls that limit access to cloud re
>sources. Cloud firewalls are separate from system firewalls >sources. Cloud firewalls are separate from system firewalls 
>that are described in [Disable or Modify System Firewall](ht>that are described in [Disable or Modify System Firewall](ht
>tps://attack.mitre.org/techniques/T1562/004).   Cloud enviro>tps://attack.mitre.org/techniques/T1562/004).   Cloud enviro
>nments typically utilize restrictive security groups and fir>nments typically utilize restrictive security groups and fir
>ewall rules that only allow network activity from trusted IP>ewall rules that only allow network activity from trusted IP
> addresses via expected ports and protocols. An adversary ma> addresses via expected ports and protocols. An adversary ma
>y introduce new firewall rules or policies to allow access i>y introduce new firewall rules or policies to allow access i
>nto a victim cloud environment. For example, an adversary ma>nto a victim cloud environment. For example, an adversary ma
>y use a script or utility that creates new ingress rules in >y use a script or utility that creates new ingress rules in 
>existing security groups to allow any TCP/IP connectivity.(C>existing security groups to allow any TCP/IP connectivity, o
>itation: Expel IO Evil in AWS)  Modifying or disabling a clo>r remove networking limitations to support traffic associate
>ud firewall may enable adversary C2 communications, lateral >d with malicious activity (such as cryptomining).(Citation: 
>movement, and/or data exfiltration that would otherwise not >Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromise
>be allowed.>d Cloud Compute Credentials 2022)  Modifying or disabling a 
 >cloud firewall may enable adversary C2 communications, later
 >al movement, and/or data exfiltration that would otherwise n
 >ot be allowed.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-03-08 10:33:02.146000+00:002023-04-15 00:25:36.502000+00:00
descriptionAdversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.(Citation: Expel IO Evil in AWS) Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004). Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity, or remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022', 'description': 'Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.', 'url': 'https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/'}

[T1562.004] Impair Defenses: Disable or Modify System Firewall

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may disable or modify system firewalls in order t1Adversaries may disable or modify system firewalls in order 
>to bypass controls limiting network usage. Changes could be >to bypass controls limiting network usage. Changes could be 
>disabling the entire mechanism as well as adding, deleting, >disabling the entire mechanism as well as adding, deleting, 
>or modifying particular rules. This can be done numerous way>or modifying particular rules. This can be done numerous way
>s depending on the operating system, including via command-l>s depending on the operating system, including via command-l
>ine, editing Windows Registry keys, and Windows Control Pane>ine, editing Windows Registry keys, and Windows Control Pane
>l.  Modifying or disabling a system firewall may enable adve>l.  Modifying or disabling a system firewall may enable adve
>rsary C2 communications, lateral movement, and/or data exfil>rsary C2 communications, lateral movement, and/or data exfil
>tration that would otherwise not be allowed. >tration that would otherwise not be allowed. For example, ad
 >versaries may add a new firewall rule for a well-known proto
 >col (such as RDP) using a non-traditional and potentially le
 >ss securitized port (i.e. [Non-Standard Port](https://attack
 >.mitre.org/techniques/T1571)).(Citation: change_rdp_port_con
 >ti)

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2020-03-29 22:18:11.166000+00:002023-02-28 22:34:38.316000+00:00
descriptionAdversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel. Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel. Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti)
x_mitre_data_sources[1]Firewall: Firewall Rule ModificationWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[3]Windows Registry: Windows Registry Key ModificationFirewall: Firewall Rule Modification
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'change_rdp_port_conti', 'description': 'The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved March 1, 2022.', 'url': 'https://twitter.com/TheDFIRReport/status/1498657772254240768'}

[T1562.001] Impair Defenses: Disable or Modify Tools

Current version: 1.4

Version changed from: 1.3 → 1.4


Old Description
New Description
t1Adversaries may modify and/or disable security tools to avoit1Adversaries may modify and/or disable security tools to avoi
>d possible detection of their malware/tools and activities. >d possible detection of their malware/tools and activities. 
>This may take many forms, such as killing security software >This may take many forms, such as killing security software 
>processes or services, modifying / deleting Registry keys or>processes or services, modifying / deleting Registry keys or
> configuration files so that tools do not operate properly, > configuration files so that tools do not operate properly, 
>or other methods to interfere with security tools scanning o>or other methods to interfere with security tools scanning o
>r reporting information. Adversaries may also disable update>r reporting information. Adversaries may also disable update
>s to prevent the latest security patches from reaching tools>s to prevent the latest security patches from reaching tools
> on victim systems.(Citation: SCADAfence_ransomware)  Advers> on victim systems.(Citation: SCADAfence_ransomware)  Advers
>aries may also tamper with artifacts deployed and utilized b>aries may also tamper with artifacts deployed and utilized b
>y security tools. Security tools may make dynamic changes to>y security tools. Security tools may make dynamic changes to
> system components in order to maintain visibility into spec> system components in order to maintain visibility into spec
>ific events. For example, security products may load their o>ific events. For example, security products may load their o
>wn modules and/or modify those loaded by processes to facili>wn modules and/or modify those loaded by processes to facili
>tate data collection. Similar to [Indicator Blocking](https:>tate data collection. Similar to [Indicator Blocking](https:
>//attack.mitre.org/techniques/T1562/006), adversaries may un>//attack.mitre.org/techniques/T1562/006), adversaries may un
>hook or otherwise modify these features added by tools (espe>hook or otherwise modify these features added by tools (espe
>cially those that exist in userland or are otherwise potenti>cially those that exist in userland or are otherwise potenti
>ally accessible to adversaries) to avoid detection.(Citation>ally accessible to adversaries) to avoid detection.(Citation
>: OutFlank System Calls)(Citation: MDSec System Calls)  In c>: OutFlank System Calls)(Citation: MDSec System Calls)   Adv
>loud environments, tools disabled by adversaries may include>ersaries may also focus on specific applications such as Sys
> cloud monitoring agents that report back to services such a>mon. For example, the “Start” and “Enable” values in <code>H
>s AWS CloudWatch or Google Cloud Monitor.  Furthermore, alth>KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autol
>ough defensive tools may have anti-tampering mechanisms, adv>ogger\EventLog-Microsoft-Windows-Sysmon-Operational</code> m
>ersaries may abuse tools such as legitimate rootkit removal >ay be modified to tamper with and potentially disable Sysmon
>kits to impair and/or disable these tools.(Citation: chasing> logging.(Citation: disable_win_evt_logging)   In cloud envi
>_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: >ronments, tools disabled by adversaries may include cloud mo
>demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For e>nitoring agents that report back to services such as AWS Clo
>xample, adversaries have used tools such as GMER to find and>udWatch or Google Cloud Monitor.  Furthermore, although defe
> shut down hidden processes and antivirus software on infect>nsive tools may have anti-tampering mechanisms, adversaries 
>ed systems.(Citation: demystifying_ryuk)  Additionally, adve>may abuse tools such as legitimate rootkit removal kits to i
>rsaries may exploit legitimate drivers from anti-virus softw>mpair and/or disable these tools.(Citation: chasing_avaddon_
>are to gain access to kernel space (i.e. [Exploitation for P>ransomware)(Citation: dharma_ransomware)(Citation: demystify
>rivilege Escalation](https://attack.mitre.org/techniques/T10>ing_ryuk)(Citation: doppelpaymer_crowdstrike) For example, a
>68)), which may lead to bypassing anti-tampering features.(C>dversaries have used tools such as GMER to find and shut dow
>itation: avoslocker_ransomware)>n hidden processes and antivirus software on infected system
 >s.(Citation: demystifying_ryuk)  Additionally, adversaries m
 >ay exploit legitimate drivers from anti-virus software to ga
 >in access to kernel space (i.e. [Exploitation for Privilege 
 >Escalation](https://attack.mitre.org/techniques/T1068)), whi
 >ch may lead to bypassing anti-tampering features.(Citation: 
 >avoslocker_ransomware)
Details
dictionary_item_added
STIX FieldOld valueNew Value
external_referencesTran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022.
dictionary_item_removed
STIX FieldOld valueNew Value
external_referencesCAPEC-578
values_changed
STIX FieldOld valueNew Value
modified2022-10-24 15:23:59.433000+00:002023-04-12 13:43:42.986000+00:00
descriptionAdversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk) Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware) Adversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) Adversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) In cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor. Furthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk) Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)
external_references[2]['source_name']chasing_avaddon_ransomwaredisable_win_evt_logging
external_references[2]['description']Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022.Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
external_references[2]['url']https://www.mandiant.com/resources/chasing-avaddon-ransomwarehttps://ptylu.github.io/content/report/report.html?report=25
external_references[3]['source_name']doppelpaymer_crowdstrikechasing_avaddon_ransomware
external_references[3]['description']Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022.Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022.
external_references[3]['url']https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/https://www.mandiant.com/resources/chasing-avaddon-ransomware
external_references[4]['source_name']avoslocker_ransomwaredoppelpaymer_crowdstrike
external_references[4]['description']Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022.Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022.
external_references[4]['url']https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.htmlhttps://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/
external_references[5]['source_name']dharma_ransomwareavoslocker_ransomware
external_references[5]['description']Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022.Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022.
external_references[5]['url']https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html
external_references[6]['source_name']MDSec System Callsdharma_ransomware
external_references[6]['description']MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022.
external_references[6]['url']https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/
external_references[7]['source_name']SCADAfence_ransomwareMDSec System Calls
external_references[7]['description']Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.
external_references[7]['url']https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdfhttps://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/
external_references[8]['source_name']demystifying_ryukSCADAfence_ransomware
external_references[8]['description']Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022.Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.
external_references[8]['url']https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf
external_references[9]['source_name']capecdemystifying_ryuk
external_references[9]['url']https://capec.mitre.org/data/definitions/578.htmlhttps://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[1]Driver: Driver LoadWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[2]Windows Registry: Windows Registry Key ModificationProcess: Process Termination
x_mitre_data_sources[3]Service: Service MetadataSensor Health: Host Status
x_mitre_data_sources[4]Command: Command ExecutionDriver: Driver Load
x_mitre_data_sources[5]Process: Process TerminationService: Service Metadata
x_mitre_data_sources[6]Sensor Health: Host StatusCommand: Command Execution
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsLucas Heiligenstein
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_contributorsLucas Heiligenstein

[T1561.002] Disk Wipe: Disk Structure Wipe

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may corrupt or wipe the disk data structures on t1Adversaries may corrupt or wipe the disk data structures on 
>a hard drive necessary to boot a system; targeting specific >a hard drive necessary to boot a system; targeting specific 
>critical systems or in large numbers in a network to interru>critical systems or in large numbers in a network to interru
>pt availability to system and network resources.   Adversari>pt availability to system and network resources.   Adversari
>es may attempt to render the system unable to boot by overwr>es may attempt to render the system unable to boot by overwr
>iting critical data located in structures such as the master>iting critical data located in structures such as the master
> boot record (MBR) or partition table.(Citation: Symantec Sh> boot record (MBR) or partition table.(Citation: Symantec Sh
>amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa>amoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Pa
>lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201>lo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 201
>7)(Citation: Unit 42 Shamoon3 2018) The data contained in di>7)(Citation: Unit 42 Shamoon3 2018) The data contained in di
>sk structures may include the initial executable code for lo>sk structures may include the initial executable code for lo
>ading an operating system or the location of the file system>ading an operating system or the location of the file system
> partitions on disk. If this information is not present, the> partitions on disk. If this information is not present, the
> computer will not be able to load an operating system durin> computer will not be able to load an operating system durin
>g the boot process, leaving the computer unavailable. [Disk >g the boot process, leaving the computer unavailable. [Disk 
>Structure Wipe](https://attack.mitre.org/techniques/T1561/00>Structure Wipe](https://attack.mitre.org/techniques/T1561/00
>2) may be performed in isolation, or along with [Disk Conten>2) may be performed in isolation, or along with [Disk Conten
>t Wipe](https://attack.mitre.org/techniques/T1561/001) if al>t Wipe](https://attack.mitre.org/techniques/T1561/001) if al
>l sectors of a disk are wiped.  To maximize impact on the ta>l sectors of a disk are wiped.  On a network devices, advers
>rget organization, malware designed for destroying disk stru>aries may reformat the file system using [Network Device CLI
>ctures may have worm-like features to propagate across a net>](https://attack.mitre.org/techniques/T1059/008) commands su
>work by leveraging other techniques like [Valid Accounts](ht>ch as `format`.(Citation: format_cmd_cisco)  To maximize imp
>tps://attack.mitre.org/techniques/T1078), [OS Credential Dum>act on the target organization, malware designed for destroy
>ping](https://attack.mitre.org/techniques/T1003), and [SMB/W>ing disk structures may have worm-like features to propagate
>indows Admin Shares](https://attack.mitre.org/techniques/T10> across a network by leveraging other techniques like [Valid
>21/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye > Accounts](https://attack.mitre.org/techniques/T1078), [OS C
>Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Cita>redential Dumping](https://attack.mitre.org/techniques/T1003
>tion: Kaspersky StoneDrill 2017)>), and [SMB/Windows Admin Shares](https://attack.mitre.org/t
 >echniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citat
 >ion: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon N
 >ov 2016)(Citation: Kaspersky StoneDrill 2017)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_contributors['Austin Clark, @c2defense']
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User', 'Administrator', 'root', 'SYSTEM']
values_changed
STIX FieldOld valueNew Value
modified2020-03-28 23:00:00.367000+00:002023-04-14 19:38:24.089000+00:00
descriptionAdversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources. Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk. If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable. [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) may be performed in isolation, or along with [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) if all sectors of a disk are wiped. On a network devices, adversaries may reformat the file system using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `format`.(Citation: format_cmd_cisco) To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
external_references[1]['source_name']Symantec Shamoon 2012format_cmd_cisco
external_references[1]['description']Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.Cisco. (2022, August 16). format - Cisco IOS Configuration Fundamentals Command Reference. Retrieved July 13, 2022.
external_references[1]['url']https://www.symantec.com/connect/blogs/shamoon-attackshttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/F_through_K.html#wp2829794668
external_references[2]['source_name']FireEye Shamoon Nov 2016Unit 42 Shamoon3 2018
external_references[2]['description']FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017.Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.
external_references[2]['url']https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.htmlhttps://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/
external_references[4]['source_name']Kaspersky StoneDrill 2017FireEye Shamoon Nov 2016
external_references[4]['description']Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017.
external_references[4]['url']https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdfhttps://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html
external_references[5]['source_name']Unit 42 Shamoon3 2018Kaspersky StoneDrill 2017
external_references[5]['description']Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.
external_references[5]['url']https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf
x_mitre_data_sources[2]Command: Command ExecutionDriver: Driver Load
x_mitre_data_sources[3]Driver: Driver LoadCommand: Command Execution
x_mitre_detectionLook for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the \\\\.\\ notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity.Look for attempts to read/write to sensitive locations like the master boot record and the disk partition table. Monitor for direct access read/write attempts using the \\\\.\\ notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity. For network infrastructure devices, collect AAA logging to monitor for `format` commands being run to erase the file structure and prevent recovery of the device.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Symantec Shamoon 2012', 'description': 'Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.', 'url': 'https://www.symantec.com/connect/blogs/shamoon-attacks'}
x_mitre_platformsNetwork

[T1561] Disk Wipe

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may wipe or corrupt raw disk data on specific syt1Adversaries may wipe or corrupt raw disk data on specific sy
>stems or in large numbers in a network to interrupt availabi>stems or in large numbers in a network to interrupt availabi
>lity to system and network resources. With direct write acce>lity to system and network resources. With direct write acce
>ss to a disk, adversaries may attempt to overwrite portions >ss to a disk, adversaries may attempt to overwrite portions 
>of disk data. Adversaries may opt to wipe arbitrary portions>of disk data. Adversaries may opt to wipe arbitrary portions
> of disk data and/or wipe disk structures like the master bo> of disk data and/or wipe disk structures like the master bo
>ot record (MBR). A complete wipe of all disk sectors may be >ot record (MBR). A complete wipe of all disk sectors may be 
>attempted.  To maximize impact on the target organization in>attempted.  To maximize impact on the target organization in
> operations where network-wide availability interruption is > operations where network-wide availability interruption is 
>the goal, malware used for wiping disks may have worm-like f>the goal, malware used for wiping disks may have worm-like f
>eatures to propagate across a network by leveraging addition>eatures to propagate across a network by leveraging addition
>al techniques like [Valid Accounts](https://attack.mitre.org>al techniques like [Valid Accounts](https://attack.mitre.org
>/techniques/T1078), [OS Credential Dumping](https://attack.m>/techniques/T1078), [OS Credential Dumping](https://attack.m
>itre.org/techniques/T1003), and [SMB/Windows Admin Shares](h>itre.org/techniques/T1003), and [SMB/Windows Admin Shares](h
>ttps://attack.mitre.org/techniques/T1021/002).(Citation: Nov>ttps://attack.mitre.org/techniques/T1021/002).(Citation: Nov
>etta Blockbuster Destructive Malware)>etta Blockbuster Destructive Malware)  On network devices, a
 >dversaries may wipe configuration files and other data from 
 >the device using [Network Device CLI](https://attack.mitre.o
 >rg/techniques/T1059/008) commands such as `erase`.(Citation:
 > erase_cmd_cisco)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Austin Clark, @c2defense']
values_changed
STIX FieldOld valueNew Value
modified2022-07-28 18:55:35.987000+00:002023-04-20 18:16:41.942000+00:00
descriptionAdversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources. With direct write access to a disk, adversaries may attempt to overwrite portions of disk data. Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR). A complete wipe of all disk sectors may be attempted. To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware) On network devices, adversaries may wipe configuration files and other data from the device using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `erase`.(Citation: erase_cmd_cisco)
external_references[1]['source_name']Novetta Blockbuster Destructive Malwareerase_cmd_cisco
external_references[1]['description']Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.Cisco. (2022, August 16). erase - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022.
external_references[1]['url']https://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdfhttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/D_through_E.html#wp3557227463
external_references[2]['source_name']Microsoft Sysmon v6 May 2017Novetta Blockbuster Destructive Malware
external_references[2]['description']Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017.Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
external_references[2]['url']https://docs.microsoft.com/sysinternals/downloads/sysmonhttps://web.archive.org/web/20160303200515/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Drive: Drive AccessDrive: Drive Modification
x_mitre_data_sources[1]Command: Command ExecutionProcess: Process Creation
x_mitre_data_sources[2]Process: Process CreationCommand: Command Execution
x_mitre_data_sources[4]Drive: Drive ModificationDrive: Drive Access
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft Sysmon v6 May 2017', 'description': 'Russinovich, M. & Garnier, T. (2017, May 22). Sysmon v6.20. Retrieved December 13, 2017.', 'url': 'https://docs.microsoft.com/sysinternals/downloads/sysmon'}
x_mitre_platformsNetwork

[T1021.003] Remote Services: Distributed Component Object Model

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['Administrator', 'SYSTEM']
values_changed
STIX FieldOld valueNew Value
modified2021-06-23 18:58:32.752000+00:002023-04-03 18:58:54.034000+00:00
external_references[3]['source_name']Microsoft Process Wide Com KeysMicrosoft COM ACL
external_references[3]['description']Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017.Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.
external_references[3]['url']https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspxhttps://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1
external_references[4]['source_name']Microsoft COM ACLMicrosoft Process Wide Com Keys
external_references[4]['description']Microsoft. (n.d.). DCOM Security Enhancements in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1. Retrieved November 22, 2017.Microsoft. (n.d.). Setting Process-Wide Security Through the Registry. Retrieved November 21, 2017.
external_references[4]['url']https://docs.microsoft.com/en-us/windows/desktop/com/dcom-security-enhancements-in-windows-xp-service-pack-2-and-windows-server-2003-service-pack-1https://msdn.microsoft.com/en-us/library/windows/desktop/ms687317(v=vs.85).aspx
external_references[5]['source_name']Enigma Outlook DCOM Lateral Movement Nov 2017MSDN WMI
external_references[5]['description']Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.
external_references[5]['url']https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/https://msdn.microsoft.com/en-us/library/aa394582.aspx
external_references[6]['source_name']Enigma MMC20 COM Jan 2017Enigma DCOM Lateral Movement Jan 2017
external_references[6]['description']Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017.
external_references[6]['url']https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
external_references[7]['source_name']Enigma DCOM Lateral Movement Jan 2017Enigma MMC20 COM Jan 2017
external_references[7]['description']Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017.Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017.
external_references[7]['url']https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
external_references[8]['source_name']Enigma Excel DCOM Sept 2017Enigma Outlook DCOM Lateral Movement Nov 2017
external_references[8]['description']Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017.Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017.
external_references[8]['url']https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/https://enigma0x3.net/2017/11/16/lateral-movement-using-outlooks-createobject-method-and-dotnettojscript/
external_references[9]['source_name']Cyberreason DCOM DDE Lateral Movement Nov 2017Enigma Excel DCOM Sept 2017
external_references[9]['description']Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral movement via DCOM. Retrieved November 21, 2017.Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017.
external_references[9]['url']https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcomhttps://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
external_references[10]['source_name']MSDN WMICyberreason DCOM DDE Lateral Movement Nov 2017
external_references[10]['description']Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.Tsukerman, P. (2017, November 8). Leveraging Excel DDE for lateral movement via DCOM. Retrieved November 21, 2017.
external_references[10]['url']https://msdn.microsoft.com/en-us/library/aa394582.aspxhttps://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom
x_mitre_data_sources[0]Process: Process CreationModule: Module Load
x_mitre_data_sources[2]Module: Module LoadProcess: Process Creation
x_mitre_version1.11.2

[T1087.002] Account Discovery: Domain Account

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may attempt to get a listing of domain accounts.t1Adversaries may attempt to get a listing of domain accounts.
> This information can help adversaries determine which domai> This information can help adversaries determine which domai
>n accounts exist to aid in follow-on behavior.  Commands suc>n accounts exist to aid in follow-on behavior such as target
>h as <code>net user /domain</code> and <code>net group /doma>ing specific accounts which possess particular privileges.  
>in</code> of the [Net](https://attack.mitre.org/software/S00>Commands such as <code>net user /domain</code> and <code>net
>39) utility, <code>dscacheutil -q group</code>on macOS, and > group /domain</code> of the [Net](https://attack.mitre.org/
><code>ldapsearch</code> on Linux can list domain users and g>software/S0039) utility, <code>dscacheutil -q group</code>on
>roups.> macOS, and <code>ldapsearch</code> on Linux can list domain
 > users and groups. [PowerShell](https://attack.mitre.org/tec
 >hniques/T1059/001) cmdlets including <code>Get-ADUser</code>
 > and <code>Get-ADGroupMember</code> may enumerate members of
 > Active Directory groups.  
Details
values_changed
STIX FieldOld valueNew Value
modified2022-08-25 13:04:00.863000+00:002023-04-15 16:37:59.115000+00:00
descriptionAdversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Command: Command ExecutionNetwork Traffic: Network Traffic Content
x_mitre_data_sources[1]Process: Process CreationProcess: OS API Execution
x_mitre_data_sources[2]Network Traffic: Network Traffic ContentProcess: Process Creation
x_mitre_data_sources[4]Process: OS API ExecutionCommand: Command Execution
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/575.html', 'external_id': 'CAPEC-575'}

[T1078.002] Valid Accounts: Domain Accounts

Current version: 1.3

Version changed from: 1.2 → 1.3

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 20:14:34.479000+00:002023-04-13 17:17:03.605000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesUser Account: User Account Authentication
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'capec', 'url': 'https://capec.mitre.org/data/definitions/560.html', 'external_id': 'CAPEC-560'}
x_mitre_data_sourcesUser Account: User Account Authentication

[T1069.002] Permission Groups Discovery: Domain Groups

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-21 12:55:51.337000+00:002023-04-07 17:16:47.754000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesGroup: Group Enumeration
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesGroup: Group Enumeration

[T1584.001] Compromise Infrastructure: Domains

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may hijack domains and/or subdomains that can bet1Adversaries may hijack domains and/or subdomains that can be
> used during targeting. Domain registration hijacking is the> used during targeting. Domain registration hijacking is the
> act of changing the registration of a domain name without t> act of changing the registration of a domain name without t
>he permission of the original registrant.(Citation: ICANNDom>he permission of the original registrant.(Citation: ICANNDom
>ainNameHijacking) Adversaries may gain access to an email ac>ainNameHijacking) Adversaries may gain access to an email ac
>count for the person listed as the owner of the domain. The >count for the person listed as the owner of the domain. The 
>adversary can then claim that they forgot their password in >adversary can then claim that they forgot their password in 
>order to make changes to the domain registration. Other poss>order to make changes to the domain registration. Other poss
>ibilities include social engineering a domain registration h>ibilities include social engineering a domain registration h
>elp desk to gain access to an account or taking advantage of>elp desk to gain access to an account or taking advantage of
> renewal process gaps.(Citation: Krebs DNS Hijack 2019)  Sub> renewal process gaps.(Citation: Krebs DNS Hijack 2019)  Sub
>domain hijacking can occur when organizations have DNS entri>domain hijacking can occur when organizations have DNS entri
>es that point to non-existent or deprovisioned resources. In>es that point to non-existent or deprovisioned resources. In
> such cases, an adversary may take control of a subdomain to> such cases, an adversary may take control of a subdomain to
> conduct operations with the benefit of the trust associated> conduct operations with the benefit of the trust associated
> with that domain.(Citation: Microsoft Sub Takeover 2020)> with that domain.(Citation: Microsoft Sub Takeover 2020)  A
 >dversaries who compromise a domain may also engage in domain
 > shadowing by creating malicious subdomains under their cont
 >rol while keeping any existing DNS records. As service will 
 >not be disrupted, the malicious subdomains may go unnoticed 
 >for long periods of time.(Citation: Palo Alto Unit 42 Domain
 > Shadowing 2022)
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-20 14:10:48.814000+00:002023-03-07 13:05:42.901000+00:00
descriptionAdversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019) Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019) Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020) Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022)
external_references[3]['source_name']Microsoft Sub Takeover 2020Palo Alto Unit 42 Domain Shadowing 2022
external_references[3]['description']Microsoft. (2020, September 29). Prevent dangling DNS entries and avoid subdomain takeover. Retrieved October 12, 2020.Janos Szurdi, Rebekah Houser and Daiping Liu. (2022, September 21). Domain Shadowing: A Stealthy Use of DNS Compromise for Cybercrime. Retrieved March 7, 2023.
external_references[3]['url']https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeoverhttps://unit42.paloaltonetworks.com/domain-shadowing/
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[1]Domain Name: Passive DNSDomain Name: Domain Registration
x_mitre_data_sources[2]Domain Name: Domain RegistrationDomain Name: Passive DNS
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft Sub Takeover 2020', 'description': 'Microsoft. (2020, September 29). Prevent dangling DNS entries and avoid subdomain takeover. Retrieved October 12, 2020.', 'url': 'https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover'}

[T1189] Drive-by Compromise

Current version: 1.5

Version changed from: 1.4 → 1.5


Old Description
New Description
t1Adversaries may gain access to a system through a user visitt1Adversaries may gain access to a system through a user visit
>ing a website over the normal course of browsing. With this >ing a website over the normal course of browsing. With this 
>technique, the user's web browser is typically targeted for >technique, the user's web browser is typically targeted for 
>exploitation, but adversaries may also use compromised websi>exploitation, but adversaries may also use compromised websi
>tes for non-exploitation behavior such as acquiring [Applica>tes for non-exploitation behavior such as acquiring [Applica
>tion Access Token](https://attack.mitre.org/techniques/T1550>tion Access Token](https://attack.mitre.org/techniques/T1550
>/001).  Multiple ways of delivering exploit code to a browse>/001).  Multiple ways of delivering exploit code to a browse
>r exist, including:  * A legitimate website is compromised w>r exist (i.e.[Drive-by Target](https://attack.mitre.org/te
>here adversaries have injected some form of malicious code s>chniques/T1608/004)), including:  * A legitimate website is 
>uch as JavaScript, iFrames, and cross-site scripting. * Mali>compromised where adversaries have injected some form of mal
>cious ads are paid for and served through legitimate ad prov>icious code such as JavaScript, iFrames, and cross-site scri
>iders. * Built-in web application interfaces are leveraged f>pting * Script files served to a legitimate website from a p
>or the insertion of any other kind of object that can be use>ublicly writeable cloud storage bucket are modified by an ad
>d to display web content or contain a script that executes o>versary * Malicious ads are paid for and served through legi
>n the visiting client (e.g. forum posts, comments, and other>timate ad providers (i.e., [Malvertising](https://attack.mit
> user controllable web content).  Often the website used by >re.org/techniques/T1583/008)) * Built-in web application int
>an adversary is one visited by a specific community, such as>erfaces are leveraged for the insertion of any other kind of
> government, a particular industry, or region, where the goa> object that can be used to display web content or contain a
>l is to compromise a specific user or set of users based on > script that executes on the visiting client (e.g. forum pos
>a shared interest. This kind of targeted campaign is often r>ts, comments, and other user controllable web content).  Oft
>eferred to a strategic web compromise or watering hole attac>en the website used by an adversary is one visited by a spec
>k. There are several known examples of this occurring.(Citat>ific community, such as government, a particular industry, o
>ion: Shadowserver Strategic Web Compromise)  Typical drive-b>r region, where the goal is to compromise a specific user or
>y compromise process:  1. A user visits a website that is us> set of users based on a shared interest. This kind of targe
>ed to host the adversary controlled content. 2. Scripts auto>ted campaign is often referred to a strategic web compromise
>matically execute, typically searching versions of the brows> or watering hole attack. There are several known examples o
>er and plugins for a potentially vulnerable version.      * >f this occurring.(Citation: Shadowserver Strategic Web Compr
>The user may be required to assist in this process by enabli>omise)  Typical drive-by compromise process:  1. A user visi
>ng scripting or active website components and ignoring warni>ts a website that is used to host the adversary controlled c
>ng dialog boxes. 3. Upon finding a vulnerable version, explo>ontent. 2. Scripts automatically execute, typically searchin
>it code is delivered to the browser. 4. If exploitation is s>g versions of the browser and plugins for a potentially vuln
>uccessful, then it will give the adversary code execution on>erable version.      * The user may be required to assist in
> the user's system unless other protections are in place.   > this process by enabling scripting or active website compon
>  * In some cases a second visit to the website after the in>ents and ignoring warning dialog boxes. 3. Upon finding a vu
>itial scan is required before exploit code is delivered.  Un>lnerable version, exploit code is delivered to the browser. 
>like [Exploit Public-Facing Application](https://attack.mitr>4. If exploitation is successful, then it will give the adve
>e.org/techniques/T1190), the focus of this technique is to e>rsary code execution on the user's system unless other prote
>xploit software on a client endpoint upon visiting a website>ctions are in place.     * In some cases a second visit to t
>. This will commonly give an adversary access to systems on >he website after the initial scan is required before exploit
>the internal network instead of external systems that may be> code is delivered.  Unlike [Exploit Public-Facing Applicati
> in a DMZ.  Adversaries may also use compromised websites to>on](https://attack.mitre.org/techniques/T1190), the focus of
> deliver a user to a malicious application designed to [Stea> this technique is to exploit software on a client endpoint 
>l Application Access Token](https://attack.mitre.org/techniq>upon visiting a website. This will commonly give an adversar
>ues/T1528)s, like OAuth tokens, to gain access to protected >y access to systems on the internal network instead of exter
>applications and information. These malicious applications h>nal systems that may be in a DMZ.  Adversaries may also use 
>ave been delivered through popups on legitimate websites.(Ci>compromised websites to deliver a user to a malicious applic
>tation: Volexity OceanLotus Nov 2017)>ation designed to [Steal Application Access Token](https://a
 >ttack.mitre.org/techniques/T1528)s, like OAuth tokens, to ga
 >in access to protected applications and information. These m
 >alicious applications have been delivered through popups on 
 >legitimate websites.(Citation: Volexity OceanLotus Nov 2017)

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2022-03-08 21:11:47.798000+00:002023-04-14 23:58:45.490000+00:00
descriptionAdversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Multiple ways of delivering exploit code to a browser exist, including: * A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting. * Malicious ads are paid for and served through legitimate ad providers. * Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content). Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise) Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. * The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place. * In some cases a second visit to the website after the initial scan is required before exploit code is delivered. Unlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ. Adversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017)Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)), including: * A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting * Script files served to a legitimate website from a publicly writeable cloud storage bucket are modified by an adversary * Malicious ads are paid for and served through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008)) * Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client (e.g. forum posts, comments, and other user controllable web content). Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack. There are several known examples of this occurring.(Citation: Shadowserver Strategic Web Compromise) Typical drive-by compromise process: 1. A user visits a website that is used to host the adversary controlled content. 2. Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. * The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes. 3. Upon finding a vulnerable version, exploit code is delivered to the browser. 4. If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place. * In some cases a second visit to the website after the initial scan is required before exploit code is delivered. Unlike [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), the focus of this technique is to exploit software on a client endpoint upon visiting a website. This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ. Adversaries may also use compromised websites to deliver a user to a malicious application designed to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s, like OAuth tokens, to gain access to protected applications and information. These malicious applications have been delivered through popups on legitimate websites.(Citation: Volexity OceanLotus Nov 2017)
x_mitre_data_sources[2]Network Traffic: Network Traffic ContentProcess: Process Creation
x_mitre_version1.41.5
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetwork Traffic: Network Traffic Content
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation

[T1608.004] Stage Capabilities: Drive-by Target

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may prepare an operational environment to infectt1Adversaries may prepare an operational environment to infect
> systems that visit a website over the normal course of brow> systems that visit a website over the normal course of brow
>sing. Endpoint systems may be compromised through browsing t>sing. Endpoint systems may be compromised through browsing t
>o adversary controlled sites, as in [Drive-by Compromise](ht>o adversary controlled sites, as in [Drive-by Compromise](ht
>tps://attack.mitre.org/techniques/T1189). In such cases, the>tps://attack.mitre.org/techniques/T1189). In such cases, the
> user's web browser is typically targeted for exploitation (> user's web browser is typically targeted for exploitation (
>often not requiring any extra user interaction once landing >often not requiring any extra user interaction once landing 
>on the site), but adversaries may also set up websites for n>on the site), but adversaries may also set up websites for n
>on-exploitation behavior such as [Application Access Token](>on-exploitation behavior such as [Application Access Token](
>https://attack.mitre.org/techniques/T1550/001). Prior to [Dr>https://attack.mitre.org/techniques/T1550/001). Prior to [Dr
>ive-by Compromise](https://attack.mitre.org/techniques/T1189>ive-by Compromise](https://attack.mitre.org/techniques/T1189
>), adversaries must stage resources needed to deliver that e>), adversaries must stage resources needed to deliver that e
>xploit to users who browse to an adversary controlled site. >xploit to users who browse to an adversary controlled site. 
>Drive-by content can be staged on adversary controlled infra>Drive-by content can be staged on adversary controlled infra
>structure that has been acquired ([Acquire Infrastructure](h>structure that has been acquired ([Acquire Infrastructure](h
>ttps://attack.mitre.org/techniques/T1583)) or previously com>ttps://attack.mitre.org/techniques/T1583)) or previously com
>promised ([Compromise Infrastructure](https://attack.mitre.o>promised ([Compromise Infrastructure](https://attack.mitre.o
>rg/techniques/T1584)).  Adversaries may upload or inject mal>rg/techniques/T1584)).  Adversaries may upload or inject mal
>icious web content, such as [JavaScript](https://attack.mitr>icious web content, such as [JavaScript](https://attack.mitr
>e.org/techniques/T1059/007), into websites.(Citation: FireEy>e.org/techniques/T1059/007), into websites.(Citation: FireEy
>e CFR Watering Hole 2012)(Citation: Gallagher 2015) This may>e CFR Watering Hole 2012)(Citation: Gallagher 2015) This may
> be done in a number of ways, including inserting malicious > be done in a number of ways, including:  * Inserting malici
>script into web pages or other user controllable web content>ous scripts into web pages or other user controllable web co
> such as forum posts. Adversaries may also craft malicious w>ntent such as forum posts * Modifying script files served to
>eb advertisements and purchase ad space on a website through> websites from publicly writeable cloud storage buckets * Cr
> legitimate ad providers. In addition to staging content to >afting malicious web advertisements and purchasing ad space 
>exploit a user's web browser, adversaries may also stage scr>on a website through legitimate ad providers (i.e., [Malvert
>ipting content to profile the user's browser (as in [Gather >ising](https://attack.mitre.org/techniques/T1583/008))  In a
>Victim Host Information](https://attack.mitre.org/techniques>ddition to staging content to exploit a user's web browser, 
>/T1592)) to ensure it is vulnerable prior to attempting expl>adversaries may also stage scripting content to profile the 
>oitation.(Citation: ATT ScanBox)  Websites compromised by an>user's browser (as in [Gather Victim Host Information](https
> adversary and used to stage a drive-by may be ones visited >://attack.mitre.org/techniques/T1592)) to ensure it is vulne
>by a specific community, such as government, a particular in>rable prior to attempting exploitation.(Citation: ATT ScanBo
>dustry, or region, where the goal is to compromise a specifi>x)  Websites compromised by an adversary and used to stage a
>c user or set of users based on a shared interest. This kind> drive-by may be ones visited by a specific community, such 
> of targeted campaign is referred to a strategic web comprom>as government, a particular industry, or region, where the g
>ise or watering hole attack.  Adversaries may purchase domai>oal is to compromise a specific user or set of users based o
>ns similar to legitimate domains (ex: homoglyphs, typosquatt>n a shared interest. This kind of targeted campaign is refer
>ing, different top-level domain, etc.) during acquisition of>red to a strategic web compromise or watering hole attack.  
> infrastructure ([Domains](https://attack.mitre.org/techniqu>Adversaries may purchase domains similar to legitimate domai
>es/T1583/001)) to help facilitate [Drive-by Compromise](http>ns (ex: homoglyphs, typosquatting, different top-level domai
>s://attack.mitre.org/techniques/T1189).>n, etc.) during acquisition of infrastructure ([Domains](htt
 >ps://attack.mitre.org/techniques/T1583/001)) to help facilit
 >ate [Drive-by Compromise](https://attack.mitre.org/technique
 >s/T1189).
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2022-03-08 21:59:57.082000+00:002023-04-15 00:21:55.791000+00:00
descriptionAdversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts. Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers. In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox) Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including: * Inserting malicious scripts into web pages or other user controllable web content such as forum posts * Modifying script files served to websites from publicly writeable cloud storage buckets * Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008)) In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox) Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).
external_references[1]['source_name']FireEye CFR Watering Hole 2012ATT ScanBox
external_references[1]['description']Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020.Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.
external_references[1]['url']https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.htmlhttps://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks
external_references[3]['source_name']ATT ScanBoxFireEye CFR Watering Hole 2012
external_references[3]['description']Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved December 18, 2020.
external_references[3]['url']https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attackshttps://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html
x_mitre_version1.21.3

[T1586.002] Compromise Accounts: Email Accounts

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may compromise email accounts that can be used dt1Adversaries may compromise email accounts that can be used d
>uring targeting. Adversaries can use compromised email accou>uring targeting. Adversaries can use compromised email accou
>nts to further their operations, such as leveraging them to >nts to further their operations, such as leveraging them to 
>conduct [Phishing for Information](https://attack.mitre.org/>conduct [Phishing for Information](https://attack.mitre.org/
>techniques/T1598) or [Phishing](https://attack.mitre.org/tec>techniques/T1598), [Phishing](https://attack.mitre.org/techn
>hniques/T1566). Utilizing an existing persona with a comprom>iques/T1566), or large-scale spam email campaigns. Utilizing
>ised email account may engender a level of trust in a potent> an existing persona with a compromised email account may en
>ial victim if they have a relationship, or knowledge of, the>gender a level of trust in a potential victim if they have a
> compromised persona. Compromised email accounts can also be> relationship with, or knowledge of, the compromised persona
> used in the acquisition of infrastructure (ex: [Domains](ht>. Compromised email accounts can also be used in the acquisi
>tps://attack.mitre.org/techniques/T1583/001)).  A variety of>tion of infrastructure (ex: [Domains](https://attack.mitre.o
> methods exist for compromising email accounts, such as gath>rg/techniques/T1583/001)).  A variety of methods exist for c
>ering credentials via [Phishing for Information](https://att>ompromising email accounts, such as gathering credentials vi
>ack.mitre.org/techniques/T1598), purchasing credentials from>a [Phishing for Information](https://attack.mitre.org/techni
> third-party sites, or by brute forcing credentials (ex: pas>ques/T1598), purchasing credentials from third-party sites, 
>sword reuse from breach credential dumps).(Citation: AnonHBG>brute forcing credentials (ex: password reuse from breach cr
>ary) Prior to compromising email accounts, adversaries may c>edential dumps), or paying employees, suppliers or business 
>onduct Reconnaissance to inform decisions about which accoun>partners for access to credentials.(Citation: AnonHBGary)(Ci
>ts to compromise to further their operation.  Adversaries ca>tation: Microsoft DEV-0537) Prior to compromising email acco
>n use a compromised email account to hijack existing email t>unts, adversaries may conduct Reconnaissance to inform decis
>hreads with targets of interest.>ions about which accounts to compromise to further their ope
 >ration. Adversaries may target compromising well-known email
 > accounts or domains from which malicious spam or [Phishing]
 >(https://attack.mitre.org/techniques/T1566) emails may evade
 > reputation-based email filtering rules.  Adversaries can us
 >e a compromised email account to hijack existing email threa
 >ds with targets of interest.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_contributors['Tristan Bennett, Seamless Intelligence', 'Bryan Onel']
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-04-15 02:57:25.544000+00:002023-04-11 01:07:48.218000+00:00
descriptionAdversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566). Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)). A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).(Citation: AnonHBGary) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)). A variety of methods exist for compromising email accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. Adversaries may target compromising well-known email accounts or domains from which malicious spam or [Phishing](https://attack.mitre.org/techniques/T1566) emails may evade reputation-based email filtering rules. Adversaries can use a compromised email account to hijack existing email threads with targets of interest.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft DEV-0537', 'description': 'Microsoft. (2022, March 22). DEV-0537 criminal actor targeting organizations for data exfiltration and destruction. Retrieved March 23, 2022.', 'url': 'https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/'}

[T1114] Email Collection

Current version: 2.4

Version changed from: 2.3 → 2.4

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-10-15 20:19:33.750000+00:002023-04-12 20:46:04.871000+00:00
x_mitre_data_sources[1]Logon Session: Logon Session CreationApplication Log: Application Log Content
x_mitre_data_sources[2]Application Log: Application Log ContentLogon Session: Logon Session Creation
x_mitre_version2.32.4

[T1114.003] Email Collection: Email Forwarding Rule

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may setup email forwarding rules to collect senst1Adversaries may setup email forwarding rules to collect sens
>itive information. Adversaries may abuse email-forwarding ru>itive information. Adversaries may abuse email forwarding ru
>les to monitor the activities of a victim, steal information>les to monitor the activities of a victim, steal information
>, and further gain intelligence on the victim or the victim’>, and further gain intelligence on the victim or the victim’
>s organization to use as part of further exploits or operati>s organization to use as part of further exploits or operati
>ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo>ons.(Citation: US-CERT TA18-068A 2018) Furthermore, email fo
>rwarding rules can allow adversaries to maintain persistent >rwarding rules can allow adversaries to maintain persistent 
>access to victim's emails even after compromised credentials>access to victim's emails even after compromised credentials
> are reset by administrators.(Citation: Pfammatter - Hidden > are reset by administrators.(Citation: Pfammatter - Hidden 
>Inbox Rules) Most email clients allow users to create inbox >Inbox Rules) Most email clients allow users to create inbox 
>rules for various email functions, including forwarding to a>rules for various email functions, including forwarding to a
> different recipient. These rules may be created through a l> different recipient. These rules may be created through a l
>ocal email application, a web interface, or by command-line >ocal email application, a web interface, or by command-line 
>interface. Messages can be forwarded to internal or external>interface. Messages can be forwarded to internal or external
> recipients, and there are no restrictions limiting the exte> recipients, and there are no restrictions limiting the exte
>nt of this rule. Administrators may also create forwarding r>nt of this rule. Administrators may also create forwarding r
>ules for user accounts with the same considerations and outc>ules for user accounts with the same considerations and outc
>omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar>omes.(Citation: Microsoft Tim McMichael Exchange Mail Forwar
>ding 2)(Citation: Mac Forwarding Rules)  Any user or adminis>ding 2)(Citation: Mac Forwarding Rules)  Any user or adminis
>trator within the organization (or adversary with valid cred>trator within the organization (or adversary with valid cred
>entials) can create rules to automatically forward all recei>entials) can create rules to automatically forward all recei
>ved messages to another recipient, forward emails to differe>ved messages to another recipient, forward emails to differe
>nt locations based on the sender, and more. Adversaries may >nt locations based on the sender, and more. Adversaries may 
>also hide the rule by making use of the Microsoft Messaging >also hide the rule by making use of the Microsoft Messaging 
>API (MAPI) to modify the rule properties, making it hidden a>API (MAPI) to modify the rule properties, making it hidden a
>nd not visible from Outlook, OWA or most Exchange Administra>nd not visible from Outlook, OWA or most Exchange Administra
>tion tools.(Citation: Pfammatter - Hidden Inbox Rules)>tion tools.(Citation: Pfammatter - Hidden Inbox Rules)  In s
 >ome environments, administrators may be able to enable email
 > forwarding rules that operate organization-wide rather than
 > on individual inboxes. For example, Microsoft Exchange supp
 >orts transport rules that evaluate all mail an organization 
 >receives against user-specified conditions, then performs a 
 >user-specified action on mail that adheres to those conditio
 >ns.(Citation: Microsoft Mail Flow Rules 2023) Adversaries th
 >at abuse such features may be able to enable forwarding on a
 >ll or specific mail an organization receives. 

New Detections:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-10-15 20:19:33.416000+00:002023-04-12 20:47:47.583000+00:00
descriptionAdversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules)Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to enable forwarding on all or specific mail an organization receives.
external_references[1]['source_name']US-CERT TA18-068A 2018Mac Forwarding Rules
external_references[1]['description']US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.Apple. (n.d.). Reply to, forward, or redirect emails in Mail on Mac. Retrieved June 22, 2021.
external_references[1]['url']https://www.us-cert.gov/ncas/alerts/TA18-086Ahttps://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/mac
external_references[4]['source_name']Mac Forwarding RulesMicrosoft Mail Flow Rules 2023
external_references[4]['description']Apple. (n.d.). Reply to, forward, or redirect emails in Mail on Mac. Retrieved June 22, 2021.Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023.
external_references[4]['url']https://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/machttps://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'US-CERT TA18-068A 2018', 'description': 'US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-086A'}
x_mitre_contributorsLiran Ravich, CardinalOps
x_mitre_data_sourcesCommand: Command Execution

[T1564.008] Hide Artifacts: Email Hiding Rules

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may use email rules to hide inbound emails in a t1Adversaries may use email rules to hide inbound emails in a 
>compromised user's mailbox. Many email clients allow users t>compromised user's mailbox. Many email clients allow users t
>o create inbox rules for various email functions, including >o create inbox rules for various email functions, including 
>moving emails to other folders, marking emails as read, or d>moving emails to other folders, marking emails as read, or d
>eleting emails. Rules may be created or modified within emai>eleting emails. Rules may be created or modified within emai
>l clients or through external features such as the <code>New>l clients or through external features such as the <code>New
>-InboxRule</code> or <code>Set-InboxRule</code> [PowerShell]>-InboxRule</code> or <code>Set-InboxRule</code> [PowerShell]
>(https://attack.mitre.org/techniques/T1059/001) cmdlets on W>(https://attack.mitre.org/techniques/T1059/001) cmdlets on W
>indows systems.(Citation: Microsoft Inbox Rules)(Citation: M>indows systems.(Citation: Microsoft Inbox Rules)(Citation: M
>acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio>acOS Email Rules)(Citation: Microsoft New-InboxRule)(Citatio
>n: Microsoft Set-InboxRule)  Adversaries may utilize email r>n: Microsoft Set-InboxRule)  Adversaries may utilize email r
>ules within a compromised user's mailbox to delete and/or mo>ules within a compromised user's mailbox to delete and/or mo
>ve emails to less noticeable folders. Adversaries may do thi>ve emails to less noticeable folders. Adversaries may do thi
>s to hide security alerts, C2 communication, or responses to>s to hide security alerts, C2 communication, or responses to
> [Internal Spearphishing](https://attack.mitre.org/technique> [Internal Spearphishing](https://attack.mitre.org/technique
>s/T1534) emails sent from the compromised account.  Any user>s/T1534) emails sent from the compromised account.  Any user
> or administrator within the organization (or adversary with> or administrator within the organization (or adversary with
> valid credentials) may be able to create rules to automatic> valid credentials) may be able to create rules to automatic
>ally move or delete emails. These rules can be abused to imp>ally move or delete emails. These rules can be abused to imp
>air/delay detection had the email content been immediately s>air/delay detection had the email content been immediately s
>een by a user or defender. Malicious rules commonly filter o>een by a user or defender. Malicious rules commonly filter o
>ut emails based on key words (such as <code>malware</code>, >ut emails based on key words (such as <code>malware</code>, 
><code>suspicious</code>, <code>phish</code>, and <code>hack<><code>suspicious</code>, <code>phish</code>, and <code>hack<
>/code>) found in message bodies and subject lines. (Citation>/code>) found in message bodies and subject lines. (Citation
>: Microsoft Cloud App Security)>: Microsoft Cloud App Security)  In some environments, admin
 >istrators may be able to enable email rules that operate org
 >anization-wide rather than on individual inboxes. For exampl
 >e, Microsoft Exchange supports transport rules that evaluate
 > all mail an organization receives against user-specified co
 >nditions, then performs a user-specified action on mail that
 > adheres to those conditions.(Citation: Microsoft Mail Flow 
 >Rules 2023) Adversaries that abuse such features may be able
 > to automatically modify or delete all emails related to spe
 >cific topics (such as internal security incident notificatio
 >ns).
Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-12 15:22:29.599000+00:002023-04-12 20:42:20.079000+00:00
descriptionAdversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule) Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account. Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule) Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account. Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security) In some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).
external_references[3]['source_name']Microsoft Inbox RulesMicrosoft Mail Flow Rules 2023
external_references[3]['description']Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021.Microsoft. (2023, February 22). Mail flow rules (transport rules) in Exchange Online. Retrieved March 13, 2023.
external_references[3]['url']https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules
external_references[4]['source_name']Microsoft New-InboxRuleMicrosoft Inbox Rules
external_references[4]['description']Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021.Microsoft. (n.d.). Manage email messages by using rules. Retrieved June 11, 2021.
external_references[4]['url']https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-pshttps://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59
external_references[5]['source_name']Microsoft Set-InboxRuleMicrosoft New-InboxRule
external_references[5]['description']Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021.Microsoft. (n.d.). New-InboxRule. Retrieved June 7, 2021.
external_references[5]['url']https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-pshttps://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps
external_references[6]['source_name']Microsoft Cloud App SecurityMicrosoft Set-InboxRule
external_references[6]['description']Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021.Microsoft. (n.d.). Set-InboxRule. Retrieved June 7, 2021.
external_references[6]['url']https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft Cloud App Security', 'description': 'Niv Goldenberg. (2018, December 12). Rule your inbox with Microsoft Cloud App Security. Retrieved June 7, 2021.', 'url': 'https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154'}
x_mitre_contributorsLiran Ravich, CardinalOps
x_mitre_data_sourcesFile: File Modification
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesFile: File Modification

[T1611] Escape to Host

Current version: 1.4

Version changed from: 1.3 → 1.4

New Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-21 20:03:06.707000+00:002023-04-15 16:21:04.265000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesContainer: Container Creation
x_mitre_data_sourcesProcess: Process Creation
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation
x_mitre_data_sourcesContainer: Container Creation

[T1048] Exfiltration Over Alternative Protocol

Current version: 1.4

Version changed from: 1.3 → 1.4


Old Description
New Description
t1Adversaries may steal data by exfiltrating it over a differet1Adversaries may steal data by exfiltrating it over a differe
>nt protocol than that of the existing command and control ch>nt protocol than that of the existing command and control ch
>annel. The data may also be sent to an alternate network loc>annel. The data may also be sent to an alternate network loc
>ation from the main command and control server.    Alternate>ation from the main command and control server.    Alternate
> protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other> protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other
> network protocol not being used as the main command and con> network protocol not being used as the main command and con
>trol channel. Different protocol channels could also include>trol channel. Adversaries may also opt to encrypt and/or obf
> Web services such as cloud storage. Adversaries may also op>uscate these alternate channels.   [Exfiltration Over Altern
>t to encrypt and/or obfuscate these alternate channels.   [E>ative Protocol](https://attack.mitre.org/techniques/T1048) c
>xfiltration Over Alternative Protocol](https://attack.mitre.>an be done using various common operating system utilities s
>org/techniques/T1048) can be done using various common opera>uch as [Net](https://attack.mitre.org/software/S0039)/SMB or
>ting system utilities such as [Net](https://attack.mitre.org> FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linu
>/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct >x <code>curl</code> may be used to invoke protocols such as 
>2016) On macOS and Linux <code>curl</code> may be used to in>HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 
>voke protocols such as HTTP/S or FTP/S to exfiltrate data fr>20 macOS Common Tools and Techniques)  Many IaaS and SaaS pl
>om a system.(Citation: 20 macOS Common Tools and Techniques)>atforms (such as Microsoft Exchange, Microsoft SharePoint, G
> >itHub, and AWS S3) support the direct download of files, ema
 >ils, source code, and other sensitive information via the we
 >b console or [Cloud API](https://attack.mitre.org/techniques
 >/T1059/009).

New Mitigations:

New Detections:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
x_mitre_network_requirementsFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-15 22:49:28.766000+00:002023-04-15 00:58:36.287000+00:00
descriptionAdversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
external_references[1]['source_name']Palo Alto OilRig Oct 2016University of Birmingham C2
external_references[1]['description']Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
external_references[1]['url']http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
external_references[2]['source_name']20 macOS Common Tools and TechniquesPalo Alto OilRig Oct 2016
external_references[2]['description']Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.
external_references[2]['url']https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/
external_references[3]['source_name']University of Birmingham C220 macOS Common Tools and Techniques
external_references[3]['description']Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.
external_references[3]['url']https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdfhttps://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/
x_mitre_version1.31.4
x_mitre_data_sources[3]Command: Command ExecutionCloud Storage: Cloud Storage Access
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesApplication Log: Application Log Content
x_mitre_data_sourcesNetwork Traffic: Network Connection Creation
x_mitre_data_sourcesCommand: Command Execution
x_mitre_platformsOffice 365
x_mitre_platformsSaaS
x_mitre_platformsIaaS
x_mitre_platformsGoogle Workspace
x_mitre_platformsNetwork
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetwork Traffic: Network Connection Creation

[T1041] Exfiltration Over C2 Channel

Current version: 2.2

Version changed from: 2.1 → 2.2

Dropped Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
x_mitre_network_requirementsFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-15 22:45:50.620000+00:002023-04-07 17:09:14.040000+00:00
x_mitre_data_sources[0]Network Traffic: Network Traffic ContentFile: File Access
x_mitre_data_sources[1]Command: Command ExecutionNetwork Traffic: Network Traffic Content
x_mitre_data_sources[3]Network Traffic: Network Connection CreationCommand: Command Execution
x_mitre_data_sources[4]File: File AccessNetwork Traffic: Network Connection Creation
x_mitre_version2.12.2

[T1048.003] Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Current version: 2.1

Version changed from: 2.0 → 2.1


Old Description
New Description
t1Adversaries may steal data by exfiltrating it over an un-enct1Adversaries may steal data by exfiltrating it over an un-enc
>rypted network protocol other than that of the existing comm>rypted network protocol other than that of the existing comm
>and and control channel. The data may also be sent to an alt>and and control channel. The data may also be sent to an alt
>ernate network location from the main command and control se>ernate network location from the main command and control se
>rver.   Adversaries may opt to obfuscate this data, without >rver.(Citation: copy_cmd_cisco)  Adversaries may opt to obfu
>the use of encryption, within network protocols that are nat>scate this data, without the use of encryption, within netwo
>ively unencrypted (such as HTTP, FTP, or DNS). This may incl>rk protocols that are natively unencrypted (such as HTTP, FT
>ude custom or publicly available encoding/compression algori>P, or DNS). This may include custom or publicly available en
>thms (such as base64) as well as embedding data within proto>coding/compression algorithms (such as base64) as well as em
>col headers and fields. >bedding data within protocol headers and fields. 
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_network_requirementsFalse
values_changed
STIX FieldOld valueNew Value
modified2022-04-12 19:57:45.277000+00:002023-04-12 23:39:25.476000+00:00
descriptionAdversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
external_references[1]['source_name']University of Birmingham C2copy_cmd_cisco
external_references[1]['description']Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.Cisco. (2022, August 16). copy - Cisco IOS Configuration Fundamentals Command Reference . Retrieved July 13, 2022.
external_references[1]['url']https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdfhttps://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/C_commands.html#wp1068167689
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[1]Network Traffic: Network Traffic ContentCommand: Command Execution
x_mitre_data_sources[2]Command: Command ExecutionNetwork Traffic: Network Connection Creation
x_mitre_data_sources[4]Network Traffic: Network Connection CreationNetwork Traffic: Network Traffic Content
x_mitre_detectionAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2) For network infrastructure devices, collect AAA logging to monitor for `copy` commands being run to exfiltrate configuration files to non-standard destinations over unencrypted protocols such as TFTP.
x_mitre_version2.02.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'University of Birmingham C2', 'description': 'Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.', 'url': 'https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf'}
x_mitre_contributorsAustin Clark, @c2defense
x_mitre_platformsNetwork

[T1190] Exploit Public-Facing Application

Current version: 2.4

Version changed from: 2.3 → 2.4


Old Description
New Description
t1Adversaries may attempt to take advantage of a weakness in at1Adversaries may attempt to exploit a weakness in an Internet
>n Internet-facing computer or program using software, data, >-facing host or system to initially access a network. The we
>or commands in order to cause unintended or unanticipated be>akness in the system can be a software bug, a temporary glit
>havior. The weakness in the system can be a bug, a glitch, o>ch, or a misconfiguration.  Exploited applications are often
>r a design vulnerability. These applications are often websi> websites/web servers, but can also include databases (like 
>tes, but can include databases (like SQL), standard services>SQL), standard services (like SMB or SSH), network device ad
> (like SMB or SSH), network device administration and manage>ministration and management protocols (like SNMP and Smart I
>ment protocols (like SNMP and Smart Install), and any other >nstall), and any other system with Internet accessible open 
>applications with Internet accessible open sockets, such as >sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple
>web servers and related services.(Citation: NVD CVE-2016-666> SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In
>2)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US->frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic
>CERT TA18-106A Network Infrastructure Devices 2018)(Citation>e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla
>: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7>w being exploited this may also involve [Exploitation for De
>169) Depending on the flaw being exploited this may include >fense Evasion](https://attack.mitre.org/techniques/T1211).  
>[Exploitation for Defense Evasion](https://attack.mitre.org/> If an application is hosted on cloud-based infrastructure a
>techniques/T1211).   If an application is hosted on cloud-ba>nd/or is containerized, then exploiting it may lead to compr
>sed infrastructure and/or is containerized, then exploiting >omise of the underlying instance or container. This can allo
>it may lead to compromise of the underlying instance or cont>w an adversary a path to access the cloud or container APIs,
>ainer. This can allow an adversary a path to access the clou> exploit container host access via [Escape to Host](https://
>d or container APIs, exploit container host access via [Esca>attack.mitre.org/techniques/T1611), or take advantage of wea
>pe to Host](https://attack.mitre.org/techniques/T1611), or t>k identity and access management policies.  Adversaries may 
>ake advantage of weak identity and access management policie>also exploit edge network infrastructure and related applian
>s.  For websites and databases, the OWASP top 10 and CWE top>ces, specifically targeting devices that do not support robu
> 25 highlight the most common web-based vulnerabilities.(Cit>st host-based defenses.(Citation: Mandiant Fortinet Zero Day
>ation: OWASP Top 10)(Citation: CWE top 25)>)(Citation: Wired Russia Cyberwar)  For websites and databas
 >es, the OWASP top 10 and CWE top 25 highlight the most commo
 >n web-based vulnerabilities.(Citation: OWASP Top 10)(Citatio
 >n: CWE top 25)

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-04-19 17:06:53.032000+00:002023-04-14 22:18:39.190000+00:00
descriptionAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies. Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)
external_references[3]['source_name']NVD CVE-2016-6662Wired Russia Cyberwar
external_references[3]['description']National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018.Greenberg, A. (2022, November 10). Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless. Retrieved March 22, 2023.
external_references[3]['url']https://nvd.nist.gov/vuln/detail/CVE-2016-6662https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/
external_references[4]['source_name']NVD CVE-2014-7169Mandiant Fortinet Zero Day
external_references[4]['description']National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018.Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.
external_references[4]['url']https://nvd.nist.gov/vuln/detail/CVE-2014-7169https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
external_references[5]['source_name']Cisco Blog Legacy Device AttacksNVD CVE-2016-6662
external_references[5]['description']Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018.
external_references[5]['url']https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954https://nvd.nist.gov/vuln/detail/CVE-2016-6662
external_references[6]['source_name']OWASP Top 10NVD CVE-2014-7169
external_references[6]['description']OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018.
external_references[6]['url']https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projecthttps://nvd.nist.gov/vuln/detail/CVE-2014-7169
external_references[7]['source_name']US-CERT TA18-106A Network Infrastructure Devices 2018Cisco Blog Legacy Device Attacks
external_references[7]['description']US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
external_references[7]['url']https://us-cert.cisa.gov/ncas/alerts/TA18-106Ahttps://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Application Log: Application Log ContentNetwork Traffic: Network Traffic Content
x_mitre_data_sources[1]Network Traffic: Network Traffic ContentApplication Log: Application Log Content
x_mitre_version2.32.4
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'OWASP Top 10', 'description': 'OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.', 'url': 'https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project'}
external_references{'source_name': 'US-CERT TA18-106A Network Infrastructure Devices 2018', 'description': 'US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.', 'url': 'https://us-cert.cisa.gov/ncas/alerts/TA18-106A'}

[T1068] Exploitation for Privilege Escalation

Current version: 1.5

Version changed from: 1.4 → 1.5

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-06-16 19:25:12.835000+00:002023-04-07 17:13:54.168000+00:00
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Driver: Driver LoadProcess: Process Creation
x_mitre_data_sources[1]Process: Process CreationDriver: Driver Load
x_mitre_version1.41.5

[T1606] Forge Web Credentials

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may forge credential materials that can be used t1Adversaries may forge credential materials that can be used 
>to gain access to web applications or Internet services. Web>to gain access to web applications or Internet services. Web
> applications and services (hosted in cloud SaaS environment> applications and services (hosted in cloud SaaS environment
>s or on-premise servers) often use session cookies, tokens, >s or on-premise servers) often use session cookies, tokens, 
>or other materials to authenticate and authorize user access>or other materials to authenticate and authorize user access
>.  Adversaries may generate these credential materials in or>.  Adversaries may generate these credential materials in or
>der to gain access to web resources. This differs from [Stea>der to gain access to web resources. This differs from [Stea
>l Web Session Cookie](https://attack.mitre.org/techniques/T1>l Web Session Cookie](https://attack.mitre.org/techniques/T1
>539), [Steal Application Access Token](https://attack.mitre.>539), [Steal Application Access Token](https://attack.mitre.
>org/techniques/T1528), and other similar behaviors in that t>org/techniques/T1528), and other similar behaviors in that t
>he credentials are new and forged by the adversary, rather t>he credentials are new and forged by the adversary, rather t
>han stolen or intercepted from legitimate users. The generat>han stolen or intercepted from legitimate users. The generat
>ion of web credentials often requires secret values, such as>ion of web credentials often requires secret values, such as
> passwords, [Private Keys](https://attack.mitre.org/techniqu> passwords, [Private Keys](https://attack.mitre.org/techniqu
>es/T1552/004), or other cryptographic seed values.(Citation:>es/T1552/004), or other cryptographic seed values.(Citation:
> GitHub AWS-ADFS-Credential-Generator)  Once forged, adversa> GitHub AWS-ADFS-Credential-Generator) Adversaries may also 
>ries may use these web credentials to access resources (ex: >forge tokens by taking advantage of features such as the `As
>[Use Alternate Authentication Material](https://attack.mitre>sumeRole` and `GetFederationToken` APIs in AWS, which allow 
>.org/techniques/T1550)), which may bypass multi-factor and o>users to request temporary security credentials.(Citation: A
>ther authentication protection mechanisms.(Citation: Pass Th>WS Temporary Security Credentials)  Once forged, adversaries
>e Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)> may use these web credentials to access resources (ex: [Use
>(Citation: Microsoft SolarWinds Customer Guidance)> Alternate Authentication Material](https://attack.mitre.org
 >/techniques/T1550)), which may bypass multi-factor and other
 > authentication protection mechanisms.(Citation: Pass The Co
 >okie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Cit
 >ation: Microsoft SolarWinds Customer Guidance)  
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_contributors['Dylan']
x_mitre_deprecatedFalse
values_changed
STIX FieldOld valueNew Value
modified2021-10-12 14:26:52.179000+00:002023-04-12 21:35:48.084000+00:00
descriptionAdversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance)Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access. Adversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials.(Citation: AWS Temporary Security Credentials) Once forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance)
external_references[1]['source_name']GitHub AWS-ADFS-Credential-GeneratorAWS Temporary Security Credentials
external_references[1]['description']Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved December 16, 2020.AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022.
external_references[1]['url']https://github.com/damianh/aws-adfs-credential-generatorhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html
external_references[2]['source_name']Pass The CookieUnit 42 Mac Crypto Cookies January 2019
external_references[2]['description']Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.
external_references[2]['url']https://wunderwuzzi23.github.io/blog/passthecookie.htmlhttps://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/
external_references[3]['source_name']Unit 42 Mac Crypto Cookies January 2019GitHub AWS-ADFS-Credential-Generator
external_references[3]['description']Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved December 16, 2020.
external_references[3]['url']https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/https://github.com/damianh/aws-adfs-credential-generator
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Pass The Cookie', 'description': 'Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.', 'url': 'https://wunderwuzzi23.github.io/blog/passthecookie.html'}
x_mitre_data_sourcesLogon Session: Logon Session Creation
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesLogon Session: Logon Session Creation

[T1615] Group Policy Discovery

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may gather information on Group Policy settings t1Adversaries may gather information on Group Policy settings 
>to identify paths for privilege escalation, security measure>to identify paths for privilege escalation, security measure
>s applied within a domain, and to discover patterns in domai>s applied within a domain, and to discover patterns in domai
>n objects that can be manipulated or used to blend in the en>n objects that can be manipulated or used to blend in the en
>vironment. Group Policy allows for centralized management of>vironment. Group Policy allows for centralized management of
> user and computer settings in Active Directory (AD). Group > user and computer settings in Active Directory (AD). Group 
>policy objects (GPOs) are containers for group policy settin>policy objects (GPOs) are containers for group policy settin
>gs made up of files stored within a predicable network path >gs made up of files stored within a predictable network path
><code>\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\</code>.(Citation: > `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Gr
>TechNet Group Policy Basics)(Citation: ADSecurity GPO Persis>oup Policy Basics)(Citation: ADSecurity GPO Persistence 2016
>tence 2016)  Adversaries may use commands such as <code>gpre>)  Adversaries may use commands such as <code>gpresult</code
>sult</code> or various publicly available PowerShell functio>> or various publicly available PowerShell functions, such a
>ns, such as <code>Get-DomainGPO</code> and <code>Get-DomainG>s <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGro
>POLocalGroup</code>, to gather information on Group Policy s>up</code>, to gather information on Group Policy settings.(C
>ettings.(Citation: Microsoft gpresult)(Citation: Github Powe>itation: Microsoft gpresult)(Citation: Github PowerShell Emp
>rShell Empire) Adversaries may use this information to shape>ire) Adversaries may use this information to shape follow-on
> follow-on behaviors, including determining potential attack> behaviors, including determining potential attack paths wit
> paths within the target network as well as opportunities to>hin the target network as well as opportunities to manipulat
> manipulate Group Policy settings (i.e. [Domain Policy Modif>e Group Policy settings (i.e. [Domain Policy Modification](h
>ication](https://attack.mitre.org/techniques/T1484)) for the>ttps://attack.mitre.org/techniques/T1484)) for their benefit
>ir benefit.>.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_attack_spec_version3.1.0
x_mitre_deprecatedFalse
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2021-10-15 23:16:28.296000+00:002023-01-06 12:41:08.579000+00:00
descriptionAdversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predicable network path \\SYSVOL\\Policies\.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\SYSVOL\\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016) Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.
external_references[1]['source_name']TechNet Group Policy BasicsADSecurity GPO Persistence 2016
external_references[1]['description']srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.
external_references[1]['url']https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/https://adsecurity.org/?p=2716
external_references[2]['source_name']ADSecurity GPO Persistence 2016Microsoft gpresult
external_references[2]['description']Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021.
external_references[2]['url']https://adsecurity.org/?p=2716https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
external_references[3]['source_name']Microsoft gpresultGithub PowerShell Empire
external_references[3]['description']Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021.Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
external_references[3]['url']https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresulthttps://github.com/PowerShellEmpire/Empire
external_references[4]['source_name']Github PowerShell EmpireTechNet Group Policy Basics
external_references[4]['description']Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.srachui. (2012, February 13). Group Policy Basics – Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.
external_references[4]['url']https://github.com/PowerShellEmpire/Empirehttps://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/
x_mitre_data_sources[0]Network Traffic: Network Traffic ContentActive Directory: Active Directory Object Access
x_mitre_data_sources[1]Command: Command ExecutionScript: Script Execution
x_mitre_data_sources[2]Script: Script ExecutionProcess: Process Creation
x_mitre_data_sources[3]Process: Process CreationNetwork Traffic: Network Traffic Content
x_mitre_data_sources[4]Active Directory: Active Directory Object AccessCommand: Command Execution
x_mitre_version1.01.1

[T1562] Impair Defenses

Current version: 1.4

Version changed from: 1.3 → 1.4


Old Description
New Description
t1Adversaries may maliciously modify components of a victim ent1Adversaries may maliciously modify components of a victim en
>vironment in order to hinder or disable defensive mechanisms>vironment in order to hinder or disable defensive mechanisms
>. This not only involves impairing preventative defenses, su>. This not only involves impairing preventative defenses, su
>ch as firewalls and anti-virus, but also detection capabilit>ch as firewalls and anti-virus, but also detection capabilit
>ies that defenders can use to audit activity and identify ma>ies that defenders can use to audit activity and identify ma
>licious behavior. This may also span both native defenses as>licious behavior. This may also span both native defenses as
> well as supplemental capabilities installed by users and ad> well as supplemental capabilities installed by users and ad
>ministrators.  Adversaries could also target event aggregati>ministrators.  Adversaries may also impair routine operation
>on and analysis mechanisms, or otherwise disrupt these proce>s that contribute to defensive hygiene, such as blocking use
>dures by altering other system components.>rs from logging out of a computer or stopping it from being 
 >shut down. These restrictions can further enable malicious o
 >perations as well as the continued propagation of incidents.
 >(Citation: Emotet shutdown)  Adversaries could also target e
 >vent aggregation and analysis mechanisms, or otherwise disru
 >pt these procedures by altering other system components.

New Mitigations:

New Detections:

Details
values_changed
STIX FieldOld valueNew Value
modified2022-10-19 16:32:56.502000+00:002023-04-15 00:48:46.626000+00:00
descriptionAdversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators. Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown) Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.
x_mitre_attack_spec_version2.1.03.1.0
x_mitre_data_sources[0]Cloud Service: Cloud Service ModificationFirewall: Firewall Rule Modification
x_mitre_data_sources[1]Firewall: Firewall Rule ModificationCloud Service: Cloud Service Disable
x_mitre_data_sources[2]Process: Process TerminationCommand: Command Execution
x_mitre_data_sources[3]Service: Service MetadataUser Account: User Account Modification
x_mitre_data_sources[4]Process: Process CreationCloud Service: Cloud Service Modification
x_mitre_data_sources[5]Driver: Driver LoadFirewall: Firewall Disable
x_mitre_data_sources[6]Firewall: Firewall DisableScript: Script Execution
x_mitre_data_sources[7]Command: Command ExecutionDriver: Driver Load
x_mitre_data_sources[8]Cloud Service: Cloud Service DisableWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[9]Windows Registry: Windows Registry Key DeletionSensor Health: Host Status
x_mitre_data_sources[10]Windows Registry: Windows Registry Key ModificationWindows Registry: Windows Registry Key Deletion
x_mitre_data_sources[11]Sensor Health: Host StatusProcess: Process Termination
x_mitre_data_sources[12]Script: Script ExecutionProcess: Process Creation
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Emotet shutdown', 'description': 'The DFIR Report. (2022, November 8). Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware. Retrieved March 6, 2023.', 'url': 'https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/#:~:text=Don’t%20Sleep%20has%20the%20capability%20to%20keep%20the%20computer%20from%20being%20shutdown%20and%20the%20user%20from%20being%20signed%20off.%20This%20was%20likely%20done%20to%20ensure%20nothing%20will%20interfere%20with%20the%20propagation%20of%20the%20ransomware%20payload'}
x_mitre_data_sourcesService: Service Metadata

[T1562.006] Impair Defenses: Indicator Blocking

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1An adversary may attempt to block indicators or events typict1An adversary may attempt to block indicators or events typic
>ally captured by sensors from being gathered and analyzed. T>ally captured by sensors from being gathered and analyzed. T
>his could include maliciously redirecting (Citation: Microso>his could include maliciously redirecting(Citation: Microsof
>ft Lamin Sept 2017) or even disabling host-based sensors, su>t Lamin Sept 2017) or even disabling host-based sensors, suc
>ch as Event Tracing for Windows (ETW),(Citation: Microsoft A>h as Event Tracing for Windows (ETW)(Citation: Microsoft Abo
>bout Event Tracing 2018) by tampering settings that control >ut Event Tracing 2018), by tampering settings that control t
>the collection and flow of event telemetry. (Citation: Mediu>he collection and flow of event telemetry.(Citation: Medium 
>m Event Tracing Tampering 2018) These settings may be stored>Event Tracing Tampering 2018) These settings may be stored o
> on the system in configuration files and/or in the Registry>n the system in configuration files and/or in the Registry a
> as well as being accessible via administrative utilities su>s well as being accessible via administrative utilities such
>ch as [PowerShell](https://attack.mitre.org/techniques/T1059> as [PowerShell](https://attack.mitre.org/techniques/T1059/0
>/001) or [Windows Management Instrumentation](https://attack>01) or [Windows Management Instrumentation](https://attack.m
>.mitre.org/techniques/T1047).  ETW interruption can be achie>itre.org/techniques/T1047).  For example, adversaries may mo
>ved multiple ways, however most directly by defining conditi>dify the `File` value in <code>HKEY_LOCAL_MACHINE\SYSTEM\Cur
>ons using the [Powe