These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
New Techniques
[T1574.014] Hijack Execution Flow: AppDomainManager
Current version: 1.0
Description: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains)
Known as "AppDomainManager injection," adversaries may execute arbitrary code by hijacking how .NET applications load assemblies. For example, malware may create a custom application domain inside a target process to load and execute an arbitrary assembly. Alternatively, configuration files (`.config`) or process environment variables that define .NET runtime settings may be tampered with to instruct otherwise benign .NET applications to load a malicious assembly (identified by name) into the target process.(Citation: PenTestLabs AppDomainManagerInject)(Citation: PwC Yellow Liderc)(Citation: Rapid7 AppDomain Manager Injection)
[T1588.007] Obtain Capabilities: Artificial Intelligence
Current version: 1.0
Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI)
For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI)
[T1059.010] Command and Scripting Interpreter: AutoHotKey & AutoIT
Current version: 1.0
Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)
Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate)
These scripts may also be compiled into self-contained exectuable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)
[T1556.009] Modify Authentication Process: Conditional Access Policies
Current version: 1.0
Description: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
For example, in Azure AD, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required.
By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures.
[T1543.005] Create or Modify System Process: Container Service
Current version: 1.0
Description: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host.
For example, by using the `docker run` or `podman run` command with the `restart=always` directive, a container can be configured to persistently restart on the host.(Citation: AquaSec TeamTNT 2023) A user with access to the (rootful) docker command may also be able to escalate their privileges on the host.(Citation: GTFOBins Docker)
In Kubernetes environments, DaemonSets allow an adversary to persistently [Deploy Container](https://attack.mitre.org/techniques/T1610)s on all nodes, including ones added later to the cluster.(Citation: Aquasec Kubernetes Attack 2023)(Citation: Kubernetes DaemonSet) Pods can also be deployed to specific nodes using the `nodeSelector` or `nodeName` fields in the pod spec.(Citation: Kubernetes Assigning Pods to Nodes)(Citation: AppSecco Kubernetes Namespace Breakout 2020)
Note that containers can also be configured to run as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s.(Citation: Podman Systemd)(Citation: Docker Systemd)
[T1218.015] System Binary Proxy Execution: Electron Applications
Current version: 1.0
Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1)
Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8)
Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)
[T1027.013] Obfuscated Files or Information: Encrypted/Encoded File
Current version: 1.0
Description: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.
This type of file obfuscation can be applied to many file artifacts present on victim hosts, such as malware log/configuration and payload files.(Citation: File obfuscation) Files can be encrypted with a hardcoded or user-supplied key, as well as otherwise obfuscated using standard encoding/compression schemes such as Base64.
The entire content of a file may be obfuscated, or just specific functions or values (such as C2 addresses). Encryption and encoding may also be applied in redundant layers for additional protection.
For example, adversaries may abuse password-protected Word documents or self-extracting (SFX) archives as a method of encrypting/encoding a file such as a [Phishing](https://attack.mitre.org/techniques/T1566) payload. These files typically function by attaching the intended archived content to a decompressor stub that is executed when the file is invoked (e.g., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: SFX - Encrypted/Encoded File)
Adversaries may also abuse file-specific as well as custom encoding schemes. For example, Byte Order Mark (BOM) headers in text files may be abused to manipulate and obfuscate file content until [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) execution.
[T1564.012] Hide Artifacts: File/Path Exclusions
Current version: 1.0
Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions)
Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
[T1665] Hide Infrastructure
Current version: 1.0
Description: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished in various ways including by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.
C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies)
Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite)
Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing services for C2 networks may enable adversaries to present benign content that later redirects victims to malicious web pages or infrastructure once specific conditions are met.(Citation: StarBlizzard)(Citation: QR-cofense)
[T1584.008] Compromise Infrastructure: Network Devices
Current version: 1.0
Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting.
Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices.
Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
[T1216.002] System Script Proxy Execution: SyncAppvPublishingServer
Current version: 1.0
Description: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)
The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv)
Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv)
For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv)
`SyncAppvPublishingServer.vbs "n; {PowerShell}"`
[T1548.006] Abuse Elevation Control Mechanism: TCC Manipulation
Current version: 1.0
Description: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to execute malicious applications with elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).
When an application requests to access data or a service protected by TCC, the TCC daemon (`tccd`) checks the TCC database, located at `/Library/Application Support/com.apple.TCC/TCC.db` (and `~/` equivalent), for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again.(Citation: welivesecurity TCC)
Adversaries may manipulate the TCC database or otherwise abuse the TCC service to execute malicious content. This can be done in various ways, including using privileged system applications to execute malicious payloads or manipulating the database to grant their application TCC permissions.
For example, adversaries can use Finder, which has FDA permissions by default, to execute malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002) while preventing a user prompt. For a system without System Integrity Protection (SIP) enabled, adversaries have also manipulated the operating system to load an adversary controlled TCC database using environment variables and [Launchctl](https://attack.mitre.org/techniques/T1569/001).(Citation: TCC macOS bypass)(Citation: TCC Database)
Adversaries may also opt to instead inject code (e.g., [Process Injection](https://attack.mitre.org/techniques/T1055)) into targeted applications with the desired TCC permissions.
Minor Version Changes
[T1548] Abuse Elevation Control Mechanism
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may circumvent mechanisms designed to control el | t | Adversaries may circumvent mechanisms designed to control el |
| evate privileges to gain higher-level permissions. Most mode | | evate privileges to gain higher-level permissions. Most mode |
| rn systems contain native elevation control mechanisms that | | rn systems contain native elevation control mechanisms that |
| are intended to limit privileges that a user can perform on | | are intended to limit privileges that a user can perform on |
| a machine. Authorization has to be granted to specific users | | a machine. Authorization has to be granted to specific users |
| in order to perform tasks that can be considered of higher | | in order to perform tasks that can be considered of higher |
| risk. An adversary can perform several methods to take advan | | risk.(Citation: TechNet How UAC Works)(Citation: sudo man pa |
| tage of built-in control mechanisms in order to escalate pri | | ge 2018) An adversary can perform several methods to take ad |
| vileges on a system. | | vantage of built-in control mechanisms in order to escalate |
| | | privileges on a system.(Citation: OSX Keydnap malware)(Citat |
| | | ion: Fortinet Fareit) |
New Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-02 00:47:11.369000+00:00 | 2024-04-15 20:52:09.908000+00:00 |
| description | Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system. | Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit) |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'TechNet How UAC Works', 'description': 'Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.', 'url': 'https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works'} |
| external_references | | {'source_name': 'OSX Keydnap malware', 'description': 'Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.', 'url': 'https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/'} |
| external_references | | {'source_name': 'Fortinet Fareit', 'description': 'Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.', 'url': 'https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware'} |
| external_references | | {'source_name': 'sudo man page 2018', 'description': 'Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.', 'url': 'https://www.sudo.ws/'} |
[T1583] Acquire Infrastructure
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may buy, lease, or rent infrastructure that can | t | Adversaries may buy, lease, rent, or obtain infrastructure t |
| be used during targeting. A wide variety of infrastructure e | | hat can be used during targeting. A wide variety of infrastr |
| xists for hosting and orchestrating adversary operations. In | | ucture exists for hosting and orchestrating adversary operat |
| frastructure solutions include physical or cloud servers, do | | ions. Infrastructure solutions include physical or cloud ser |
| mains, and third-party web services.(Citation: TrendmicroHid | | vers, domains, and third-party web services.(Citation: Trend |
| eoutsLease) Additionally, botnets are available for rent or | | microHideoutsLease) Some infrastructure providers offer free |
| purchase. Use of these infrastructure solutions allows adve | | trial periods, enabling infrastructure acquisition at limit |
| rsaries to stage, launch, and execute operations. Solutions | | ed to no cost.(Citation: Free Trial PurpleUrchin) Additional |
| may help adversary operations blend in with traffic that is | | ly, botnets are available for rent or purchase. Use of thes |
| seen as normal, such as contacting third-party web services | | e infrastructure solutions allows adversaries to stage, laun |
| or acquiring infrastructure to support [Proxy](https://attac | | ch, and execute operations. Solutions may help adversary ope |
| k.mitre.org/techniques/T1090), including from residential pr | | rations blend in with traffic that is seen as normal, such a |
| oxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI P | | s contacting third-party web services or acquiring infrastru |
| roxies Credential Stuffing)(Citation: Mandiant APT29 Microso | | cture to support [Proxy](https://attack.mitre.org/techniques |
| ft 365 2022) Depending on the implementation, adversaries ma | | /T1090), including from residential proxy services.(Citation |
| y use infrastructure that makes it difficult to physically t | | : amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuf |
| ie back to them as well as utilize infrastructure that can b | | fing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending |
| e rapidly provisioned, modified, and shut down. | | on the implementation, adversaries may use infrastructure t |
| | | hat makes it difficult to physically tie back to them as wel |
| | | l as utilize infrastructure that can be rapidly provisioned, |
| | | modified, and shut down. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-02 01:10:09.833000+00:00 | 2024-02-28 21:13:02.648000+00:00 |
| description | Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.
Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. | Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase.
Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down. |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Free Trial PurpleUrchin', 'description': 'Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.', 'url': 'https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/'} |
[T1098.001] Account Manipulation: Additional Cloud Credentials
Current version: 2.7
Version changed from: 2.6 → 2.7
|
|
|---|
| t | Adversaries may add adversary-controlled credentials to a cl | t | Adversaries may add adversary-controlled credentials to a cl |
| oud account to maintain persistent access to victim accounts | | oud account to maintain persistent access to victim accounts |
| and instances within the environment. For example, adversa | | and instances within the environment. For example, adversa |
| ries may add credentials for Service Principals and Applicat | | ries may add credentials for Service Principals and Applicat |
| ions in addition to existing legitimate credentials in Azure | | ions in addition to existing legitimate credentials in Azure |
| AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat | | AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat |
| ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide | | ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide |
| o) These credentials include both x509 keys and passwords.(C | | o) These credentials include both x509 keys and passwords.(C |
| itation: Microsoft SolarWinds Customer Guidance) With suffic | | itation: Microsoft SolarWinds Customer Guidance) With suffic |
| ient permissions, there are a variety of ways to add credent | | ient permissions, there are a variety of ways to add credent |
| ials including the Azure Portal, Azure command line interfac | | ials including the Azure Portal, Azure command line interfac |
| e, and Azure or Az PowerShell modules.(Citation: Demystifyin | | e, and Azure or Az PowerShell modules.(Citation: Demystifyin |
| g Azure AD Service Principals) In infrastructure-as-a-servi | | g Azure AD Service Principals) In infrastructure-as-a-servi |
| ce (IaaS) environments, after gaining access through [Cloud | | ce (IaaS) environments, after gaining access through [Cloud |
| Accounts](https://attack.mitre.org/techniques/T1078/004), ad | | Accounts](https://attack.mitre.org/techniques/T1078/004), ad |
| versaries may generate or import their own SSH keys using ei | | versaries may generate or import their own SSH keys using ei |
| ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ | | ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ |
| code> API in AWS or the <code>gcloud compute os-login ssh-ke | | code> API in AWS or the <code>gcloud compute os-login ssh-ke |
| ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi | | ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi |
| s allows persistent access to instances within the cloud env | | s allows persistent access to instances within the cloud env |
| ironment without further usage of the compromised cloud acco | | ironment without further usage of the compromised cloud acco |
| unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind | | unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind |
| the Scenes) Adversaries may also use the <code>CreateAcces | | the Scenes) Adversaries may also use the <code>CreateAcces |
| sKey</code> API in AWS or the <code>gcloud iam service-accou | | sKey</code> API in AWS or the <code>gcloud iam service-accou |
| nts keys create</code> command in GCP to add access keys to | | nts keys create</code> command in GCP to add access keys to |
| an account. If the target account has different permissions | | an account. If the target account has different permissions |
| from the requesting account, the adversary may also be able | | from the requesting account, the adversary may also be able |
| to escalate their privileges in the environment (i.e. [Cloud | | to escalate their privileges in the environment (i.e. [Cloud |
| Accounts](https://attack.mitre.org/techniques/T1078/004)).( | | Accounts](https://attack.mitre.org/techniques/T1078/004)).( |
| Citation: Rhino Security Labs AWS Privilege Escalation)(Cita | | Citation: Rhino Security Labs AWS Privilege Escalation)(Cita |
| tion: Sysdig ScarletEel 2.0) For example, in Azure AD enviro | | tion: Sysdig ScarletEel 2.0) For example, in Azure AD enviro |
| nments, an adversary with the Application Administrator role | | nments, an adversary with the Application Administrator role |
| can add a new set of credentials to their application's ser | | can add a new set of credentials to their application's ser |
| vice principal. In doing so the adversary would be able to a | | vice principal. In doing so the adversary would be able to a |
| ccess the service principal’s roles and permissions, which m | | ccess the service principal’s roles and permissions, which m |
| ay be different from those of the Application Administrator. | | ay be different from those of the Application Administrator. |
| (Citation: SpecterOps Azure Privilege Escalation) In AWS e | | (Citation: SpecterOps Azure Privilege Escalation) In AWS e |
| nvironments, adversaries with the appropriate permissions ma | | nvironments, adversaries with the appropriate permissions ma |
| y also use the `sts:GetFederationToken` API call to create a | | y also use the `sts:GetFederationToken` API call to create a |
| temporary set of credentials tied to the permissions of the | | temporary set of credentials to [Forge Web Credentials](htt |
| original user account. These credentials may remain valid f | | ps://attack.mitre.org/techniques/T1606) tied to the permissi |
| or the duration of their lifetime even if the original accou | | ons of the original user account. These temporary credential |
| nt’s API credentials are deactivated. (Citation: Crowdstrike | | s may remain valid for the duration of their lifetime even i |
| AWS User Federation Persistence) | | f the original account’s API credentials are deactivated. (C |
| | | itation: Crowdstrike AWS User Federation Persistence) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 17:37:24.011000+00:00 | 2024-02-28 14:35:00.862000+00:00 |
| description | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence) |
| x_mitre_version | 2.6 | 2.7 |
[T1098.003] Account Manipulation: Additional Cloud Roles
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | An adversary may add additional roles or permissions to an a | t | An adversary may add additional roles or permissions to an a |
| dversary-controlled cloud account to maintain persistent acc | | dversary-controlled cloud account to maintain persistent acc |
| ess to a tenant. For example, adversaries may update IAM pol | | ess to a tenant. For example, adversaries may update IAM pol |
| icies in cloud-based environments or add a new global admini | | icies in cloud-based environments or add a new global admini |
| strator in Office 365 environments.(Citation: AWS IAM Polici | | strator in Office 365 environments.(Citation: AWS IAM Polici |
| es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit |
| ation: Microsoft Support O365 Add Another Admin, October 201 | | ation: Microsoft Support O365 Add Another Admin, October 201 |
| 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per |
| missions, a compromised account can gain almost unlimited ac | | missions, a compromised account can gain almost unlimited ac |
| cess to data and settings (including the ability to reset th | | cess to data and settings (including the ability to reset th |
| e passwords of other admins).(Citation: Expel AWS Attacker) | | e passwords of other admins).(Citation: Expel AWS Attacker) |
| (Citation: Microsoft O365 Admin Roles) This account modifi | | (Citation: Microsoft O365 Admin Roles) This account modifi |
| cation may immediately follow [Create Account](https://attac | | cation may immediately follow [Create Account](https://attac |
| k.mitre.org/techniques/T1136) or other malicious account act | | k.mitre.org/techniques/T1136) or other malicious account act |
| ivity. Adversaries may also modify existing [Valid Accounts] | | ivity. Adversaries may also modify existing [Valid Accounts] |
| (https://attack.mitre.org/techniques/T1078) that they have c | | (https://attack.mitre.org/techniques/T1078) that they have c |
| ompromised. This could lead to privilege escalation, particu | | ompromised. This could lead to privilege escalation, particu |
| larly if the roles added allow for lateral movement to addit | | larly if the roles added allow for lateral movement to addit |
| ional accounts. For example, in AWS environments, an advers | | ional accounts. For example, in AWS environments, an advers |
| ary with appropriate permissions may be able to use the <cod | | ary with appropriate permissions may be able to use the <cod |
| e>CreatePolicyVersion</code> API to define a new version of | | e>CreatePolicyVersion</code> API to define a new version of |
| an IAM policy or the <code>AttachUserPolicy</code> API to at | | an IAM policy or the <code>AttachUserPolicy</code> API to at |
| tach an IAM policy with additional or distinct permissions t | | tach an IAM policy with additional or distinct permissions t |
| o a compromised user account.(Citation: Rhino Security Labs | | o a compromised user account.(Citation: Rhino Security Labs |
| AWS Privilege Escalation) | | AWS Privilege Escalation) In some cases, adversaries may ad |
| | | d roles to adversary-controlled accounts outside the victim |
| | | cloud tenant. This allows these external accounts to perform |
| | | actions inside the victim tenant without requiring the adve |
| | | rsary to [Create Account](https://attack.mitre.org/technique |
| | | s/T1136) or modify a victim-owned account.(Citation: Invictu |
| | | s IR DangerDev 2024) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 17:37:41.250000+00:00 | 2024-03-29 18:29:06.873000+00:00 |
| description | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation) | An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
(Citation: Microsoft O365 Admin Roles)
This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.
For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)
In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024) |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Invictus IR DangerDev 2024', 'description': 'Invictus Incident Response. (2024, January 31). The curious case of DangerDev@protonmail.me. Retrieved March 19, 2024.', 'url': 'https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me'} |
[T1557] Adversary-in-the-Middle
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may attempt to position themselves between two o | t | Adversaries may attempt to position themselves between two o |
| r more networked devices using an adversary-in-the-middle (A | | r more networked devices using an adversary-in-the-middle (A |
| iTM) technique to support follow-on behaviors such as [Netwo | | iTM) technique to support follow-on behaviors such as [Netwo |
| rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr |
| ansmitted Data Manipulation](https://attack.mitre.org/techni | | ansmitted Data Manipulation](https://attack.mitre.org/techni |
| ques/T1565/002), or replay attacks ([Exploitation for Creden | | ques/T1565/002), or replay attacks ([Exploitation for Creden |
| tial Access](https://attack.mitre.org/techniques/T1212)). By | | tial Access](https://attack.mitre.org/techniques/T1212)). By |
| abusing features of common networking protocols that can de | | abusing features of common networking protocols that can de |
| termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e |
| tc.), adversaries may force a device to communicate through | | tc.), adversaries may force a device to communicate through |
| an adversary controlled system so they can collect informati | | an adversary controlled system so they can collect informati |
| on or perform additional actions.(Citation: Rapid7 MiTM Basi | | on or perform additional actions.(Citation: Rapid7 MiTM Basi |
| cs) For example, adversaries may manipulate victim DNS sett | | cs) For example, adversaries may manipulate victim DNS sett |
| ings to enable other malicious activities such as preventing | | ings to enable other malicious activities such as preventing |
| /redirecting users from accessing legitimate sites and/or pu | | /redirecting users from accessing legitimate sites and/or pu |
| shing additional malware.(Citation: ttint_rat)(Citation: dns | | shing additional malware.(Citation: ttint_rat)(Citation: dns |
| _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari |
| es may also manipulate DNS and leverage their position in or | | es may also manipulate DNS and leverage their position in or |
| der to intercept user credentials and session cookies.(Citat | | der to intercept user credentials, including access tokens ( |
| ion: volexity_0day_sophos_FW) [Downgrade Attack](https://att | | [Steal Application Access Token](https://attack.mitre.org/te |
| ack.mitre.org/techniques/T1562/010)s can also be used to est | | chniques/T1528)) and session cookies ([Steal Web Session Coo |
| ablish an AiTM position, such as by negotiating a less secur | | kie](https://attack.mitre.org/techniques/T1539)).(Citation: |
| e, deprecated, or weaker version of communication protocol ( | | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade |
| SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgra | | Attack](https://attack.mitre.org/techniques/T1562/010)s can |
| de_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlse | | also be used to establish an AiTM position, such as by nego |
| minar_downgrade_att) Adversaries may also leverage the AiTM | | tiating a less secure, deprecated, or weaker version of comm |
| position to attempt to monitor and/or modify traffic, such | | unication protocol (SSL/TLS) or encryption algorithm.(Citati |
| as in [Transmitted Data Manipulation](https://attack.mitre.o | | on: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att |
| rg/techniques/T1565/002). Adversaries can setup a position s | | _tls)(Citation: tlseminar_downgrade_att) Adversaries may al |
| imilar to AiTM to prevent traffic from flowing to the approp | | so leverage the AiTM position to attempt to monitor and/or m |
| riate destination, potentially to [Impair Defenses](https:// | | odify traffic, such as in [Transmitted Data Manipulation](ht |
| attack.mitre.org/techniques/T1562) and/or in support of a [N | | tps://attack.mitre.org/techniques/T1565/002). Adversaries ca |
| etwork Denial of Service](https://attack.mitre.org/technique | | n setup a position similar to AiTM to prevent traffic from f |
| s/T1498). | | lowing to the appropriate destination, potentially to [Impai |
| | | r Defenses](https://attack.mitre.org/techniques/T1562) and/o |
| | | r in support of a [Network Denial of Service](https://attack |
| | | .mitre.org/techniques/T1498). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-27 20:27:50.792000+00:00 | 2024-04-18 14:26:21.852000+00:00 |
| description | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)
For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)
Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). | Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)
For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials, including access tokens ([Steal Application Access Token](https://attack.mitre.org/techniques/T1528)) and session cookies ([Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)).(Citation: volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)
Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498). |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Token tactics', 'description': 'Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023.', 'url': 'https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/'} |
[T1059.002] Command and Scripting Interpreter: AppleScript
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-19 15:37:28.071000+00:00 | 2024-03-01 19:06:05.126000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[T1550.001] Use Alternate Authentication Material: Application Access Token
Current version: 1.6
Version changed from: 1.5 → 1.6
New Mitigations:
- M1013: Application Developer Guidance
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-19 21:24:45.231000+00:00 | 2024-04-12 21:18:28.848000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Blake Strom, Microsoft Threat Intelligence |
[T1071] Application Layer Protocol
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may communicate using OSI application layer prot | t | Adversaries may communicate using OSI application layer prot |
| ocols to avoid detection/network filtering by blending in wi | | ocols to avoid detection/network filtering by blending in wi |
| th existing traffic. Commands to the remote system, and ofte | | th existing traffic. Commands to the remote system, and ofte |
| n the results of those commands, will be embedded within the | | n the results of those commands, will be embedded within the |
| protocol traffic between the client and server. Adversari | | protocol traffic between the client and server. Adversari |
| es may utilize many different protocols, including those use | | es may utilize many different protocols, including those use |
| d for web browsing, transferring files, electronic mail, or | | d for web browsing, transferring files, electronic mail, or |
| DNS. For connections that occur internally within an enclave | | DNS. For connections that occur internally within an enclave |
| (such as those between a proxy or pivot node and other node | | (such as those between a proxy or pivot node and other node |
| s), commonly used protocols are SMB, SSH, or RDP. | | s), commonly used protocols are SMB, SSH, or RDP.(Citation: |
| | | Mandiant APT29 Eye Spy Email Nov 22) |
New Mitigations:
- M1037: Filter Network Traffic
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 14:35:41.468000+00:00 | 2024-01-17 22:52:23.454000+00:00 |
| description | Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP. | Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Mandiant APT29 Eye Spy Email Nov 22', 'description': 'Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.', 'url': 'https://www.mandiant.com/resources/blog/unc3524-eye-spy-email'} |
| x_mitre_platforms | | Network |
[T1573.002] Encrypted Channel: Asymmetric Cryptography
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 19:27:46.484000+00:00 | 2023-12-26 20:59:21.941000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1053.002] Scheduled Task/Job: At
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 21:13:52.767000+00:00 | 2023-11-15 14:38:10.876000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.1 | 2.2 |
[T1119] Automated Collection
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Once established within a system or network, an adversary ma | t | Once established within a system or network, an adversary ma |
| y use automated techniques for collecting internal data. Met | | y use automated techniques for collecting internal data. Met |
| hods for performing this technique could include use of a [C | | hods for performing this technique could include use of a [C |
| ommand and Scripting Interpreter](https://attack.mitre.org/t | | ommand and Scripting Interpreter](https://attack.mitre.org/t |
| echniques/T1059) to search for and copy information fitting | | echniques/T1059) to search for and copy information fitting |
| set criteria such as file type, location, or name at specifi | | set criteria such as file type, location, or name at specifi |
| c time intervals. In cloud-based environments, adversaries m | | c time intervals. In cloud-based environments, adversaries |
| ay also use cloud APIs, command line interfaces, or extract, | | may also use cloud APIs, data pipelines, command line inter |
| transform, and load (ETL) services to automatically collect | | faces, or extract, transform, and load (ETL) services to aut |
| data. This functionality could also be built into remote ac | | omatically collect data.(Citation: Mandiant UNC3944 SMS Phis |
| cess tools. This technique may incorporate use of other te | | hing 2023) This functionality could also be built into rem |
| chniques such as [File and Directory Discovery](https://atta | | ote access tools. This technique may incorporate use of ot |
| ck.mitre.org/techniques/T1083) and [Lateral Tool Transfer](h | | her techniques such as [File and Directory Discovery](https: |
| ttps://attack.mitre.org/techniques/T1570) to identify and mo | | //attack.mitre.org/techniques/T1083) and [Lateral Tool Trans |
| ve files, as well as [Cloud Service Dashboard](https://attac | | fer](https://attack.mitre.org/techniques/T1570) to identify |
| k.mitre.org/techniques/T1538) and [Cloud Storage Object Disc | | and move files, as well as [Cloud Service Dashboard](https:/ |
| overy](https://attack.mitre.org/techniques/T1619) to identif | | /attack.mitre.org/techniques/T1538) and [Cloud Storage Objec |
| y resources in cloud environments. | | t Discovery](https://attack.mitre.org/techniques/T1619) to i |
| | | dentify resources in cloud environments. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-11 18:40:24.795000+00:00 | 2024-01-02 13:35:57.680000+00:00 |
| description | Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data. This functionality could also be built into remote access tools.
This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments. | Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023)
This functionality could also be built into remote access tools.
This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments. |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Mandiant UNC3944 SMS Phishing 2023', 'description': 'Mandiant Intelligence. (2023, September 14). Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety. Retrieved January 2, 2024.', 'url': 'https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware'} |
[T1547] Boot or Logon Autostart Execution
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:42.099000+00:00 | 2024-04-16 12:26:07.945000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1037] Boot or Logon Initialization Scripts
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may use scripts automatically executed at boot o | t | Adversaries may use scripts automatically executed at boot o |
| r logon initialization to establish persistence. Initializat | | r logon initialization to establish persistence.(Citation: M |
| ion scripts can be used to perform administrative functions, | | andiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke |
| which may often execute other programs or send information | | March 2019) Initialization scripts can be used to perform ad |
| to an internal logging server. These scripts can vary based | | ministrative functions, which may often execute other progra |
| on operating system and whether applied locally or remotely. | | ms or send information to an internal logging server. These |
| Adversaries may use these scripts to maintain persistenc | | scripts can vary based on operating system and whether appli |
| e on a single system. Depending on the access configuration | | ed locally or remotely. Adversaries may use these scripts |
| of the logon scripts, either local credentials or an adminis | | to maintain persistence on a single system. Depending on th |
| trator account may be necessary. An adversary may also be | | e access configuration of the logon scripts, either local cr |
| able to escalate their privileges since some boot or logon i | | edentials or an administrator account may be necessary. An |
| nitialization scripts run with higher privileges. | | adversary may also be able to escalate their privileges sin |
| | | ce some boot or logon initialization scripts run with higher |
| | | privileges. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 20:54:55.991000+00:00 | 2024-04-16 12:23:13.621000+00:00 |
| description | Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. | Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely.
Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Anomali Rocke March 2019', 'description': 'Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.', 'url': 'https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang'} |
| external_references | | {'source_name': 'Mandiant APT29 Eye Spy Email Nov 22', 'description': 'Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.', 'url': 'https://www.mandiant.com/resources/blog/unc3524-eye-spy-email'} |
| x_mitre_platforms | | Network |
[T1176] Browser Extensions
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may abuse Internet browser extensions to establi | t | Adversaries may abuse Internet browser extensions to establi |
| sh persistent access to victim systems. Browser extensions o | | sh persistent access to victim systems. Browser extensions o |
| r plugins are small programs that can add functionality and | | r plugins are small programs that can add functionality and |
| customize aspects of Internet browsers. They can be installe | | customize aspects of Internet browsers. They can be installe |
| d directly or through a browser's app store and generally ha | | d directly or through a browser's app store and generally ha |
| ve access and permissions to everything that the browser can | | ve access and permissions to everything that the browser can |
| access.(Citation: Wikipedia Browser Extension)(Citation: Ch | | access.(Citation: Wikipedia Browser Extension)(Citation: Ch |
| rome Extensions Definition) Malicious extensions can be ins | | rome Extensions Definition) Malicious extensions can be ins |
| talled into a browser through malicious app store downloads | | talled into a browser through malicious app store downloads |
| masquerading as legitimate extensions, through social engine | | masquerading as legitimate extensions, through social engine |
| ering, or by an adversary that has already compromised a sys | | ering, or by an adversary that has already compromised a sys |
| tem. Security can be limited on browser app stores so it may | | tem. Security can be limited on browser app stores so it may |
| not be difficult for malicious extensions to defeat automat | | not be difficult for malicious extensions to defeat automat |
| ed scanners.(Citation: Malicious Chrome Extension Numbers) D | | ed scanners.(Citation: Malicious Chrome Extension Numbers) D |
| epending on the browser, adversaries may also manipulate an | | epending on the browser, adversaries may also manipulate an |
| extension's update url to install updates from an adversary | | extension's update url to install updates from an adversary |
| controlled server or manipulate the mobile configuration fil | | controlled server or manipulate the mobile configuration fil |
| e to silently install additional extensions. Previous to ma | | e to silently install additional extensions. Previous to ma |
| cOS 11, adversaries could silently install browser extension | | cOS 11, adversaries could silently install browser extension |
| s via the command line using the <code>profiles</code> tool | | s via the command line using the <code>profiles</code> tool |
| to install malicious <code>.mobileconfig</code> files. In ma | | to install malicious <code>.mobileconfig</code> files. In ma |
| cOS 11+, the use of the <code>profiles</code> tool can no lo | | cOS 11+, the use of the <code>profiles</code> tool can no lo |
| nger install configuration profiles, however <code>.mobileco | | nger install configuration profiles, however <code>.mobileco |
| nfig</code> files can be planted and installed with user int | | nfig</code> files can be planted and installed with user int |
| eraction.(Citation: xorrior chrome extensions macOS) Once t | | eraction.(Citation: xorrior chrome extensions macOS) Once t |
| he extension is installed, it can browse to websites in the | | he extension is installed, it can browse to websites in the |
| background, steal all information that a user enters into a | | background, steal all information that a user enters into a |
| browser (including credentials), and be used as an installer | | browser (including credentials), and be used as an installer |
| for a RAT for persistence.(Citation: Chrome Extension Crypt | | for a RAT for persistence.(Citation: Chrome Extension Crypt |
| o Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banke | | o Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banke |
| r Google Chrome Extension Steals Creds)(Citation: Catch All | | r Google Chrome Extension Steals Creds)(Citation: Catch All |
| Chrome Extension) There have also been instances of botnets | | Chrome Extension) There have also been instances of botnets |
| using a persistent backdoor through malicious Chrome extens | | using a persistent backdoor through malicious Chrome extens |
| ions.(Citation: Stantinko Botnet) There have also been simil | | ions for [Command and Control](https://attack.mitre.org/tact |
| ar examples of extensions being used for command & control.( | | ics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Ex |
| Citation: Chrome Extension C2 Malware) | | tension C2 Malware) Adversaries may also use browser extensi |
| | | ons to modify browser permissions and components, privacy se |
| | | ttings, and other security controls for [Defense Evasion](ht |
| | | tps://attack.mitre.org/tactics/TA0005).(Citation: Browers Fr |
| | | iarFox)(Citation: Browser Adrozek) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 16:46:36.707000+00:00 | 2024-04-18 23:22:37.874000+00:00 |
| description | Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.
Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)
Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware) | Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.
Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)
Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Browser Adrozek', 'description': 'Microsoft Threat Intelligence. (2020, December 10). Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers. Retrieved February 26, 2024.', 'url': 'https://www.microsoft.com/en-us/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/'} |
| external_references | | {'source_name': 'Browers FriarFox', 'description': 'Raggi, Michael. Proofpoint Threat Research Team. (2021, February 25). TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations. Retrieved February 26, 2024.', 'url': 'https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global'} |
| x_mitre_contributors | | Manikantan Srinivasan, NEC Corporation India |
[T1003.005] OS Credential Dumping: Cached Domain Credentials
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may attempt to access cached domain credentials | t | Adversaries may attempt to access cached domain credentials |
| used to allow authentication to occur in the event a domain | | used to allow authentication to occur in the event a domain |
| controller is unavailable.(Citation: Microsoft - Cached Cred | | controller is unavailable.(Citation: Microsoft - Cached Cred |
| s) On Windows Vista and newer, the hash format is DCC2 (Dom | | s) On Windows Vista and newer, the hash format is DCC2 (Dom |
| ain Cached Credentials version 2) hash, also known as MS-Cac | | ain Cached Credentials version 2) hash, also known as MS-Cac |
| he v2 hash.(Citation: PassLib mscache) The number of default | | he v2 hash.(Citation: PassLib mscache) The number of default |
| cached credentials varies and can be altered per system. Th | | cached credentials varies and can be altered per system. Th |
| is hash does not allow pass-the-hash style attacks, and inst | | is hash does not allow pass-the-hash style attacks, and inst |
| ead requires [Password Cracking](https://attack.mitre.org/te | | ead requires [Password Cracking](https://attack.mitre.org/te |
| chniques/T1110/002) to recover the plaintext password.(Citat | | chniques/T1110/002) to recover the plaintext password.(Citat |
| ion: ired mscache) With SYSTEM access, the tools/utilities | | ion: ired mscache) On Linux systems, Active Directory crede |
| such as [Mimikatz](https://attack.mitre.org/software/S0002), | | ntials can be accessed through caches maintained by software |
| [Reg](https://attack.mitre.org/software/S0075), and secrets | | like System Security Services Daemon (SSSD) or Quest Authen |
| dump.py can be used to extract the cached credentials. Note | | tication Services (formerly VAS). Cached credential hashes a |
| : Cached credentials for Windows Vista are derived using PBK | | re typically located at `/var/lib/sss/db/cache.[domain].ldb` |
| DF2.(Citation: PassLib mscache) | | for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for |
| | | Quest. Adversaries can use utilities, such as `tdbdump`, on |
| | | these database files to dump the cached hashes and use [Pas |
| | | sword Cracking](https://attack.mitre.org/techniques/T1110/00 |
| | | 2) to obtain the plaintext password.(Citation: Brining MimiK |
| | | atz to Unix) With SYSTEM or sudo access, the tools/utiliti |
| | | es such as [Mimikatz](https://attack.mitre.org/software/S000 |
| | | 2), [Reg](https://attack.mitre.org/software/S0075), and secr |
| | | etsdump.py for Windows or Linikatz for Linux can be used to |
| | | extract the cached credentials.(Citation: Brining MimiKatz t |
| | | o Unix) Note: Cached credentials for Windows Vista are deri |
| | | ved using PBKDF2.(Citation: PassLib mscache) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-19 18:37:57.025000+00:00 | 2024-04-18 23:47:54.553000+00:00 |
| description | Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)
On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)
With SYSTEM access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py can be used to extract the cached credentials.
Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache) | Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)
On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache)
On Linux systems, Active Directory credentials can be accessed through caches maintained by software like System Security Services Daemon (SSSD) or Quest Authentication Services (formerly VAS). Cached credential hashes are typically located at `/var/lib/sss/db/cache.[domain].ldb` for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for Quest. Adversaries can use utilities, such as `tdbdump`, on these database files to dump the cached hashes and use [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to obtain the plaintext password.(Citation: Brining MimiKatz to Unix)
With SYSTEM or sudo access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py for Windows or Linikatz for Linux can be used to extract the cached credentials.(Citation: Brining MimiKatz to Unix)
Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Brining MimiKatz to Unix', 'description': 'Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.', 'url': 'https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf'} |
| x_mitre_contributors | | Tim (Wadhwa-)Brown |
| x_mitre_contributors | | Yves Yonan |
| x_mitre_platforms | | Linux |
[T1070.003] Indicator Removal: Clear Command History
Current version: 1.5
Version changed from: 1.4 → 1.5
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-07 17:20:44.770000+00:00 | 2024-02-14 20:07:44.756000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
[T1070.001] Indicator Removal: Clear Windows Event Logs
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may clear Windows Event Logs to hide the activit | t | Adversaries may clear Windows Event Logs to hide the activit |
| y of an intrusion. Windows Event Logs are a record of a comp | | y of an intrusion. Windows Event Logs are a record of a comp |
| uter's alerts and notifications. There are three system-defi | | uter's alerts and notifications. There are three system-defi |
| ned sources of events: System, Application, and Security, wi | | ned sources of events: System, Application, and Security, wi |
| th five event types: Error, Warning, Information, Success Au | | th five event types: Error, Warning, Information, Success Au |
| dit, and Failure Audit. The event logs can be cleared with | | dit, and Failure Audit. With administrator privileges, the |
| the following utility commands: * <code>wevtutil cl system< | | event logs can be cleared with the following utility comman |
| /code> * <code>wevtutil cl application</code> * <code>wevtut | | ds: * <code>wevtutil cl system</code> * <code>wevtutil cl a |
| il cl security</code> These logs may also be cleared throug | | pplication</code> * <code>wevtutil cl security</code> These |
| h other mechanisms, such as the event viewer GUI or [PowerSh | | logs may also be cleared through other mechanisms, such as |
| ell](https://attack.mitre.org/techniques/T1059/001). For exa | | the event viewer GUI or [PowerShell](https://attack.mitre.or |
| mple, adversaries may use the PowerShell command <code>Remov | | g/techniques/T1059/001). For example, adversaries may use th |
| e-EventLog -LogName Security</code> to delete the Security E | | e PowerShell command <code>Remove-EventLog -LogName Security |
| ventLog and after reboot, disable future logging. Note: even | | </code> to delete the Security EventLog and after reboot, di |
| ts may still be generated and logged in the .evtx file betwe | | sable future logging. Note: events may still be generated a |
| en the time the command is run and the reboot.(Citation: dis | | nd logged in the .evtx file between the time the command is |
| able_win_evt_logging) | | run and the reboot.(Citation: disable_win_evt_logging) Adve |
| | | rsaries may also attempt to clear logs by directly deleting |
| | | the stored log files within `C:\Windows\System32\winevt\logs |
| | | \`. |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_system_requirements | ['Clearing the Windows event logs requires Administrator permissions'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 21:43:04.568000+00:00 | 2024-04-16 12:40:58.536000+00:00 |
| description | Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
The event logs can be cleared with the following utility commands:
* wevtutil cl system
* wevtutil cl application
* wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) | Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
With administrator privileges, the event logs can be cleared with the following utility commands:
* wevtutil cl system
* wevtutil cl application
* wevtutil cl security
These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)
Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
[T1136.003] Create Account: Cloud Account
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may create a cloud account to maintain access to | t | Adversaries may create a cloud account to maintain access to |
| victim systems. With a sufficient level of access, such acc | | victim systems. With a sufficient level of access, such acc |
| ounts may be used to establish secondary credentialed access | | ounts may be used to establish secondary credentialed access |
| that does not require persistent remote access tools to be | | that does not require persistent remote access tools to be |
| deployed on the system.(Citation: Microsoft O365 Admin Roles | | deployed on the system.(Citation: Microsoft O365 Admin Roles |
| )(Citation: Microsoft Support O365 Add Another Admin, Octobe | | )(Citation: Microsoft Support O365 Add Another Admin, Octobe |
| r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create | | r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create |
| Cloud Identity Users)(Citation: Microsoft Azure AD Users) A | | Cloud Identity Users)(Citation: Microsoft Azure AD Users) I |
| dversaries may create accounts that only have access to spec | | n addition to user accounts, cloud accounts may be associate |
| ific cloud services, which can reduce the chance of detectio | | d with services. Cloud providers handle the concept of servi |
| n. Once an adversary has created a cloud account, they can | | ce accounts in different ways. In Azure, service accounts in |
| then manipulate that account to ensure persistence and allow | | clude service principals and managed identities, which can b |
| access to additional resources - for example, by adding [Ad | | e linked to various resources such as OAuth applications, se |
| ditional Cloud Credentials](https://attack.mitre.org/techniq | | rverless functions, and virtual machines in order to grant t |
| ues/T1098/001) or assigning [Additional Cloud Roles](https:/ | | hose resources permissions to perform various activities in |
| /attack.mitre.org/techniques/T1098/003). | | the environment.(Citation: Microsoft Entra ID Service Princi |
| | | pals) In GCP, service accounts can also be linked to specifi |
| | | c resources, as well as be impersonated by other accounts fo |
| | | r [Temporary Elevated Cloud Access](https://attack.mitre.org |
| | | /techniques/T1548/005).(Citation: GCP Service Accounts) Whil |
| | | e AWS has no specific concept of service accounts, resources |
| | | can be directly granted permission to assume roles.(Citatio |
| | | n: AWS Instance Profiles)(Citation: AWS Lambda Execution Rol |
| | | e) Adversaries may create accounts that only have access to |
| | | specific cloud services, which can reduce the chance of det |
| | | ection. Once an adversary has created a cloud account, they |
| | | can then manipulate that account to ensure persistence and |
| | | allow access to additional resources - for example, by addin |
| | | g [Additional Cloud Credentials](https://attack.mitre.org/te |
| | | chniques/T1098/001) or assigning [Additional Cloud Roles](ht |
| | | tps://attack.mitre.org/techniques/T1098/003). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 17:34:42.544000+00:00 | 2024-03-28 16:14:28.678000+00:00 |
| description | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003). | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
In addition to user accounts, cloud accounts may be associated with services. Cloud providers handle the concept of service accounts in different ways. In Azure, service accounts include service principals and managed identities, which can be linked to various resources such as OAuth applications, serverless functions, and virtual machines in order to grant those resources permissions to perform various activities in the environment.(Citation: Microsoft Entra ID Service Principals) In GCP, service accounts can also be linked to specific resources, as well as be impersonated by other accounts for [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005).(Citation: GCP Service Accounts) While AWS has no specific concept of service accounts, resources can be directly granted permission to assume roles.(Citation: AWS Instance Profiles)(Citation: AWS Lambda Execution Role)
Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.
Once an adversary has created a cloud account, they can then manipulate that account to ensure persistence and allow access to additional resources - for example, by adding [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) or assigning [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003). |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'AWS Lambda Execution Role', 'description': 'AWS. (n.d.). Lambda execution role. Retrieved February 28, 2024.', 'url': 'https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html'} |
| external_references | | {'source_name': 'AWS Instance Profiles', 'description': 'AWS. (n.d.). Using instance profiles. Retrieved February 28, 2024.', 'url': 'https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html'} |
| external_references | | {'source_name': 'GCP Service Accounts', 'description': 'Google. (n.d.). Service Accounts Overview. Retrieved February 28, 2024.', 'url': 'https://cloud.google.com/iam/docs/service-account-overview'} |
| external_references | | {'source_name': 'Microsoft Entra ID Service Principals', 'description': 'Microsoft. (2023, December 15). Application and service principal objects in Microsoft Entra ID. Retrieved February 28, 2024.', 'url': 'https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals?tabs=browser'} |
[T1078.004] Valid Accounts: Cloud Accounts
Current version: 1.7
Version changed from: 1.6 → 1.7
|
|
|---|
| t | Valid accounts in cloud environments may allow adversaries t | t | Valid accounts in cloud environments may allow adversaries t |
| o perform actions to achieve Initial Access, Persistence, Pr | | o perform actions to achieve Initial Access, Persistence, Pr |
| ivilege Escalation, or Defense Evasion. Cloud accounts are t | | ivilege Escalation, or Defense Evasion. Cloud accounts are t |
| hose created and configured by an organization for use by us | | hose created and configured by an organization for use by us |
| ers, remote support, services, or for administration of reso | | ers, remote support, services, or for administration of reso |
| urces within a cloud service provider or SaaS application. C | | urces within a cloud service provider or SaaS application. C |
| loud Accounts can exist solely in the cloud or be hybrid joi | | loud Accounts can exist solely in the cloud; alternatively, |
| ned between on-premises systems and the cloud through federa | | they may be hybrid-joined between on-premises systems and th |
| tion with other identity sources such as Windows Active Dire | | e cloud through syncing or federation with other identity so |
| ctory. (Citation: AWS Identity Federation)(Citation: Google | | urces such as Windows Active Directory. (Citation: AWS Ident |
| Federating GC)(Citation: Microsoft Deploying AD Federation) | | ity Federation)(Citation: Google Federating GC)(Citation: Mi |
| Service or user accounts may be targeted by adversaries thr | | crosoft Deploying AD Federation) Service or user accounts m |
| ough [Brute Force](https://attack.mitre.org/techniques/T1110 | | ay be targeted by adversaries through [Brute Force](https:// |
| ), [Phishing](https://attack.mitre.org/techniques/T1566), or | | attack.mitre.org/techniques/T1110), [Phishing](https://attac |
| various other means to gain access to the environment. Fede | | k.mitre.org/techniques/T1566), or various other means to gai |
| rated accounts may be a pathway for the adversary to affect | | n access to the environment. Federated or synced accounts ma |
| both on-premises systems and cloud environments. An adversa | | y be a pathway for the adversary to affect both on-premises |
| ry may create long lasting [Additional Cloud Credentials](ht | | systems and cloud environments - for example, by leveraging |
| tps://attack.mitre.org/techniques/T1098/001) on a compromise | | shared credentials to log onto [Remote Services](https://att |
| d cloud account to maintain persistence in the environment. | | ack.mitre.org/techniques/T1021). High privileged cloud accou |
| Such credentials may also be used to bypass security control | | nts, whether federated, synced, or cloud-only, may also allo |
| s such as multi-factor authentication. Cloud accounts may | | w pivoting to on-premises environments by leveraging SaaS-ba |
| also be able to assume [Temporary Elevated Cloud Access](htt | | sed [Software Deployment Tools](https://attack.mitre.org/tec |
| ps://attack.mitre.org/techniques/T1548/005) or other privile | | hniques/T1072) to run commands on hybrid-joined devices. An |
| ges through various means within the environment. Misconfigu | | adversary may create long lasting [Additional Cloud Credent |
| rations in role assignments or role assumption policies may | | ials](https://attack.mitre.org/techniques/T1098/001) on a co |
| allow an adversary to use these mechanisms to leverage permi | | mpromised cloud account to maintain persistence in the envir |
| ssions outside the intended scope of the account. Such over | | onment. Such credentials may also be used to bypass security |
| privileged accounts may be used to harvest sensitive data fr | | controls such as multi-factor authentication. Cloud accou |
| om online storage accounts and databases through [Cloud API] | | nts may also be able to assume [Temporary Elevated Cloud Acc |
| (https://attack.mitre.org/techniques/T1059/009) or other met | | ess](https://attack.mitre.org/techniques/T1548/005) or other |
| hods. | | privileges through various means within the environment. Mi |
| | | sconfigurations in role assignments or role assumption polic |
| | | ies may allow an adversary to use these mechanisms to levera |
| | | ge permissions outside the intended scope of the account. Su |
| | | ch over privileged accounts may be used to harvest sensitive |
| | | data from online storage accounts and databases through [Cl |
| | | oud API](https://attack.mitre.org/techniques/T1059/009) or o |
| | | ther methods. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 17:25:38.546000+00:00 | 2024-03-29 15:42:13.499000+00:00 |
| description | Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud or be hybrid joined between on-premises systems and the cloud through federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)
Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments.
An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.
Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through [Cloud API](https://attack.mitre.org/techniques/T1059/009) or other methods.
| Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)
Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto [Remote Services](https://attack.mitre.org/techniques/T1021). High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) to run commands on hybrid-joined devices.
An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication.
Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through [Cloud API](https://attack.mitre.org/techniques/T1059/009) or other methods.
|
| x_mitre_version | 1.6 | 1.7 |
[T1538] Cloud Service Dashboard
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:51:02.852000+00:00 | 2024-04-19 04:25:33.300000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Obsidian Security |
| x_mitre_platforms | | SaaS |
[T1584] Compromise Infrastructure
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may compromise third-party infrastructure that c | t | Adversaries may compromise third-party infrastructure that c |
| an be used during targeting. Infrastructure solutions includ | | an be used during targeting. Infrastructure solutions includ |
| e physical or cloud servers, domains, and third-party web an | | e physical or cloud servers, domains, network devices, and t |
| d DNS services. Instead of buying, leasing, or renting infra | | hird-party web and DNS services. Instead of buying, leasing, |
| structure an adversary may compromise infrastructure and use | | or renting infrastructure an adversary may compromise infra |
| it during other phases of the adversary lifecycle.(Citation | | structure and use it during other phases of the adversary li |
| : Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio | | fecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameH |
| n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens | | ijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: Fir |
| Part 2) Additionally, adversaries may compromise numerous ma | | eEye EPS Awakens Part 2) Additionally, adversaries may compr |
| chines to form a botnet they can leverage. Use of compromis | | omise numerous machines to form a botnet they can leverage. |
| ed infrastructure allows adversaries to stage, launch, and e | | Use of compromised infrastructure allows adversaries to sta |
| xecute operations. Compromised infrastructure can help adver | | ge, launch, and execute operations. Compromised infrastructu |
| sary operations blend in with traffic that is seen as normal | | re can help adversary operations blend in with traffic that |
| , such as contact with high reputation or trusted sites. For | | is seen as normal, such as contact with high reputation or t |
| example, adversaries may leverage compromised infrastructur | | rusted sites. For example, adversaries may leverage compromi |
| e (potentially also in conjunction with [Digital Certificate | | sed infrastructure (potentially also in conjunction with [Di |
| s](https://attack.mitre.org/techniques/T1588/004)) to furthe | | gital Certificates](https://attack.mitre.org/techniques/T158 |
| r blend in and support staged information gathering and/or [ | | 8/004)) to further blend in and support staged information g |
| Phishing](https://attack.mitre.org/techniques/T1566) campaig | | athering and/or [Phishing](https://attack.mitre.org/techniqu |
| ns.(Citation: FireEye DNS Hijack 2019) Additionally, adversa | | es/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Addi |
| ries may also compromise infrastructure to support [Proxy](h | | tionally, adversaries may also compromise infrastructure to |
| ttps://attack.mitre.org/techniques/T1090) and/or proxyware s | | support [Proxy](https://attack.mitre.org/techniques/T1090) a |
| ervices.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Pro | | nd/or proxyware services.(Citation: amnesty_nso_pegasus)(Cit |
| xyjacking) By using compromised infrastructure, adversaries | | ation: Sysdig Proxyjacking) By using compromised infrastruc |
| may make it difficult to tie their actions back to them. Pr | | ture, adversaries may make it difficult to tie their actions |
| ior to targeting, adversaries may compromise the infrastruct | | back to them. Prior to targeting, adversaries may compromis |
| ure of other adversaries.(Citation: NSA NCSC Turla OilRig) | | e the infrastructure of other adversaries.(Citation: NSA NCS |
| | | C Turla OilRig) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-02 01:10:49.053000+00:00 | 2024-03-28 03:53:28.299000+00:00 |
| description | Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.
Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)
By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) | Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.
Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)
By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig) |
| x_mitre_version | 1.4 | 1.5 |
[T1195.001] Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1013: Application Developer Guidance
- M1033: Limit Software Installation
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-28 16:03:59.172000+00:00 | 2024-04-13 14:47:31.204000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[T1543] Create or Modify System Process
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1026: Privileged Account Management
- M1054: Software Configuration
New Detections:
- DS0032: Container (Container Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 16:52:58.415000+00:00 | 2024-02-15 14:14:03.942000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Container: Container Creation |
| x_mitre_platforms | | Containers |
[T1110.004] Brute Force: Credential Stuffing
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:53:12.789000+00:00 | 2024-03-07 14:28:02.910000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1555] Credentials from Password Stores
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may search for common password storage locations | t | Adversaries may search for common password storage locations |
| to obtain user credentials. Passwords are stored in several | | to obtain user credentials.(Citation: F-Secure The Dukes) P |
| places on a system, depending on the operating system or ap | | asswords are stored in several places on a system, depending |
| plication holding the credentials. There are also specific a | | on the operating system or application holding the credenti |
| pplications and services that store passwords to make them e | | als. There are also specific applications and services that |
| asier for users to manage and maintain, such as password man | | store passwords to make them easier for users to manage and |
| agers and cloud secrets vaults. Once credentials are obtaine | | maintain, such as password managers and cloud secrets vaults |
| d, they can be used to perform lateral movement and access r | | . Once credentials are obtained, they can be used to perform |
| estricted information. | | lateral movement and access restricted information. |
New Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 20:16:41.759000+00:00 | 2024-02-26 14:19:09.417000+00:00 |
| description | Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information. | Adversaries may search for common password storage locations to obtain user credentials.(Citation: F-Secure The Dukes) Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'F-Secure The Dukes', 'description': 'F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.', 'url': 'https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf'} |
[T1574.001] Hijack Execution Flow: DLL Search Order Hijacking
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may execute their own malicious payloads by hija | t | Adversaries may execute their own malicious payloads by hija |
| cking the search order used to load DLLs. Windows systems us | | cking the search order used to load DLLs. Windows systems us |
| e a common method to look for required DLLs to load into a p | | e a common method to look for required DLLs to load into a p |
| rogram. (Citation: Microsoft Dynamic Link Library Search Ord | | rogram. (Citation: Microsoft Dynamic Link Library Search Ord |
| er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa | | er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa |
| ds may be for the purpose of establishing persistence as wel | | ds may be for the purpose of establishing persistence as wel |
| l as elevating privileges and/or evading restrictions on fil | | l as elevating privileges and/or evading restrictions on fil |
| e execution. There are many ways an adversary can hijack DL | | e execution. There are many ways an adversary can hijack DL |
| L loads. Adversaries may plant trojan dynamic-link library f | | L loads. Adversaries may plant trojan dynamic-link library f |
| iles (DLLs) in a directory that will be searched before the | | iles (DLLs) in a directory that will be searched before the |
| location of a legitimate library that will be requested by a | | location of a legitimate library that will be requested by a |
| program, causing Windows to load their malicious library wh | | program, causing Windows to load their malicious library wh |
| en it is called for by the victim program. Adversaries may a | | en it is called for by the victim program. Adversaries may a |
| lso perform DLL preloading, also called binary planting atta | | lso perform DLL preloading, also called binary planting atta |
| cks, (Citation: OWASP Binary Planting) by placing a maliciou | | cks, (Citation: OWASP Binary Planting) by placing a maliciou |
| s DLL with the same name as an ambiguously specified DLL in | | s DLL with the same name as an ambiguously specified DLL in |
| a location that Windows searches before the legitimate DLL. | | a location that Windows searches before the legitimate DLL. |
| Often this location is the current working directory of the | | Often this location is the current working directory of the |
| program.(Citation: FireEye fxsst June 2011) Remote DLL prelo | | program.(Citation: FireEye fxsst June 2011) Remote DLL prelo |
| ading attacks occur when a program sets its current director | | ading attacks occur when a program sets its current director |
| y to a remote location such as a Web share before loading a | | y to a remote location such as a Web share before loading a |
| DLL. (Citation: Microsoft Security Advisory 2269637) Advers | | DLL. (Citation: Microsoft Security Advisory 2269637) Phanto |
| aries may also directly modify the search order via DLL redi | | m DLL hijacking is a specific type of DLL search order hijac |
| rection, which after being enabled (in the Registry and crea | | king where adversaries target references to non-existent DLL |
| tion of a redirection file) may cause a program to load a di | | files.(Citation: Adversaries Hijack DLLs) They may be able |
| fferent DLL.(Citation: Microsoft Dynamic-Link Library Redire | | to load their own malicious DLL by planting it with the corr |
| ction)(Citation: Microsoft Manifests)(Citation: FireEye DLL | | ect name in the location of the missing module. Adversaries |
| Search Order Hijacking) If a search order-vulnerable progra | | may also directly modify the search order via DLL redirecti |
| m is configured to run at a higher privilege level, then the | | on, which after being enabled (in the Registry and creation |
| adversary-controlled DLL that is loaded will also be execut | | of a redirection file) may cause a program to load a differe |
| ed at the higher level. In this case, the technique could be | | nt DLL.(Citation: Microsoft Dynamic-Link Library Redirection |
| used for privilege escalation from user to administrator or | | )(Citation: Microsoft Manifests)(Citation: FireEye DLL Searc |
| SYSTEM or from administrator to SYSTEM, depending on the pr | | h Order Hijacking) If a search order-vulnerable program is |
| ogram. Programs that fall victim to path hijacking may appea | | configured to run at a higher privilege level, then the adve |
| r to behave normally because malicious DLLs may be configure | | rsary-controlled DLL that is loaded will also be executed at |
| d to also load the legitimate DLLs they were meant to replac | | the higher level. In this case, the technique could be used |
| e. | | for privilege escalation from user to administrator or SYST |
| | | EM or from administrator to SYSTEM, depending on the program |
| | | . Programs that fall victim to path hijacking may appear to |
| | | behave normally because malicious DLLs may be configured to |
| | | also load the legitimate DLLs they were meant to replace. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:51.098000+00:00 | 2024-04-18 22:54:54.668000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.
Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Adversaries Hijack DLLs', 'description': 'CrowdStrike, Falcon OverWatch Team. (2022, December 30). Retrieved October 19, 2023.', 'url': 'https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/'} |
| x_mitre_contributors | | Marina Liang |
| x_mitre_contributors | | Will Alexander |
| x_mitre_contributors | | Ami Holeston |
[T1071.004] Application Layer Protocol: DNS
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-06-17 13:52:03.232000+00:00 | 2023-12-26 20:54:38.721000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1213] Data from Information Repositories
Current version: 3.3
Version changed from: 3.2 → 3.3
New Mitigations:
- M1032: Multi-factor Authentication
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-11 22:28:36.395000+00:00 | 2024-03-01 16:27:47.391000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 3.2 | 3.3 |
[T1078.001] Valid Accounts: Default Accounts
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:44.382000+00:00 | 2024-03-07 14:27:04.770000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1610] Deploy Container
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may deploy a container into an environment to fa | t | Adversaries may deploy a container into an environment to fa |
| cilitate execution or evade defenses. In some cases, adversa | | cilitate execution or evade defenses. In some cases, adversa |
| ries may deploy a new container to execute processes associa | | ries may deploy a new container to execute processes associa |
| ted with a particular image or deployment, such as processes | | ted with a particular image or deployment, such as processes |
| that execute or download malware. In others, an adversary m | | that execute or download malware. In others, an adversary m |
| ay deploy a new container configured without network rules, | | ay deploy a new container configured without network rules, |
| user limitations, etc. to bypass existing defenses within th | | user limitations, etc. to bypass existing defenses within th |
| e environment. Containers can be deployed by various means, | | e environment. In Kubernetes environments, an adversary may |
| such as via Docker's <code>create</code> and <code>start</c | | attempt to deploy a privileged or vulnerable container into |
| ode> APIs or via a web application such as the Kubernetes da | | a specific node in order to [Escape to Host](https://attack. |
| shboard or Kubeflow.(Citation: Docker Containers API)(Citati | | mitre.org/techniques/T1611) and access other containers runn |
| on: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adve | | ing on the node. (Citation: AppSecco Kubernetes Namespace Br |
| rsaries may deploy containers based on retrieved or built ma | | eakout 2020) Containers can be deployed by various means, s |
| licious images or from benign images that download and execu | | uch as via Docker's <code>create</code> and <code>start</cod |
| te malicious payloads at runtime.(Citation: Aqua Build Image | | e> APIs or via a web application such as the Kubernetes dash |
| s on Hosts) | | board or Kubeflow. (Citation: Docker Containers API)(Citatio |
| | | n: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Ku |
| | | bernetes environments, containers may be deployed through wo |
| | | rkloads such as ReplicaSets or DaemonSets, which can allow c |
| | | ontainers to be deployed across multiple nodes.(Citation: Ku |
| | | bernetes Workload Management) Adversaries may deploy contain |
| | | ers based on retrieved or built malicious images or from ben |
| | | ign images that download and execute malicious payloads at r |
| | | untime.(Citation: Aqua Build Images on Hosts) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:13:40.232000+00:00 | 2024-04-11 21:24:42.680000+00:00 |
| description | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts) | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'AppSecco Kubernetes Namespace Breakout 2020', 'description': 'Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume — Part 1. Retrieved January 16, 2024.', 'url': 'https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216'} |
| external_references | | {'source_name': 'Kubernetes Workload Management', 'description': 'Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.', 'url': 'https://kubernetes.io/docs/concepts/workloads/controllers/'} |
| x_mitre_contributors | | Joas Antonio dos Santos, @C0d3Cr4zy |
[T1006] Direct Volume Access
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-01 14:19:18.804000+00:00 | 2024-04-16 12:25:24.480000+00:00 |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1562.004] Impair Defenses: Disable or Modify System Firewall
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may disable or modify system firewalls in order | t | Adversaries may disable or modify system firewalls in order |
| to bypass controls limiting network usage. Changes could be | | to bypass controls limiting network usage. Changes could be |
| disabling the entire mechanism as well as adding, deleting, | | disabling the entire mechanism as well as adding, deleting, |
| or modifying particular rules. This can be done numerous way | | or modifying particular rules. This can be done numerous way |
| s depending on the operating system, including via command-l | | s depending on the operating system, including via command-l |
| ine, editing Windows Registry keys, and Windows Control Pane | | ine, editing Windows Registry keys, and Windows Control Pane |
| l. Modifying or disabling a system firewall may enable adve | | l. Modifying or disabling a system firewall may enable adve |
| rsary C2 communications, lateral movement, and/or data exfil | | rsary C2 communications, lateral movement, and/or data exfil |
| tration that would otherwise not be allowed. For example, ad | | tration that would otherwise not be allowed. For example, ad |
| versaries may add a new firewall rule for a well-known proto | | versaries may add a new firewall rule for a well-known proto |
| col (such as RDP) using a non-traditional and potentially le | | col (such as RDP) using a non-traditional and potentially le |
| ss securitized port (i.e. [Non-Standard Port](https://attack | | ss securitized port (i.e. [Non-Standard Port](https://attack |
| .mitre.org/techniques/T1571)).(Citation: change_rdp_port_con | | .mitre.org/techniques/T1571)).(Citation: change_rdp_port_con |
| ti) | | ti) Adversaries may also modify host networking settings th |
| | | at indirectly manipulate system firewalls, such as interface |
| | | bandwidth or network connection request thresholds.(Citatio |
| | | n: Huntress BlackCat) Settings related to enabling abuse of |
| | | various [Remote Services](https://attack.mitre.org/technique |
| | | s/T1021) may also indirectly modify firewall rules. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-02-28 22:34:38.316000+00:00 | 2024-03-28 00:01:08.337000+00:00 |
| description | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti) | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti)
Adversaries may also modify host networking settings that indirectly manipulate system firewalls, such as interface bandwidth or network connection request thresholds.(Citation: Huntress BlackCat) Settings related to enabling abuse of various [Remote Services](https://attack.mitre.org/techniques/T1021) may also indirectly modify firewall rules. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Huntress BlackCat', 'description': 'Carvey, H. (2024, February 28). BlackCat Ransomware Affiliate TTPs. Retrieved March 27, 2024.', 'url': 'https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps'} |
| x_mitre_platforms | | Network |
[T1561.001] Disk Wipe: Disk Content Wipe
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 23:42:59.868000+00:00 | 2024-04-16 13:00:33.303000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1583.001] Acquire Infrastructure: Domains
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may acquire domains that can be used during targ | t | Adversaries may acquire domains that can be used during targ |
| eting. Domain names are the human readable names used to rep | | eting. Domain names are the human readable names used to rep |
| resent one or more IP addresses. They can be purchased or, i | | resent one or more IP addresses. They can be purchased or, i |
| n some cases, acquired for free. Adversaries may use acquir | | n some cases, acquired for free. Adversaries may use acquir |
| ed domains for a variety of purposes, including for [Phishin | | ed domains for a variety of purposes, including for [Phishin |
| g](https://attack.mitre.org/techniques/T1566), [Drive-by Com | | g](https://attack.mitre.org/techniques/T1566), [Drive-by Com |
| promise](https://attack.mitre.org/techniques/T1189), and Com | | promise](https://attack.mitre.org/techniques/T1189), and Com |
| mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m | | mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m |
| ay choose domains that are similar to legitimate domains, in | | ay choose domains that are similar to legitimate domains, in |
| cluding through use of homoglyphs or use of a different top- | | cluding through use of homoglyphs or use of a different top- |
| level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa | | level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa |
| lScam) Typosquatting may be used to aid in delivery of paylo | | lScam) Typosquatting may be used to aid in delivery of paylo |
| ads via [Drive-by Compromise](https://attack.mitre.org/techn | | ads via [Drive-by Compromise](https://attack.mitre.org/techn |
| iques/T1189). Adversaries may also use internationalized dom | | iques/T1189). Adversaries may also use internationalized dom |
| ain names (IDNs) and different character sets (e.g. Cyrillic | | ain names (IDNs) and different character sets (e.g. Cyrillic |
| , Greek, etc.) to execute "IDN homograph attacks," creating | | , Greek, etc.) to execute "IDN homograph attacks," creating |
| visually similar lookalike domains used to deliver malware t | | visually similar lookalike domains used to deliver malware t |
| o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt | | o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt |
| _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht | | _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht |
| track_unhcr)(Citation: lazgroup_idn_phishing) Adversaries m | | track_unhcr)(Citation: lazgroup_idn_phishing) Different URIs |
| ay also acquire and repurpose expired domains, which may be | | /URLs may also be dynamically generated to uniquely serve ma |
| potentially already allowlisted/trusted by defenders based o | | licious content to victims.(Citation: iOS URL Scheme)(Citati |
| n an existing reputation/history.(Citation: Categorisation_n | | on: URI)(Citation: URI Use)(Citation: URI Unique) Adversari |
| ot_boundary)(Citation: Domain_Steal_CC)(Citation: Redirector | | es may also acquire and repurpose expired domains, which may |
| s_Domain_Fronting)(Citation: bypass_webproxy_filtering) Dom | | be potentially already allowlisted/trusted by defenders bas |
| ain registrars each maintain a publicly viewable database th | | ed on an existing reputation/history.(Citation: Categorisati |
| at displays contact information for every registered domain. | | on_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redire |
| Private WHOIS services display alternative information, suc | | ctors_Domain_Fronting)(Citation: bypass_webproxy_filtering) |
| h as their own company data, rather than the owner of the do | | Domain registrars each maintain a publicly viewable databas |
| main. Adversaries may use such private WHOIS services to obs | | e that displays contact information for every registered dom |
| cure information about who owns a purchased domain. Adversar | | ain. Private WHOIS services display alternative information, |
| ies may further interrupt efforts to track their infrastruct | | such as their own company data, rather than the owner of th |
| ure by using varied registration information and purchasing | | e domain. Adversaries may use such private WHOIS services to |
| domains with different domain registrars.(Citation: Mandiant | | obscure information about who owns a purchased domain. Adve |
| APT1) | | rsaries may further interrupt efforts to track their infrast |
| | | ructure by using varied registration information and purchas |
| | | ing domains with different domain registrars.(Citation: Mand |
| | | iant APT1) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:37.379000+00:00 | 2024-04-13 14:03:04.511000+00:00 |
| description | Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) | Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims.(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique)
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'URI Unique', 'description': 'Australian Cyber Security Centre. National Security Agency. (2020, April 21). Detect and Prevent Web Shell Malware. Retrieved February 9, 2024.', 'url': 'https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF'} |
| external_references | | {'source_name': 'URI', 'description': 'Michael Cobb. (2007, October 11). Preparing for uniform resource identifier (URI) exploits. Retrieved February 9, 2024.', 'url': 'https://www.techtarget.com/searchsecurity/tip/Preparing-for-uniform-resource-identifier-URI-exploits'} |
| external_references | | {'source_name': 'URI Use', 'description': 'Nathan McFeters. Billy Kim Rios. Rob Carter.. (2008). URI Use and Abuse. Retrieved February 9, 2024.', 'url': 'https://www.blackhat.com/presentations/bh-dc-08/McFeters-Rios-Carter/Presentation/bh-dc-08-mcfeters-rios-carter.pdf'} |
| external_references | | {'source_name': 'iOS URL Scheme', 'description': 'Ostorlab. (n.d.). iOS URL Scheme Hijacking. Retrieved February 9, 2024.', 'url': 'https://docs.ostorlab.co/kb/IPA_URL_SCHEME_HIJACKING/index.html'} |
| x_mitre_contributors | | Nikola Kovac |
[T1585.002] Establish Accounts: Email Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may create email accounts that can be used durin | t | Adversaries may create email accounts that can be used durin |
| g targeting. Adversaries can use accounts created with email | | g targeting. Adversaries can use accounts created with email |
| providers to further their operations, such as leveraging t | | providers to further their operations, such as leveraging t |
| hem to conduct [Phishing for Information](https://attack.mit | | hem to conduct [Phishing for Information](https://attack.mit |
| re.org/techniques/T1598) or [Phishing](https://attack.mitre. | | re.org/techniques/T1598) or [Phishing](https://attack.mitre. |
| org/techniques/T1566).(Citation: Mandiant APT1) Adversaries | | org/techniques/T1566).(Citation: Mandiant APT1) Establishing |
| may also take steps to cultivate a persona around the email | | email accounts may also allow adversaries to abuse free ser |
| account, such as through use of [Social Media Accounts](http | | vices – such as trial periods – to [Acquire Infrastructure]( |
| s://attack.mitre.org/techniques/T1585/001), to increase the | | https://attack.mitre.org/techniques/T1583) for follow-on pur |
| chance of success of follow-on behaviors. Created email acco | | poses.(Citation: Free Trial PurpleUrchin) Adversaries may a |
| unts can also be used in the acquisition of infrastructure ( | | lso take steps to cultivate a persona around the email accou |
| ex: [Domains](https://attack.mitre.org/techniques/T1583/001) | | nt, such as through use of [Social Media Accounts](https://a |
| ).(Citation: Mandiant APT1) To decrease the chance of physi | | ttack.mitre.org/techniques/T1585/001), to increase the chanc |
| cally tying back operations to themselves, adversaries may m | | e of success of follow-on behaviors. Created email accounts |
| ake use of disposable email services.(Citation: Trend Micro | | can also be used in the acquisition of infrastructure (ex: [ |
| R980 2016) | | Domains](https://attack.mitre.org/techniques/T1583/001)).(Ci |
| | | tation: Mandiant APT1) To decrease the chance of physically |
| | | tying back operations to themselves, adversaries may make u |
| | | se of disposable email services.(Citation: Trend Micro R980 |
| | | 2016) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:09:59.862000+00:00 | 2024-02-28 21:11:27.088000+00:00 |
| description | Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)
To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016) | Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)
Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)
To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Free Trial PurpleUrchin', 'description': 'Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.', 'url': 'https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/'} |
[T1573] Encrypted Channel
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may employ a known encryption algorithm to conce | t | Adversaries may employ an encryption algorithm to conceal co |
| al command and control traffic rather than relying on any in | | mmand and control traffic rather than relying on any inheren |
| herent protections provided by a communication protocol. Des | | t protections provided by a communication protocol. Despite |
| pite the use of a secure algorithm, these implementations ma | | the use of a secure algorithm, these implementations may be |
| y be vulnerable to reverse engineering if secret keys are en | | vulnerable to reverse engineering if secret keys are encoded |
| coded and/or generated within malware samples/configuration | | and/or generated within malware samples/configuration files |
| files. | | . |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 19:27:46.650000+00:00 | 2024-04-16 12:29:47.903000+00:00 |
| description | Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files. | Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1611] Escape to Host
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may break out of a container to gain access to t | t | Adversaries may break out of a container to gain access to t |
| he underlying host. This can allow an adversary access to ot | | he underlying host. This can allow an adversary access to ot |
| her containerized resources from the host level or to the ho | | her containerized resources from the host level or to the ho |
| st itself. In principle, containerized resources should prov | | st itself. In principle, containerized resources should prov |
| ide a clear separation of application functionality and be i | | ide a clear separation of application functionality and be i |
| solated from the host environment.(Citation: Docker Overview | | solated from the host environment.(Citation: Docker Overview |
| ) There are multiple ways an adversary may escape to a host | | ) There are multiple ways an adversary may escape to a host |
| environment. Examples include creating a container configur | | environment. Examples include creating a container configur |
| ed to mount the host’s filesystem using the bind parameter, | | ed to mount the host’s filesystem using the bind parameter, |
| which allows the adversary to drop payloads and execute cont | | which allows the adversary to drop payloads and execute cont |
| rol utilities such as cron on the host; utilizing a privileg | | rol utilities such as cron on the host; utilizing a privileg |
| ed container to run commands or load a malicious kernel modu | | ed container to run commands or load a malicious kernel modu |
| le on the underlying host; or abusing system calls such as ` | | le on the underlying host; or abusing system calls such as ` |
| unshare` and `keyctl` to escalate privileges and steal secre | | unshare` and `keyctl` to escalate privileges and steal secre |
| ts.(Citation: Docker Bind Mounts)(Citation: Trend Micro Priv | | ts.(Citation: Docker Bind Mounts)(Citation: Trend Micro Priv |
| ileged Container)(Citation: Intezer Doki July 20)(Citation: | | ileged Container)(Citation: Intezer Doki July 20)(Citation: |
| Container Escape)(Citation: Crowdstrike Kubernetes Container | | Container Escape)(Citation: Crowdstrike Kubernetes Container |
| Escape)(Citation: Keyctl-unmask) Additionally, an adversar | | Escape)(Citation: Keyctl-unmask) Additionally, an adversar |
| y may be able to exploit a compromised container with a moun | | y may be able to exploit a compromised container with a moun |
| ted container management socket, such as `docker.sock`, to b | | ted container management socket, such as `docker.sock`, to b |
| reak out of the container via a [Container Administration Co | | reak out of the container via a [Container Administration Co |
| mmand](https://attack.mitre.org/techniques/T1609).(Citation: | | mmand](https://attack.mitre.org/techniques/T1609).(Citation: |
| Container Escape) Adversaries may also escape via [Exploita | | Container Escape) Adversaries may also escape via [Exploita |
| tion for Privilege Escalation](https://attack.mitre.org/tech | | tion for Privilege Escalation](https://attack.mitre.org/tech |
| niques/T1068), such as exploiting vulnerabilities in global | | niques/T1068), such as exploiting vulnerabilities in global |
| symbolic links in order to access the root directory of a ho | | symbolic links in order to access the root directory of a ho |
| st machine.(Citation: Windows Server Containers Are Open) G | | st machine.(Citation: Windows Server Containers Are Open) G |
| aining access to the host may provide the adversary with the | | aining access to the host may provide the adversary with the |
| opportunity to achieve follow-on objectives, such as establ | | opportunity to achieve follow-on objectives, such as establ |
| ishing persistence, moving laterally within the environment, | | ishing persistence, moving laterally within the environment, |
| or setting up a command and control channel on the host. | | accessing other containers running on the host, or setting |
| | | up a command and control channel on the host. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:21:04.265000+00:00 | 2024-04-19 12:42:18.632000+00:00 |
| description | Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)
Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host. | Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)
Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)
Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers running on the host, or setting up a command and control channel on the host. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Joas Antonio dos Santos, @C0d3Cr4zy |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics | |
[T1585] Establish Accounts
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may create and cultivate accounts with services | t | Adversaries may create and cultivate accounts with services |
| that can be used during targeting. Adversaries can create ac | | that can be used during targeting. Adversaries can create ac |
| counts that can be used to build a persona to further operat | | counts that can be used to build a persona to further operat |
| ions. Persona development consists of the development of pub | | ions. Persona development consists of the development of pub |
| lic information, presence, history and appropriate affiliati | | lic information, presence, history and appropriate affiliati |
| ons. This development could be applied to social media, webs | | ons. This development could be applied to social media, webs |
| ite, or other publicly available information that could be r | | ite, or other publicly available information that could be r |
| eferenced and scrutinized for legitimacy over the course of | | eferenced and scrutinized for legitimacy over the course of |
| an operation using that persona or identity.(Citation: NEWSC | | an operation using that persona or identity.(Citation: NEWSC |
| ASTER2014)(Citation: BlackHatRobinSage) For operations inco | | ASTER2014)(Citation: BlackHatRobinSage) For operations inco |
| rporating social engineering, the utilization of an online p | | rporating social engineering, the utilization of an online p |
| ersona may be important. These personas may be fictitious or | | ersona may be important. These personas may be fictitious or |
| impersonate real people. The persona may exist on a single | | impersonate real people. The persona may exist on a single |
| site or across multiple sites (ex: Facebook, LinkedIn, Twitt | | site or across multiple sites (ex: Facebook, LinkedIn, Twitt |
| er, Google, GitHub, Docker Hub, etc.). Establishing a person | | er, Google, GitHub, Docker Hub, etc.). Establishing a person |
| a may require development of additional documentation to mak | | a may require development of additional documentation to mak |
| e them seem real. This could include filling out profile inf | | e them seem real. This could include filling out profile inf |
| ormation, developing social networks, or incorporating photo | | ormation, developing social networks, or incorporating photo |
| s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) E | | s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) E |
| stablishing accounts can also include the creation of accoun | | stablishing accounts can also include the creation of accoun |
| ts with email providers, which may be directly leveraged for | | ts with email providers, which may be directly leveraged for |
| [Phishing for Information](https://attack.mitre.org/techniq | | [Phishing for Information](https://attack.mitre.org/techniq |
| ues/T1598) or [Phishing](https://attack.mitre.org/techniques | | ues/T1598) or [Phishing](https://attack.mitre.org/techniques |
| /T1566).(Citation: Mandiant APT1) | | /T1566).(Citation: Mandiant APT1) In addition, establishing |
| | | accounts may allow adversaries to abuse free services, such |
| | | as registering for trial periods to [Acquire Infrastructure] |
| | | (https://attack.mitre.org/techniques/T1583) for malicious pu |
| | | rposes.(Citation: Free Trial PurpleUrchin) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 17:35:59.386000+00:00 | 2024-02-28 21:08:56.520000+00:00 |
| description | Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) | Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) In addition, establishing accounts may allow adversaries to abuse free services, such as registering for trial periods to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for malicious purposes.(Citation: Free Trial PurpleUrchin)
|
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Free Trial PurpleUrchin', 'description': 'Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.', 'url': 'https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/'} |
[T1546] Event Triggered Execution
Current version: 1.3
Version changed from: 1.2 → 1.3
New Mitigations:
- M1026: Privileged Account Management
- M1051: Update Software
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-19 15:44:20.456000+00:00 | 2024-03-01 15:49:15.588000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[T1190] Exploit Public-Facing Application
Current version: 2.5
Version changed from: 2.4 → 2.5
|
|
|---|
| t | Adversaries may attempt to exploit a weakness in an Internet | t | Adversaries may attempt to exploit a weakness in an Internet |
| -facing host or system to initially access a network. The we | | -facing host or system to initially access a network. The we |
| akness in the system can be a software bug, a temporary glit | | akness in the system can be a software bug, a temporary glit |
| ch, or a misconfiguration. Exploited applications are often | | ch, or a misconfiguration. Exploited applications are often |
| websites/web servers, but can also include databases (like | | websites/web servers, but can also include databases (like |
| SQL), standard services (like SMB or SSH), network device ad | | SQL), standard services (like SMB or SSH), network device ad |
| ministration and management protocols (like SNMP and Smart I | | ministration and management protocols (like SNMP and Smart I |
| nstall), and any other system with Internet accessible open | | nstall), and any other system with Internet accessible open |
| sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple | | sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple |
| SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In | | SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In |
| frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic | | frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic |
| e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla | | e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla |
| w being exploited this may also involve [Exploitation for De | | w being exploited this may also involve [Exploitation for De |
| fense Evasion](https://attack.mitre.org/techniques/T1211). | | fense Evasion](https://attack.mitre.org/techniques/T1211) or |
| If an application is hosted on cloud-based infrastructure a | | [Exploitation for Client Execution](https://attack.mitre.or |
| nd/or is containerized, then exploiting it may lead to compr | | g/techniques/T1203). If an application is hosted on cloud-b |
| omise of the underlying instance or container. This can allo | | ased infrastructure and/or is containerized, then exploiting |
| w an adversary a path to access the cloud or container APIs, | | it may lead to compromise of the underlying instance or con |
| exploit container host access via [Escape to Host](https:// | | tainer. This can allow an adversary a path to access the clo |
| attack.mitre.org/techniques/T1611), or take advantage of wea | | ud or container APIs, exploit container host access via [Esc |
| k identity and access management policies. Adversaries may | | ape to Host](https://attack.mitre.org/techniques/T1611), or |
| also exploit edge network infrastructure and related applian | | take advantage of weak identity and access management polici |
| ces, specifically targeting devices that do not support robu | | es. Adversaries may also exploit edge network infrastructur |
| st host-based defenses.(Citation: Mandiant Fortinet Zero Day | | e and related appliances, specifically targeting devices tha |
| )(Citation: Wired Russia Cyberwar) For websites and databas | | t do not support robust host-based defenses.(Citation: Mandi |
| es, the OWASP top 10 and CWE top 25 highlight the most commo | | ant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) For |
| n web-based vulnerabilities.(Citation: OWASP Top 10)(Citatio | | websites and databases, the OWASP top 10 and CWE top 25 hig |
| n: CWE top 25) | | hlight the most common web-based vulnerabilities.(Citation: |
| | | OWASP Top 10)(Citation: CWE top 25) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 22:18:39.190000+00:00 | 2023-11-28 21:27:35.373000+00:00 |
| description | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.4 | 2.5 |
[T1090.002] Proxy: External Proxy
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-27 17:50:37.411000+00:00 | 2024-04-16 12:19:08.953000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1071.002] Application Layer Protocol: File Transfer Protocols
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may communicate using application layer protocol | t | Adversaries may communicate using application layer protocol |
| s associated with transferring files to avoid detection/netw | | s associated with transferring files to avoid detection/netw |
| ork filtering by blending in with existing traffic. Commands | | ork filtering by blending in with existing traffic. Commands |
| to the remote system, and often the results of those comman | | to the remote system, and often the results of those comman |
| ds, will be embedded within the protocol traffic between the | | ds, will be embedded within the protocol traffic between the |
| client and server. Protocols such as SMB, FTP, FTPS, and | | client and server. Protocols such as SMB(Citation: US-CER |
| TFTP that transfer files may be very common in environments. | | T TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, a |
| Packets produced from these protocols may have many fields | | nd TFTP that transfer files may be very common in environmen |
| and headers in which data can be concealed. Data could also | | ts. Packets produced from these protocols may have many fie |
| be concealed within the transferred files. An adversary may | | lds and headers in which data can be concealed. Data could a |
| abuse these protocols to communicate with systems under the | | lso be concealed within the transferred files. An adversary |
| ir control within a victim network while also mimicking norm | | may abuse these protocols to communicate with systems under |
| al, expected traffic. | | their control within a victim network while also mimicking n |
| | | ormal, expected traffic. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-01 02:42:15.473000+00:00 | 2024-01-18 17:23:22.591000+00:00 |
| description | Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. | Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMB(Citation: US-CERT TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ESET Machete July 2019', 'description': 'ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.', 'url': 'https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf'} |
| external_references | | {'source_name': 'US-CERT TA18-074A', 'description': 'US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.', 'url': 'https://www.us-cert.gov/ncas/alerts/TA18-074A'} |
| x_mitre_platforms | | Network |
[T1083] File and Directory Discovery
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may enumerate files and directories or may searc | t | Adversaries may enumerate files and directories or may searc |
| h in specific locations of a host or network share for certa | | h in specific locations of a host or network share for certa |
| in information within a file system. Adversaries may use the | | in information within a file system. Adversaries may use the |
| information from [File and Directory Discovery](https://att | | information from [File and Directory Discovery](https://att |
| ack.mitre.org/techniques/T1083) during automated discovery t | | ack.mitre.org/techniques/T1083) during automated discovery t |
| o shape follow-on behaviors, including whether or not the ad | | o shape follow-on behaviors, including whether or not the ad |
| versary fully infects the target and/or attempts specific ac | | versary fully infects the target and/or attempts specific ac |
| tions. Many command shell utilities can be used to obtain t | | tions. Many command shell utilities can be used to obtain t |
| his information. Examples include <code>dir</code>, <code>tr | | his information. Examples include <code>dir</code>, <code>tr |
| ee</code>, <code>ls</code>, <code>find</code>, and <code>loc | | ee</code>, <code>ls</code>, <code>find</code>, and <code>loc |
| ate</code>.(Citation: Windows Commands JPCERT) Custom tools | | ate</code>.(Citation: Windows Commands JPCERT) Custom tools |
| may also be used to gather file and directory information an | | may also be used to gather file and directory information an |
| d interact with the [Native API](https://attack.mitre.org/te | | d interact with the [Native API](https://attack.mitre.org/te |
| chniques/T1106). Adversaries may also leverage a [Network De | | chniques/T1106). Adversaries may also leverage a [Network De |
| vice CLI](https://attack.mitre.org/techniques/T1059/008) on | | vice CLI](https://attack.mitre.org/techniques/T1059/008) on |
| network devices to gather file and directory information (e. | | network devices to gather file and directory information (e. |
| g. <code>dir</code>, <code>show flash</code>, and/or <code>n | | g. <code>dir</code>, <code>show flash</code>, and/or <code>n |
| vram</code>).(Citation: US-CERT-TA18-106A) | | vram</code>).(Citation: US-CERT-TA18-106A) Some files and d |
| | | irectories may require elevated or specific user permissions |
| | | to access. |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_system_requirements | ['Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:42.631000+00:00 | 2024-04-16 12:40:10.978000+00:00 |
| description | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A) | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)
Some files and directories may require elevated or specific user permissions to access. |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
[T1657] Financial Theft
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may steal monetary resources from targets throug | t | Adversaries may steal monetary resources from targets throug |
| h extortion, social engineering, technical theft, or other m | | h extortion, social engineering, technical theft, or other m |
| ethods aimed at their own financial gain at the expense of t | | ethods aimed at their own financial gain at the expense of t |
| he availability of these resources for victims. Financial th | | he availability of these resources for victims. Financial th |
| eft is the ultimate objective of several popular campaign ty | | eft is the ultimate objective of several popular campaign ty |
| pes including extortion by ransomware,(Citation: FBI-ransomw | | pes including extortion by ransomware,(Citation: FBI-ransomw |
| are) business email compromise (BEC) and fraud,(Citation: FB | | are) business email compromise (BEC) and fraud,(Citation: FB |
| I-BEC) "pig butchering,"(Citation: wired-pig butchering) ban | | I-BEC) "pig butchering,"(Citation: wired-pig butchering) ban |
| k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu |
| rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com |
| promise Accounts](https://attack.mitre.org/techniques/T1586) | | promise Accounts](https://attack.mitre.org/techniques/T1586) |
| to conduct unauthorized transfers of funds.(Citation: Inter | | to conduct unauthorized transfers of funds.(Citation: Inter |
| net crime report 2022) In the case of business email comprom | | net crime report 2022) In the case of business email comprom |
| ise or email fraud, an adversary may utilize [Impersonation] | | ise or email fraud, an adversary may utilize [Impersonation] |
| (https://attack.mitre.org/techniques/T1656) of a trusted ent | | (https://attack.mitre.org/techniques/T1656) of a trusted ent |
| ity. Once the social engineering is successful, victims can | | ity. Once the social engineering is successful, victims can |
| be deceived into sending money to financial accounts control | | be deceived into sending money to financial accounts control |
| led by an adversary.(Citation: FBI-BEC) This creates the pot | | led by an adversary.(Citation: FBI-BEC) This creates the pot |
| ential for multiple victims (i.e., compromised accounts as w | | ential for multiple victims (i.e., compromised accounts as w |
| ell as the ultimate monetary loss) in incidents involving fi | | ell as the ultimate monetary loss) in incidents involving fi |
| nancial theft.(Citation: VEC) Extortion by ransomware may o | | nancial theft.(Citation: VEC) Extortion by ransomware may o |
| ccur, for example, when an adversary demands payment from a | | ccur, for example, when an adversary demands payment from a |
| victim after [Data Encrypted for Impact](https://attack.mitr | | victim after [Data Encrypted for Impact](https://attack.mitr |
| e.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfilt | | e.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfilt |
| ration](https://attack.mitre.org/tactics/TA0010) of data, fo | | ration](https://attack.mitre.org/tactics/TA0010) of data, fo |
| llowed by threatening public exposure unless payment is made | | llowed by threatening to leak sensitive data to the public u |
| to the adversary.(Citation: Mandiant-leaks) Due to the pot | | nless payment is made to the adversary.(Citation: Mandiant-l |
| entially immense business impact of financial theft, an adve | | eaks) Adversaries may use dedicated leak sites to distribute |
| rsary may abuse the possibility of financial theft and seeki | | victim data.(Citation: Crowdstrike-leaks) Due to the poten |
| ng monetary gain to divert attention from their true goals s | | tially immense business impact of financial theft, an advers |
| uch as [Data Destruction](https://attack.mitre.org/technique | | ary may abuse the possibility of financial theft and seeking |
| s/T1485) and business disruption.(Citation: AP-NotPetya) | | monetary gain to divert attention from their true goals suc |
| | | h as [Data Destruction](https://attack.mitre.org/techniques/ |
| | | T1485) and business disruption.(Citation: AP-NotPetya) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 19:54:11.916000+00:00 | 2024-04-11 20:22:14.359000+00:00 |
| description | Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)
Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1656) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC)
Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening public exposure unless payment is made to the adversary.(Citation: Mandiant-leaks)
Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya) | Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)
Adversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1656) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC)
Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary.(Citation: Mandiant-leaks) Adversaries may use dedicated leak sites to distribute victim data.(Citation: Crowdstrike-leaks)
Due to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Crowdstrike-leaks', 'description': 'Crowdstrike. (2020, September 24). Double Trouble: Ransomware with Data Leak Extortion, Part 1. Retrieved December 6, 2023.', 'url': 'https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/'} |
| x_mitre_contributors | | Goldstein Menachem |
[T1056.002] Input Capture: GUI Input Capture
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may mimic common operating system GUI components | t | Adversaries may mimic common operating system GUI components |
| to prompt users for credentials with a seemingly legitimate | | to prompt users for credentials with a seemingly legitimate |
| prompt. When programs are executed that need additional pri | | prompt. When programs are executed that need additional pri |
| vileges than are present in the current user context, it is | | vileges than are present in the current user context, it is |
| common for the operating system to prompt the user for prope | | common for the operating system to prompt the user for prope |
| r credentials to authorize the elevated privileges for the t | | r credentials to authorize the elevated privileges for the t |
| ask (ex: [Bypass User Account Control](https://attack.mitre. | | ask (ex: [Bypass User Account Control](https://attack.mitre. |
| org/techniques/T1548/002)). Adversaries may mimic this func | | org/techniques/T1548/002)). Adversaries may mimic this func |
| tionality to prompt users for credentials with a seemingly l | | tionality to prompt users for credentials with a seemingly l |
| egitimate prompt for a number of reasons that mimic normal u | | egitimate prompt for a number of reasons that mimic normal u |
| sage, such as a fake installer requiring additional access o | | sage, such as a fake installer requiring additional access o |
| r a fake malware removal suite.(Citation: OSX Malware Exploi | | r a fake malware removal suite.(Citation: OSX Malware Exploi |
| ts MacKeeper) This type of prompt can be used to collect cre | | ts MacKeeper) This type of prompt can be used to collect cre |
| dentials via various languages such as [AppleScript](https:/ | | dentials via various languages such as [AppleScript](https:/ |
| /attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm | | /attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm |
| Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citati | | Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citati |
| on: Spoofing credential dialogs) and [PowerShell](https://at | | on: Spoofing credential dialogs) and [PowerShell](https://at |
| tack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do | | tack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do |
| You Trust Oct 2014)(Citation: Enigma Phishing for Credentia | | You Trust Oct 2014)(Citation: Enigma Phishing for Credentia |
| ls Jan 2015)(Citation: Spoofing credential dialogs) On Linux | | ls Jan 2015)(Citation: Spoofing credential dialogs) On Linux |
| systems adversaries may launch dialog boxes prompting users | | systems adversaries may launch dialog boxes prompting users |
| for credentials from malicious shell scripts or the command | | for credentials from malicious shell scripts or the command |
| line (i.e. [Unix Shell](https://attack.mitre.org/techniques | | line (i.e. [Unix Shell](https://attack.mitre.org/techniques |
| /T1059/004)).(Citation: Spoofing credential dialogs) | | /T1059/004)).(Citation: Spoofing credential dialogs) Advers |
| | | aries may also mimic common software authentication requests |
| | | , such as those from browsers or email clients. This may als |
| | | o be paired with user activity monitoring (i.e., [Browser In |
| | | formation Discovery](https://attack.mitre.org/techniques/T12 |
| | | 17) and/or [Application Window Discovery](https://attack.mit |
| | | re.org/techniques/T1010)) to spoof prompts when users are na |
| | | turally accessing sensitive sites/data. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:48.279000+00:00 | 2024-04-15 23:39:31.474000+00:00 |
| description | Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citation: Spoofing credential dialogs) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015)(Citation: Spoofing credential dialogs) On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) | Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citation: Spoofing credential dialogs) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015)(Citation: Spoofing credential dialogs) On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs)
Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., [Browser Information Discovery](https://attack.mitre.org/techniques/T1217) and/or [Application Window Discovery](https://attack.mitre.org/techniques/T1010)) to spoof prompts when users are naturally accessing sensitive sites/data. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[T1589] Gather Victim Identity Information
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may gather information about the victim's identi | t | Adversaries may gather information about the victim's identi |
| ty that can be used during targeting. Information about iden | | ty that can be used during targeting. Information about iden |
| tities may include a variety of details, including personal | | tities may include a variety of details, including personal |
| data (ex: employee names, email addresses, etc.) as well as | | data (ex: employee names, email addresses, security question |
| sensitive details such as credentials. Adversaries may gath | | responses, etc.) as well as sensitive details such as crede |
| er this information in various ways, such as direct elicitat | | ntials or multi-factor authentication (MFA) configurations. |
| ion via [Phishing for Information](https://attack.mitre.org/ | | Adversaries may gather this information in various ways, su |
| techniques/T1598). Information about users could also be enu | | ch as direct elicitation via [Phishing for Information](http |
| merated via other active means (i.e. [Active Scanning](https | | s://attack.mitre.org/techniques/T1598). Information about us |
| ://attack.mitre.org/techniques/T1595)) such as probing and a | | ers could also be enumerated via other active means (i.e. [A |
| nalyzing responses from authentication services that may rev | | ctive Scanning](https://attack.mitre.org/techniques/T1595)) |
| eal valid usernames in a system.(Citation: GrimBlog Username | | such as probing and analyzing responses from authentication |
| Enum) Information about victims may also be exposed to adver | | services that may reveal valid usernames in a system or perm |
| saries via online or other accessible data sets (ex: [Social | | itted MFA /methods associated with those usernames.(Citation |
| Media](https://attack.mitre.org/techniques/T1593/001) or [S | | : GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) |
| earch Victim-Owned Websites](https://attack.mitre.org/techni | | Information about victims may also be exposed to adversarie |
| ques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitt | | s via online or other accessible data sets (ex: [Social Medi |
| e)(Citation: Register Uber)(Citation: Detectify Slack Tokens | | a](https://attack.mitre.org/techniques/T1593/001) or [Search |
| )(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog | | Victim-Owned Websites](https://attack.mitre.org/techniques/ |
| )(Citation: GitHub Gitrob)(Citation: CNET Leaks) Gathering | | T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Ci |
| this information may reveal opportunities for other forms of | | tation: Register Uber)(Citation: Detectify Slack Tokens)(Cit |
| reconnaissance (ex: [Search Open Websites/Domains](https:// | | ation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Cit |
| attack.mitre.org/techniques/T1593) or [Phishing for Informat | | ation: GitHub Gitrob)(Citation: CNET Leaks) Gathering this |
| ion](https://attack.mitre.org/techniques/T1598)), establishi | | information may reveal opportunities for other forms of reco |
| ng operational resources (ex: [Compromise Accounts](https:// | | nnaissance (ex: [Search Open Websites/Domains](https://attac |
| attack.mitre.org/techniques/T1586)), and/or initial access ( | | k.mitre.org/techniques/T1593) or [Phishing for Information]( |
| ex: [Phishing](https://attack.mitre.org/techniques/T1566) or | | https://attack.mitre.org/techniques/T1598)), establishing op |
| [Valid Accounts](https://attack.mitre.org/techniques/T1078) | | erational resources (ex: [Compromise Accounts](https://attac |
| ). | | k.mitre.org/techniques/T1586)), and/or initial access (ex: [ |
| | | Phishing](https://attack.mitre.org/techniques/T1566) or [Val |
| | | id Accounts](https://attack.mitre.org/techniques/T1078)). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-21 14:39:39.857000+00:00 | 2024-04-19 04:27:00.005000+00:00 |
| description | Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.
Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.
Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames.(Citation: GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Obsidian SSPR Abuse 2023', 'description': 'Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.', 'url': 'https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/'} |
| x_mitre_contributors | | Obsidian Security |
[T1564.003] Hide Artifacts: Hidden Window
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use hidden windows to conceal malicious acti | t | Adversaries may use hidden windows to conceal malicious acti |
| vity from the plain sight of users. In some cases, windows t | | vity from the plain sight of users. In some cases, windows t |
| hat would typically be displayed when an application carries | | hat would typically be displayed when an application carries |
| out an operation can be hidden. This may be utilized by sys | | out an operation can be hidden. This may be utilized by sys |
| tem administrators to avoid disrupting user work environment | | tem administrators to avoid disrupting user work environment |
| s when carrying out administrative tasks. On Windows, ther | | s when carrying out administrative tasks. Adversaries may |
| e are a variety of features in scripting languages in Window | | abuse these functionalities to hide otherwise visible window |
| s, such as [PowerShell](https://attack.mitre.org/techniques/ | | s from users so as not to alert the user to adversary activi |
| T1059/001), Jscript, and [Visual Basic](https://attack.mitre | | ty on the system.(Citation: Antiquated Mac Malware) On macO |
| .org/techniques/T1059/005) to make windows hidden. One examp | | S, the configurations for how applications run are listed in |
| le of this is <code>powershell.exe -WindowStyle Hidden</code | | property list (plist) files. One of the tags in these files |
| >. (Citation: PowerShell About 2019) Similarly, on macOS th | | can be <code>apple.awt.UIElement</code>, which allows for J |
| e configurations for how applications run are listed in prop | | ava applications to prevent the application's icon from appe |
| erty list (plist) files. One of the tags in these files can | | aring in the Dock. A common use for this is when application |
| be <code>apple.awt.UIElement</code>, which allows for Java a | | s run in the system tray, but don't also want to show up in |
| pplications to prevent the application's icon from appearing | | the Dock. Similarly, on Windows there are a variety of feat |
| in the Dock. A common use for this is when applications run | | ures in scripting languages, such as [PowerShell](https://at |
| in the system tray, but don't also want to show up in the D | | tack.mitre.org/techniques/T1059/001), Jscript, and [Visual B |
| ock. Adversaries may abuse these functionalities to hide ot | | asic](https://attack.mitre.org/techniques/T1059/005) to make |
| herwise visible windows from users so as not to alert the us | | windows hidden. One example of this is <code>powershell.exe |
| er to adversary activity on the system.(Citation: Antiquated | | -WindowStyle Hidden</code>.(Citation: PowerShell About 2019 |
| Mac Malware) | | ) In addition, Windows supports the `CreateDesktop()` API t |
| | | hat can create a hidden desktop window with its own correspo |
| | | nding <code>explorer.exe</code> process.(Citation: Hidden VN |
| | | C)(Citation: Anatomy of an hVNC Attack) All applications ru |
| | | nning on the hidden desktop window, such as a hidden VNC (hV |
| | | NC) session,(Citation: Hidden VNC) will be invisible to othe |
| | | r desktops windows. |
New Mitigations:
- M1033: Limit Software Installation
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-15 21:09:43.489000+00:00 | 2024-04-13 14:28:20.651000+00:00 |
| description | Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
On Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)
Similarly, on macOS the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.
Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware) | Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)
On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.
Similarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden.(Citation: PowerShell About 2019)
In addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding explorer.exe process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Hidden VNC', 'description': 'Hutchins, Marcus. (2015, September 13). Hidden VNC for Beginners. Retrieved November 28, 2023.', 'url': 'https://www.malwaretech.com/2015/09/hidden-vnc-for-beginners.html'} |
| external_references | | {'source_name': 'Anatomy of an hVNC Attack', 'description': 'Keshet, Lior. Kessem, Limor. (2017, January 25). Anatomy of an hVNC Attack. Retrieved November 28, 2023.', 'url': 'https://securityintelligence.com/anatomy-of-an-hvnc-attack/'} |
| x_mitre_contributors | | Mark Tsipershtein |
[T1564] Hide Artifacts
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1013: Application Developer Guidance
- M1033: Limit Software Installation
- M1049: Antivirus/Antimalware
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 15:59:09.632000+00:00 | 2024-03-29 17:45:48.126000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[T1562.006] Impair Defenses: Indicator Blocking
Current version: 1.4
Version changed from: 1.3 → 1.4
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-18 22:23:55.329000+00:00 | 2024-02-14 21:50:32.531000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
[T1105] Ingress Tool Transfer
Current version: 2.4
Version changed from: 2.3 → 2.4
|
|
|---|
| t | Adversaries may transfer tools or other files from an extern | t | Adversaries may transfer tools or other files from an extern |
| al system into a compromised environment. Tools or files may | | al system into a compromised environment. Tools or files may |
| be copied from an external adversary-controlled system to t | | be copied from an external adversary-controlled system to t |
| he victim network through the command and control channel or | | he victim network through the command and control channel or |
| through alternate protocols such as [ftp](https://attack.mi | | through alternate protocols such as [ftp](https://attack.mi |
| tre.org/software/S0095). Once present, adversaries may also | | tre.org/software/S0095). Once present, adversaries may also |
| transfer/spread tools between victim devices within a compro | | transfer/spread tools between victim devices within a compro |
| mised environment (i.e. [Lateral Tool Transfer](https://atta | | mised environment (i.e. [Lateral Tool Transfer](https://atta |
| ck.mitre.org/techniques/T1570)). On Windows, adversaries m | | ck.mitre.org/techniques/T1570)). On Windows, adversaries m |
| ay use various utilities to download tools, such as `copy`, | | ay use various utilities to download tools, such as `copy`, |
| `finger`, [certutil](https://attack.mitre.org/software/S0160 | | `finger`, [certutil](https://attack.mitre.org/software/S0160 |
| ), and [PowerShell](https://attack.mitre.org/techniques/T105 | | ), and [PowerShell](https://attack.mitre.org/techniques/T105 |
| 9/001) commands such as <code>IEX(New-Object Net.WebClient). | | 9/001) commands such as <code>IEX(New-Object Net.WebClient). |
| downloadString()</code> and <code>Invoke-WebRequest</code>. | | downloadString()</code> and <code>Invoke-WebRequest</code>. |
| On Linux and macOS systems, a variety of utilities also exis | | On Linux and macOS systems, a variety of utilities also exis |
| t, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, | | t, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, |
| and `wget`.(Citation: t1105_lolbas) Adversaries may also a | | and `wget`.(Citation: t1105_lolbas) Adversaries may also a |
| buse installers and package managers, such as `yum` or `wing | | buse installers and package managers, such as `yum` or `wing |
| et`, to download tools to victim hosts. Files can also be t | | et`, to download tools to victim hosts. Adversaries have als |
| ransferred using various [Web Service](https://attack.mitre. | | o abused file application features, such as the Windows `sea |
| org/techniques/T1102)s as well as native or otherwise presen | | rch-ms` protocol handler, to deliver malicious files to vict |
| t tools on the victim system.(Citation: PTSecurity Cobalt De | | ims through remote file searches invoked by [User Execution] |
| c 2016) In some cases, adversaries may be able to leverage s | | (https://attack.mitre.org/techniques/T1204) (typically after |
| ervices that sync between a web-based and an on-premises cli | | interacting with [Phishing](https://attack.mitre.org/techni |
| ent, such as Dropbox or OneDrive, to transfer files onto vic | | ques/T1566) lures).(Citation: T1105: Trellix_search-ms) Fil |
| tim systems. For example, by compromising a cloud account an | | es can also be transferred using various [Web Service](https |
| d logging into the service's web portal, an adversary may be | | ://attack.mitre.org/techniques/T1102)s as well as native or |
| able to trigger an automatic syncing process that transfers | | otherwise present tools on the victim system.(Citation: PTSe |
| the file onto the victim's machine.(Citation: Dropbox Malwa | | curity Cobalt Dec 2016) In some cases, adversaries may be ab |
| re Sync) | | le to leverage services that sync between a web-based and an |
| | | on-premises client, such as Dropbox or OneDrive, to transfe |
| | | r files onto victim systems. For example, by compromising a |
| | | cloud account and logging into the service's web portal, an |
| | | adversary may be able to trigger an automatic syncing proces |
| | | s that transfers the file onto the victim's machine.(Citatio |
| | | n: Dropbox Malware Sync) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 21:27:20.702000+00:00 | 2024-04-11 15:08:01.731000+00:00 |
| description | Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)).
On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)
Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts.
Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync) | Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)).
On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)
Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)
Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync) |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'T1105: Trellix_search-ms', 'description': ' Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the "search-ms" URI Protocol Handler. Retrieved March 15, 2024.', 'url': 'https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/'} |
| x_mitre_contributors | | Joe Wise |
| x_mitre_contributors | | Jeremy Hedges |
| x_mitre_contributors | | Selena Larson, @selenalarson |
| x_mitre_platforms | | Network |
[T1490] Inhibit System Recovery
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may delete or remove built-in data and turn off | t | Adversaries may delete or remove built-in data and turn off |
| services designed to aid in the recovery of a corrupted syst | | services designed to aid in the recovery of a corrupted syst |
| em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 |
| 18)(Citation: FireEye WannaCry 2017) This may deny access to | | 18)(Citation: FireEye WannaCry 2017) This may deny access to |
| available backups and recovery options. Operating systems | | available backups and recovery options. Operating systems |
| may contain features that can help fix corrupted systems, su | | may contain features that can help fix corrupted systems, su |
| ch as a backup catalog, volume shadow copies, and automatic | | ch as a backup catalog, volume shadow copies, and automatic |
| repair features. Adversaries may disable or delete system re | | repair features. Adversaries may disable or delete system re |
| covery features to augment the effects of [Data Destruction] | | covery features to augment the effects of [Data Destruction] |
| (https://attack.mitre.org/techniques/T1485) and [Data Encryp | | (https://attack.mitre.org/techniques/T1485) and [Data Encryp |
| ted for Impact](https://attack.mitre.org/techniques/T1486).( | | ted for Impact](https://attack.mitre.org/techniques/T1486).( |
| Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa |
| nnaCry 2017) Furthermore, adversaries may disable recovery n | | nnaCry 2017) Furthermore, adversaries may disable recovery n |
| otifications, then corrupt backups.(Citation: disable_notif_ | | otifications, then corrupt backups.(Citation: disable_notif_ |
| synology_ransom) A number of native Windows utilities have | | synology_ransom) A number of native Windows utilities have |
| been used by adversaries to disable or delete system recover | | been used by adversaries to disable or delete system recover |
| y features: * <code>vssadmin.exe</code> can be used to dele | | y features: * <code>vssadmin.exe</code> can be used to dele |
| te all volume shadow copies on a system - <code>vssadmin.exe | | te all volume shadow copies on a system - <code>vssadmin.exe |
| delete shadows /all /quiet</code> * [Windows Management Ins | | delete shadows /all /quiet</code> * [Windows Management Ins |
| trumentation](https://attack.mitre.org/techniques/T1047) can | | trumentation](https://attack.mitre.org/techniques/T1047) can |
| be used to delete volume shadow copies - <code>wmic shadowc | | be used to delete volume shadow copies - <code>wmic shadowc |
| opy delete</code> * <code>wbadmin.exe</code> can be used to | | opy delete</code> * <code>wbadmin.exe</code> can be used to |
| delete the Windows Backup Catalog - <code>wbadmin.exe delete | | delete the Windows Backup Catalog - <code>wbadmin.exe delete |
| catalog -quiet</code> * <code>bcdedit.exe</code> can be use | | catalog -quiet</code> * <code>bcdedit.exe</code> can be use |
| d to disable automatic Windows recovery features by modifyin | | d to disable automatic Windows recovery features by modifyin |
| g boot configuration data - <code>bcdedit.exe /set {default} | | g boot configuration data - <code>bcdedit.exe /set {default} |
| bootstatuspolicy ignoreallfailures & bcdedit /set {default} | | bootstatuspolicy ignoreallfailures & bcdedit /set {default} |
| recoveryenabled no</code> * <code>REAgentC.exe</code> can b | | recoveryenabled no</code> * <code>REAgentC.exe</code> can b |
| e used to disable Windows Recovery Environment (WinRE) repai | | e used to disable Windows Recovery Environment (WinRE) repai |
| r/recovery options of an infected system On network devices | | r/recovery options of an infected system * <code>diskshadow. |
| , adversaries may leverage [Disk Wipe](https://attack.mitre. | | exe</code> can be used to delete all volume shadow copies on |
| org/techniques/T1561) to delete backup firmware images and r | | a system - <code>diskshadow delete shadows all</code> (Cita |
| eformat the file system, then [System Shutdown/Reboot](https | | tion: Diskshadow) (Citation: Crytox Ransomware) On network |
| ://attack.mitre.org/techniques/T1529) to reload the device. | | devices, adversaries may leverage [Disk Wipe](https://attack |
| Together this activity may leave network devices completely | | .mitre.org/techniques/T1561) to delete backup firmware image |
| inoperable and inhibit recovery operations. Adversaries may | | s and reformat the file system, then [System Shutdown/Reboot |
| also delete “online” backups that are connected to their ne | | ](https://attack.mitre.org/techniques/T1529) to reload the d |
| twork – whether via network storage media or through folders | | evice. Together this activity may leave network devices comp |
| that sync to cloud services.(Citation: ZDNet Ransomware Bac | | letely inoperable and inhibit recovery operations. Adversar |
| kups 2020) In cloud environments, adversaries may disable ve | | ies may also delete “online” backups that are connected to t |
| rsioning and backup policies and delete snapshots, machine i | | heir network – whether via network storage media or through |
| mages, and prior versions of objects designed to be used in | | folders that sync to cloud services.(Citation: ZDNet Ransomw |
| disaster recovery scenarios.(Citation: Dark Reading Code Spa | | are Backups 2020) In cloud environments, adversaries may dis |
| ces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ranso | | able versioning and backup policies and delete snapshots, ma |
| mware) | | chine images, and prior versions of objects designed to be u |
| | | sed in disaster recovery scenarios.(Citation: Dark Reading C |
| | | ode Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S |
| | | 3 Ransomware) |
New Mitigations:
- M1038: Execution Prevention
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 17:30:59.482000+00:00 | 2024-04-12 02:30:08.379000+00:00 |
| description | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) |
| x_mitre_detection | Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit and REAgentC. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.
Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage).
For network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession. | Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit, REAgentC, and diskshadow. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.
Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage).
For network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession. |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Diskshadow', 'description': 'Microsoft Windows Server. (2023, February 3). Diskshadow. Retrieved November 21, 2023.', 'url': 'https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow'} |
| external_references | | {'source_name': 'Crytox Ransomware', 'description': 'Romain Dumont . (2022, September 21). Technical Analysis of Crytox Ransomware. Retrieved November 22, 2023.', 'url': 'https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware'} |
| x_mitre_contributors | | Harjot Shah Singh |
[T1546.016] Event Triggered Execution: Installer Packages
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may establish persistence and elevate privileges | t | Adversaries may establish persistence and elevate privileges |
| by using an installer to trigger the execution of malicious | | by using an installer to trigger the execution of malicious |
| content. Installer packages are OS specific and contain the | | content. Installer packages are OS specific and contain the |
| resources an operating system needs to install applications | | resources an operating system needs to install applications |
| on a system. Installer packages can include scripts that ru | | on a system. Installer packages can include scripts that ru |
| n prior to installation as well as after installation is com | | n prior to installation as well as after installation is com |
| plete. Installer scripts may inherit elevated permissions wh | | plete. Installer scripts may inherit elevated permissions wh |
| en executed. Developers often use these scripts to prepare t | | en executed. Developers often use these scripts to prepare t |
| he environment for installation, check requirements, downloa | | he environment for installation, check requirements, downloa |
| d dependencies, and remove files after installation.(Citatio | | d dependencies, and remove files after installation.(Citatio |
| n: Installer Package Scripting Rich Trouton) Using legitima | | n: Installer Package Scripting Rich Trouton) Using legitima |
| te applications, adversaries have distributed applications w | | te applications, adversaries have distributed applications w |
| ith modified installer scripts to execute malicious content. | | ith modified installer scripts to execute malicious content. |
| When a user installs the application, they may be required | | When a user installs the application, they may be required |
| to grant administrative permissions to allow the installatio | | to grant administrative permissions to allow the installatio |
| n. At the end of the installation process of the legitimate | | n. At the end of the installation process of the legitimate |
| application, content such as macOS `postinstall` scripts can | | application, content such as macOS `postinstall` scripts can |
| be executed with the inherited elevated permissions. Advers | | be executed with the inherited elevated permissions. Advers |
| aries can use these scripts to execute a malicious executabl | | aries can use these scripts to execute a malicious executabl |
| e or install other malicious components (such as a [Launch D | | e or install other malicious components (such as a [Launch D |
| aemon](https://attack.mitre.org/techniques/T1543/004)) with | | aemon](https://attack.mitre.org/techniques/T1543/004)) with |
| the elevated permissions.(Citation: Application Bundle Manip | | the elevated permissions.(Citation: Application Bundle Manip |
| ulation Brandon Dalton)(Citation: wardle evilquest parti) D | | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci |
| epending on the distribution, Linux versions of package inst | | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai |
| aller scripts are sometimes called maintainer scripts or pos | | ntainer Scripts) Depending on the distribution, Linux versi |
| t installation scripts. These scripts can include `preinst`, | | ons of package installer scripts are sometimes called mainta |
| `postinst`, `prerm`, `postrm` scripts and run as root when | | iner scripts or post installation scripts. These scripts can |
| executed. For Windows, the Microsoft Installer services use | | include `preinst`, `postinst`, `prerm`, `postrm` scripts an |
| s `.msi` files to manage the installing, updating, and unins | | d run as root when executed. For Windows, the Microsoft Ins |
| talling of applications. Adversaries have leveraged `Prebuil | | taller services uses `.msi` files to manage the installing, |
| d` and `Postbuild` events to run commands before or after a | | updating, and uninstalling of applications. These installati |
| build when installing .msi files.(Citation: Windows AppleJeu | | on routines may also include instructions to perform additio |
| s GReAT)(Citation: Debian Manual Maintainer Scripts) | | nal actions that may be abused by adversaries.(Citation: Mic |
| | | rosoft Installation Procedures) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-19 22:44:20.305000+00:00 | 2024-04-12 02:23:44.583000+00:00 |
| description | Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)
Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)
Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed.
For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. Adversaries have leveraged `Prebuild` and `Postbuild` events to run commands before or after a build when installing .msi files.(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts) | Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)
Using legitimate applications, adversaries have distributed applications with modified installer scripts to execute malicious content. When a user installs the application, they may be required to grant administrative permissions to allow the installation. At the end of the installation process of the legitimate application, content such as macOS `postinstall` scripts can be executed with the inherited elevated permissions. Adversaries can use these scripts to execute a malicious executable or install other malicious components (such as a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)) with the elevated permissions.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: wardle evilquest parti)(Citation: Windows AppleJeus GReAT)(Citation: Debian Manual Maintainer Scripts)
Depending on the distribution, Linux versions of package installer scripts are sometimes called maintainer scripts or post installation scripts. These scripts can include `preinst`, `postinst`, `prerm`, `postrm` scripts and run as root when executed.
For Windows, the Microsoft Installer services uses `.msi` files to manage the installing, updating, and uninstalling of applications. These installation routines may also include instructions to perform additional actions that may be abused by adversaries.(Citation: Microsoft Installation Procedures) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Installation Procedures', 'description': 'Microsoft. (2021, January 7). Installation Procedure Tables Group. Retrieved December 27, 2023.', 'url': 'https://learn.microsoft.com/windows/win32/msi/installation-procedure-tables-group'} |
| x_mitre_contributors | | Alexander Rodchenko |
[T1090.001] Proxy: Internal Proxy
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-15 00:46:26.598000+00:00 | 2024-03-07 14:29:02.408000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1534] Internal Spearphishing
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may use internal spearphishing to gain access to | t | After they already have access to accounts or systems within |
| additional information or exploit other users within the sa | | the environment, adversaries may use internal spearphishing |
| me organization after they already have access to accounts o | | to gain access to additional information or compromise othe |
| r systems within the environment. Internal spearphishing is | | r users within the same organization. Internal spearphishing |
| multi-staged campaign where an email account is owned either | | is multi-staged campaign where a legitimate account is init |
| by controlling the user's device with previously installed | | ially compromised either by controlling the user's device or |
| malware or by compromising the account credentials of the us | | by compromising the account credentials of the user. Advers |
| er. Adversaries attempt to take advantage of a trusted inter | | aries may then attempt to take advantage of the trusted inte |
| nal account to increase the likelihood of tricking the targe | | rnal account to increase the likelihood of tricking more vic |
| t into falling for the phish attempt.(Citation: Trend Micro | | tims into falling for phish attempts, often incorporating [I |
| When Phishing Starts from the Inside 2017) Adversaries may | | mpersonation](https://attack.mitre.org/techniques/T1656).(Ci |
| leverage [Spearphishing Attachment](https://attack.mitre.org | | tation: Trend Micro - Int SP) For example, adversaries may |
| /techniques/T1566/001) or [Spearphishing Link](https://attac | | leverage [Spearphishing Attachment](https://attack.mitre.org |
| k.mitre.org/techniques/T1566/002) as part of internal spearp | | /techniques/T1566/001) or [Spearphishing Link](https://attac |
| hishing to deliver a payload or redirect to an external site | | k.mitre.org/techniques/T1566/002) as part of internal spearp |
| to capture credentials through [Input Capture](https://atta | | hishing to deliver a payload or redirect to an external site |
| ck.mitre.org/techniques/T1056) on sites that mimic email log | | to capture credentials through [Input Capture](https://atta |
| in interfaces. There have been notable incidents where inte | | ck.mitre.org/techniques/T1056) on sites that mimic login int |
| rnal spearphishing has been used. The Eye Pyramid campaign u | | erfaces. Adversaries may also leverage internal chat apps, |
| sed phishing emails with malicious attachments for lateral m | | such as Microsoft Teams, to spread malicious content or enga |
| ovement between victims, compromising nearly 18,000 email ac | | ge users in attempts to capture sensitive information and/or |
| counts in the process.(Citation: Trend Micro When Phishing S | | credentials.(Citation: Int SP - chat apps) |
| tarts from the Inside 2017) The Syrian Electronic Army (SEA) | | |
| compromised email accounts at the Financial Times (FT) to s | | |
| teal additional account credentials. Once FT learned of the | | |
| campaign and began warning employees of the threat, the SEA | | |
| sent phishing emails mimicking the Financial Times IT depart | | |
| ment and were able to compromise even more users.(Citation: | | |
| THE FINANCIAL TIMES LTD 2019.) | | |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:29:30.249000+00:00 | 2024-02-16 13:09:39.215000+00:00 |
| description | Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment. Internal spearphishing is multi-staged campaign where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user. Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.(Citation: Trend Micro When Phishing Starts from the Inside 2017)
Adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic email login interfaces.
There have been notable incidents where internal spearphishing has been used. The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.(Citation: Trend Micro When Phishing Starts from the Inside 2017) The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials. Once FT learned of the campaign and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.(Citation: THE FINANCIAL TIMES LTD 2019.) | After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1656).(Citation: Trend Micro - Int SP)
For example, adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic login interfaces.
Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.(Citation: Int SP - chat apps) |
| external_references[2]['source_name'] | THE FINANCIAL TIMES LTD 2019. | Int SP - chat apps |
| external_references[2]['description'] | THE FINANCIAL TIMES. (2019, September 2). A sobering day. Retrieved October 8, 2019. | Microsoft Threat Intelligence. (2023, August 2). Midnight Blizzard conducts targeted social engineering over Microsoft Teams. Retrieved February 16, 2024. |
| external_references[2]['url'] | https://labs.ft.com/2013/05/a-sobering-day/?mhq5j=e6 | https://www.microsoft.com/en-us/security/blog/2023/08/02/midnight-blizzard-conducts-targeted-social-engineering-over-microsoft-teams/ |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Trend Micro - Int SP', 'description': 'Trend Micro. (n.d.). Retrieved February 16, 2024.', 'url': 'https://www.trendmicro.com/en_us/research.html'} |
[T1003.001] OS Credential Dumping: LSASS Memory
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may attempt to access credential material stored | t | Adversaries may attempt to access credential material stored |
| in the process memory of the Local Security Authority Subsy | | in the process memory of the Local Security Authority Subsy |
| stem Service (LSASS). After a user logs on, the system gener | | stem Service (LSASS). After a user logs on, the system gener |
| ates and stores a variety of credential materials in LSASS p | | ates and stores a variety of credential materials in LSASS p |
| rocess memory. These credential materials can be harvested b | | rocess memory. These credential materials can be harvested b |
| y an administrative user or SYSTEM and used to conduct [Late | | y an administrative user or SYSTEM and used to conduct [Late |
| ral Movement](https://attack.mitre.org/tactics/TA0008) using | | ral Movement](https://attack.mitre.org/tactics/TA0008) using |
| [Use Alternate Authentication Material](https://attack.mitr | | [Use Alternate Authentication Material](https://attack.mitr |
| e.org/techniques/T1550). As well as in-memory techniques, t | | e.org/techniques/T1550). As well as in-memory techniques, t |
| he LSASS process memory can be dumped from the target host a | | he LSASS process memory can be dumped from the target host a |
| nd analyzed on a local system. For example, on the target h | | nd analyzed on a local system. For example, on the target h |
| ost use procdump: * <code>procdump -ma lsass.exe lsass_dump | | ost use procdump: * <code>procdump -ma lsass.exe lsass_dump |
| </code> Locally, mimikatz can be run using: * <code>sekurl | | </code> Locally, mimikatz can be run using: * <code>sekurl |
| sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas | | sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas |
| swords</code> Built-in Windows tools such as comsvcs.dll ca | | swords</code> Built-in Windows tools such as `comsvcs.dll` |
| n also be used: * <code>rundll32.exe C:\Windows\System32\co | | can also be used: * <code>rundll32.exe C:\Windows\System32\ |
| msvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vole | | comsvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vo |
| xity Exchange Marauder March 2021)(Citation: Symantec Attack | | lexity Exchange Marauder March 2021)(Citation: Symantec Atta |
| s Against Government Sector) Windows Security Support Prov | | cks Against Government Sector) Similar to [Image File Execu |
| ider (SSP) DLLs are loaded into LSASS process at system star | | tion Options Injection](https://attack.mitre.org/techniques/ |
| t. Once loaded into the LSA, SSP DLLs have access to encrypt | | T1546/012), the silent process exit mechanism can be abused |
| ed and plaintext passwords that are stored in Windows, such | | to create a memory dump of `lsass.exe` through Windows Error |
| as any logged-on user's Domain password or smart card PINs. | | Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS) |
| The SSP configuration is stored in two Registry keys: <code> | | Windows Security Support Provider (SSP) DLLs are loaded int |
| HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages< | | o LSASS process at system start. Once loaded into the LSA, S |
| /code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\O | | SP DLLs have access to encrypted and plaintext passwords tha |
| SConfig\Security Packages</code>. An adversary may modify th | | t are stored in Windows, such as any logged-on user's Domain |
| ese Registry keys to add new SSPs, which will be loaded the | | password or smart card PINs. The SSP configuration is store |
| next time the system boots, or when the AddSecurityPackage W | | d in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\ |
| indows API function is called.(Citation: Graeber 2014) The | | Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\C |
| following SSPs can be used to access credentials: * Msv: In | | urrentControlSet\Control\Lsa\OSConfig\Security Packages</cod |
| teractive logons, batch logons, and service logons are done | | e>. An adversary may modify these Registry keys to add new S |
| through the MSV authentication package. * Wdigest: The Diges | | SPs, which will be loaded the next time the system boots, or |
| t Authentication protocol is designed for use with Hypertext | | when the AddSecurityPackage Windows API function is called. |
| Transfer Protocol (HTTP) and Simple Authentication Security | | (Citation: Graeber 2014) The following SSPs can be used to |
| Layer (SASL) exchanges.(Citation: TechNet Blogs Credential | | access credentials: * Msv: Interactive logons, batch logons |
| Protection) * Kerberos: Preferred for mutual client-server d | | , and service logons are done through the MSV authentication |
| omain authentication in Windows 2000 and later. * CredSSP: | | package. * Wdigest: The Digest Authentication protocol is d |
| Provides SSO and Network Level Authentication for Remote Des | | esigned for use with Hypertext Transfer Protocol (HTTP) and |
| ktop Services.(Citation: TechNet Blogs Credential Protection | | Simple Authentication Security Layer (SASL) exchanges.(Citat |
| ) | | ion: TechNet Blogs Credential Protection) * Kerberos: Prefer |
| | | red for mutual client-server domain authentication in Window |
| | | s 2000 and later. * CredSSP: Provides SSO and Network Level |
| | | Authentication for Remote Desktop Services.(Citation: TechN |
| | | et Blogs Credential Protection) |
New Detections:
- DS0022: File (File Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-24 18:52:29.338000+00:00 | 2023-12-27 17:57:20.003000+00:00 |
| description | Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords
Built-in Windows tools such as comsvcs.dll can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)
| Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
For example, on the target host use procdump:
* procdump -ma lsass.exe lsass_dump
Locally, mimikatz can be run using:
* sekurlsa::Minidump lsassdump.dmp
* sekurlsa::logonPasswords
Built-in Windows tools such as `comsvcs.dll` can also be used:
* rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)
Similar to [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012), the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS)
Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)
The following SSPs can be used to access credentials:
* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)
* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)
|
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Deep Instinct LSASS', 'description': 'Gilboa, A. (2021, February 16). LSASS Memory Dumps are Stealthier than Ever Before - Part 2. Retrieved December 27, 2023.', 'url': 'https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2'} |
| x_mitre_data_sources | | File: File Creation |
[T1608.005] Stage Capabilities: Link Target
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may put in place resources that are referenced b | t | Adversaries may put in place resources that are referenced b |
| y a link that can be used during targeting. An adversary may | | y a link that can be used during targeting. An adversary may |
| rely upon a user clicking a malicious link in order to divu | | rely upon a user clicking a malicious link in order to divu |
| lge information (including credentials) or to gain execution | | lge information (including credentials) or to gain execution |
| , as in [Malicious Link](https://attack.mitre.org/techniques | | , as in [Malicious Link](https://attack.mitre.org/techniques |
| /T1204/001). Links can be used for spearphishing, such as se | | /T1204/001). Links can be used for spearphishing, such as se |
| nding an email accompanied by social engineering text to coa | | nding an email accompanied by social engineering text to coa |
| x the user to actively click or copy and paste a URL into a | | x the user to actively click or copy and paste a URL into a |
| browser. Prior to a phish for information (as in [Spearphish | | browser. Prior to a phish for information (as in [Spearphish |
| ing Link](https://attack.mitre.org/techniques/T1598/003)) or | | ing Link](https://attack.mitre.org/techniques/T1598/003)) or |
| a phish to gain initial access to a system (as in [Spearphi | | a phish to gain initial access to a system (as in [Spearphi |
| shing Link](https://attack.mitre.org/techniques/T1566/002)), | | shing Link](https://attack.mitre.org/techniques/T1566/002)), |
| an adversary must set up the resources for a link target fo | | an adversary must set up the resources for a link target fo |
| r the spearphishing link. Typically, the resources for a l | | r the spearphishing link. Typically, the resources for a l |
| ink target will be an HTML page that may include some client | | ink target will be an HTML page that may include some client |
| -side script such as [JavaScript](https://attack.mitre.org/t | | -side script such as [JavaScript](https://attack.mitre.org/t |
| echniques/T1059/007) to decide what content to serve to the | | echniques/T1059/007) to decide what content to serve to the |
| user. Adversaries may clone legitimate sites to serve as the | | user. Adversaries may clone legitimate sites to serve as the |
| link target, this can include cloning of login pages of leg | | link target, this can include cloning of login pages of leg |
| itimate web services or organization login pages in an effor | | itimate web services or organization login pages in an effor |
| t to harvest credentials during [Spearphishing Link](https:/ | | t to harvest credentials during [Spearphishing Link](https:/ |
| /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby | | /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby |
| tes Silent Librarian October 2020)(Citation: Proofpoint TA40 | | tes Silent Librarian October 2020)(Citation: Proofpoint TA40 |
| 7 September 2019) Adversaries may also [Upload Malware](http | | 7 September 2019) Adversaries may also [Upload Malware](http |
| s://attack.mitre.org/techniques/T1608/001) and have the link | | s://attack.mitre.org/techniques/T1608/001) and have the link |
| target point to malware for download/execution by the user. | | target point to malware for download/execution by the user. |
| Adversaries may purchase domains similar to legitimate dom | | Adversaries may purchase domains similar to legitimate dom |
| ains (ex: homoglyphs, typosquatting, different top-level dom | | ains (ex: homoglyphs, typosquatting, different top-level dom |
| ain, etc.) during acquisition of infrastructure ([Domains](h | | ain, etc.) during acquisition of infrastructure ([Domains](h |
| ttps://attack.mitre.org/techniques/T1583/001)) to help facil | | ttps://attack.mitre.org/techniques/T1583/001)) to help facil |
| itate [Malicious Link](https://attack.mitre.org/techniques/T | | itate [Malicious Link](https://attack.mitre.org/techniques/T |
| 1204/001). Link shortening services can also be employed. Ad | | 1204/001). Links can be written by adversaries to mask the |
| versaries may also use free or paid accounts on Platform-as- | | true destination in order to deceive victims by abusing the |
| a-Service providers to host link targets while taking advant | | URL schema and increasing the effectiveness of phishing.(Cit |
| age of the widely trusted domains of those providers to avoi | | ation: Kaspersky-masking)(Citation: mandiant-masking) Adver |
| d being blocked.(Citation: Netskope GCP Redirection)(Citatio | | saries may also use free or paid accounts on link shortening |
| n: Netskope Cloud Phishing)(Citation: Intezer App Service Ph | | services and Platform-as-a-Service providers to host link t |
| ishing) Finally, adversaries may take advantage of the decen | | argets while taking advantage of the widely trusted domains |
| tralized nature of the InterPlanetary File System (IPFS) to | | of those providers to avoid being blocked while redirecting |
| host link targets that are difficult to remove.(Citation: Ta | | victims to malicious pages.(Citation: Netskope GCP Redirecti |
| los IPFS 2022) | | on)(Citation: Netskope Cloud Phishing)(Citation: Intezer App |
| | | Service Phishing)(Citation: Cofense-redirect) In addition, |
| | | adversaries may serve a variety of malicious links through u |
| | | niquely generated URIs/URLs.(Citation: iOS URL Scheme)(Citat |
| | | ion: URI)(Citation: URI Use)(Citation: URI Unique) Finally, |
| | | adversaries may take advantage of the decentralized nature o |
| | | f the InterPlanetary File System (IPFS) to host link targets |
| | | that are difficult to remove.(Citation: Talos IPFS 2022) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 23:20:48.603000+00:00 | 2024-04-13 14:03:24.673000+00:00 |
| description | Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Link shortening services can also be employed. Adversaries may also use free or paid accounts on Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked.(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)(Citation: Intezer App Service Phishing) Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.(Citation: Talos IPFS 2022) | Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001).
Links can be written by adversaries to mask the true destination in order to deceive victims by abusing the URL schema and increasing the effectiveness of phishing.(Citation: Kaspersky-masking)(Citation: mandiant-masking)
Adversaries may also use free or paid accounts on link shortening services and Platform-as-a-Service providers to host link targets while taking advantage of the widely trusted domains of those providers to avoid being blocked while redirecting victims to malicious pages.(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)(Citation: Intezer App Service Phishing)(Citation: Cofense-redirect) In addition, adversaries may serve a variety of malicious links through uniquely generated URIs/URLs.(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Finally, adversaries may take advantage of the decentralized nature of the InterPlanetary File System (IPFS) to host link targets that are difficult to remove.(Citation: Talos IPFS 2022) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'URI Unique', 'description': 'Australian Cyber Security Centre. National Security Agency. (2020, April 21). Detect and Prevent Web Shell Malware. Retrieved February 9, 2024.', 'url': 'https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF'} |
| external_references | | {'source_name': 'Kaspersky-masking', 'description': 'Dedenok, Roman. (2023, December 12). How cybercriminals disguise URLs. Retrieved January 17, 2024.', 'url': 'https://www.kaspersky.com/blog/malicious-redirect-methods/50045/'} |
| external_references | | {'source_name': 'URI', 'description': 'Michael Cobb. (2007, October 11). Preparing for uniform resource identifier (URI) exploits. Retrieved February 9, 2024.', 'url': 'https://www.techtarget.com/searchsecurity/tip/Preparing-for-uniform-resource-identifier-URI-exploits'} |
| external_references | | {'source_name': 'URI Use', 'description': 'Nathan McFeters. Billy Kim Rios. Rob Carter.. (2008). URI Use and Abuse. Retrieved February 9, 2024.', 'url': 'https://www.blackhat.com/presentations/bh-dc-08/McFeters-Rios-Carter/Presentation/bh-dc-08-mcfeters-rios-carter.pdf'} |
| external_references | | {'source_name': 'iOS URL Scheme', 'description': 'Ostorlab. (n.d.). iOS URL Scheme Hijacking. Retrieved February 9, 2024.', 'url': 'https://docs.ostorlab.co/kb/IPA_URL_SCHEME_HIJACKING/index.html'} |
| external_references | | {'source_name': 'Cofense-redirect', 'description': 'Raymond, Nathaniel. (2023, August 16). Major Energy Company Targeted in Large QR Code Phishing Campaign. Retrieved January 17, 2024.', 'url': 'https://cofense.com/blog/major-energy-company-targeted-in-large-qr-code-campaign/'} |
| external_references | | {'source_name': 'mandiant-masking', 'description': "Simonian, Nick. (2023, May 22). Don't @ Me: URL Obfuscation Through Schema Abuse. Retrieved January 17, 2024.", 'url': 'https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse'} |
| x_mitre_contributors | | Hen Porcilan |
| x_mitre_contributors | | Diyar Saadi Ali |
| x_mitre_contributors | | Nikola Kovac |
[T1071.003] Application Layer Protocol: Mail Protocols
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may communicate using application layer protocol | t | Adversaries may communicate using application layer protocol |
| s associated with electronic mail delivery to avoid detectio | | s associated with electronic mail delivery to avoid detectio |
| n/network filtering by blending in with existing traffic. Co | | n/network filtering by blending in with existing traffic. Co |
| mmands to the remote system, and often the results of those | | mmands to the remote system, and often the results of those |
| commands, will be embedded within the protocol traffic betwe | | commands, will be embedded within the protocol traffic betwe |
| en the client and server. Protocols such as SMTP/S, POP3/S | | en the client and server. Protocols such as SMTP/S, POP3/S |
| , and IMAP that carry electronic mail may be very common in | | , and IMAP that carry electronic mail may be very common in |
| environments. Packets produced from these protocols may hav | | environments. Packets produced from these protocols may hav |
| e many fields and headers in which data can be concealed. Da | | e many fields and headers in which data can be concealed. Da |
| ta could also be concealed within the email messages themsel | | ta could also be concealed within the email messages themsel |
| ves. An adversary may abuse these protocols to communicate w | | ves. An adversary may abuse these protocols to communicate w |
| ith systems under their control within a victim network whil | | ith systems under their control within a victim network whil |
| e also mimicking normal, expected traffic. | | e also mimicking normal, expected traffic.(Citation: FireEye |
| | | APT28) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 16:35:45.633000+00:00 | 2024-04-16 12:28:59.928000+00:00 |
| description | Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. | Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the email messages themselves. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: FireEye APT28) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'FireEye APT28', 'description': 'FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.', 'url': 'https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf'} |
| x_mitre_platforms | | Network |
[T1036] Masquerading
Current version: 1.7
Version changed from: 1.6 → 1.7
|
|
|---|
| t | Adversaries may attempt to manipulate features of their arti | t | Adversaries may attempt to manipulate features of their arti |
| facts to make them appear legitimate or benign to users and/ | | facts to make them appear legitimate or benign to users and/ |
| or security tools. Masquerading occurs when the name or loca | | or security tools. Masquerading occurs when the name or loca |
| tion of an object, legitimate or malicious, is manipulated o | | tion of an object, legitimate or malicious, is manipulated o |
| r abused for the sake of evading defenses and observation. T | | r abused for the sake of evading defenses and observation. T |
| his may include manipulating file metadata, tricking users i | | his may include manipulating file metadata, tricking users i |
| nto misidentifying the file type, and giving legitimate task | | nto misidentifying the file type, and giving legitimate task |
| or service names. Renaming abusable system utilities to ev | | or service names. Renaming abusable system utilities to ev |
| ade security monitoring is also a form of [Masquerading](htt | | ade security monitoring is also a form of [Masquerading](htt |
| ps://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Ma | | ps://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Ma |
| in Site) Masquerading may also include the use of [Proxy](ht | | in Site) |
| tps://attack.mitre.org/techniques/T1090) or VPNs to disguise | | |
| IP addresses, which can allow adversaries to blend in with | | |
| normal network traffic and bypass conditional access policie | | |
| s or anti-abuse protections. | | |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-15 09:52:11.875000+00:00 | 2024-03-08 17:00:59.133000+00:00 |
| description | Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. | Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Renaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) |
| x_mitre_version | 1.6 | 1.7 |
[T1556] Modify Authentication Process
Current version: 2.4
Version changed from: 2.3 → 2.4
New Detections:
- DS0025: Cloud Service (Cloud Service Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 03:17:32.211000+00:00 | 2024-04-11 21:51:44.851000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.3 | 2.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Cloud Service: Cloud Service Modification |
[T1556.006] Modify Authentication Process: Multi-Factor Authentication
Current version: 1.2
Version changed from: 1.1 → 1.2
New Detections:
- DS0015: Application Log (Application Log Content)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:47:26.119000+00:00 | 2024-04-16 00:20:21.488000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Application Log: Application Log Content |
[T1621] Multi-Factor Authentication Request Generation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may attempt to bypass multi-factor authenticatio | t | Adversaries may attempt to bypass multi-factor authenticatio |
| n (MFA) mechanisms and gain access to accounts by generating | | n (MFA) mechanisms and gain access to accounts by generating |
| MFA requests sent to users. Adversaries in possession of c | | MFA requests sent to users. Adversaries in possession of c |
| redentials to [Valid Accounts](https://attack.mitre.org/tech | | redentials to [Valid Accounts](https://attack.mitre.org/tech |
| niques/T1078) may be unable to complete the login process if | | niques/T1078) may be unable to complete the login process if |
| they lack access to the 2FA or MFA mechanisms required as a | | they lack access to the 2FA or MFA mechanisms required as a |
| n additional credential and security control. To circumvent | | n additional credential and security control. To circumvent |
| this, adversaries may abuse the automatic generation of push | | this, adversaries may abuse the automatic generation of push |
| notifications to MFA services such as Duo Push, Microsoft A | | notifications to MFA services such as Duo Push, Microsoft A |
| uthenticator, Okta, or similar services to have the user gra | | uthenticator, Okta, or similar services to have the user gra |
| nt access to their account. In some cases, adversaries may | | nt access to their account. If adversaries lack credentials |
| continuously repeat login attempts in order to bombard users | | to victim accounts, they may also abuse automatic push notif |
| with MFA push notifications, SMS messages, and phone calls, | | ication generation when this option is configured for self-s |
| potentially resulting in the user finally accepting the aut | | ervice password reset (SSPR).(Citation: Obsidian SSPR Abuse |
| hentication request in response to “MFA fatigue.”(Citation: | | 2023) In some cases, adversaries may continuously repeat lo |
| Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue | | gin attempts in order to bombard users with MFA push notific |
| Attacks - PortSwigger)(Citation: Suspected Russian Activity | | ations, SMS messages, and phone calls, potentially resulting |
| Targeting Government and Business Entities Around the Globe) | | in the user finally accepting the authentication request in |
| | | response to “MFA fatigue.”(Citation: Russian 2FA Push Annoy |
| | | ance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger) |
| | | (Citation: Suspected Russian Activity Targeting Government a |
| | | nd Business Entities Around the Globe) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-04 03:06:34.448000+00:00 | 2024-04-19 04:26:29.365000+00:00 |
| description | Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account.
In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe) | Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023)
In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to “MFA fatigue.”(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Obsidian SSPR Abuse 2023', 'description': 'Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.', 'url': 'https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/'} |
| x_mitre_contributors | | Obsidian Security |
[T1090.003] Proxy: Multi-hop Proxy
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | To disguise the source of malicious traffic, adversaries may | t | Adversaries may chain together multiple proxies to disguise |
| chain together multiple proxies. Typically, a defender will | | the source of malicious traffic. Typically, a defender will |
| be able to identify the last proxy traffic traversed before | | be able to identify the last proxy traffic traversed before |
| it enters their network; the defender may or may not be abl | | it enters their network; the defender may or may not be able |
| e to identify any previous proxies before the last-hop proxy | | to identify any previous proxies before the last-hop proxy. |
| . This technique makes identifying the original source of th | | This technique makes identifying the original source of the |
| e malicious traffic even more difficult by requiring the def | | malicious traffic even more difficult by requiring the defe |
| ender to trace malicious traffic through several proxies to | | nder to trace malicious traffic through several proxies to i |
| identify its source. A particular variant of this behavior i | | dentify its source. For example, adversaries may construct |
| s to use onion routing networks, such as the publicly availa | | or use onion routing networks – such as the publicly availab |
| ble TOR network. (Citation: Onion Routing) In the case of n | | le [Tor](https://attack.mitre.org/software/S0183) network – |
| etwork infrastructure, particularly routers, it is possible | | to transport encrypted C2 traffic through a compromised popu |
| for an adversary to leverage multiple compromised devices to | | lation, allowing communication with any device within the ne |
| create a multi-hop proxy chain within the Wide-Area Network | | twork.(Citation: Onion Routing) In the case of network infr |
| (WAN) of the enterprise. By leveraging [Patch System Image | | astructure, it is possible for an adversary to leverage mult |
| ](https://attack.mitre.org/techniques/T1601/001), adversarie | | iple compromised devices to create a multi-hop proxy chain ( |
| s can add custom code to the affected network devices that w | | i.e., [Network Devices](https://attack.mitre.org/techniques/ |
| ill implement onion routing between those nodes. This custo | | T1584/008)). By leveraging [Patch System Image](https://atta |
| m onion routing network will transport the encrypted C2 traf | | ck.mitre.org/techniques/T1601/001) on routers, adversaries c |
| fic through the compromised population, allowing adversaries | | an add custom code to the affected network devices that will |
| to communicate with any device within the onion routing net | | implement onion routing between those nodes. This method is |
| work. This method is dependent upon the [Network Boundary B | | dependent upon the [Network Boundary Bridging](https://atta |
| ridging](https://attack.mitre.org/techniques/T1599) method i | | ck.mitre.org/techniques/T1599) method allowing the adversari |
| n order to allow the adversaries to cross the protected netw | | es to cross the protected network boundary of the Internet p |
| ork boundary of the Internet perimeter and into the organiza | | erimeter and into the organization’s Wide-Area Network (WAN) |
| tion’s WAN. Protocols such as ICMP may be used as a transpor | | . Protocols such as ICMP may be used as a transport. Simil |
| t. | | arly, adversaries may abuse peer-to-peer (P2P) and blockchai |
| | | n-oriented infrastructure to implement routing between a dec |
| | | entralized network of peers.(Citation: NGLite Trojan) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Eduardo Chavarro Ovalle'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 17:54:28.280000+00:00 | 2024-04-19 13:24:36.872000+00:00 |
| description | To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network. (Citation: Onion Routing)
In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise. By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001), adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN. Protocols such as ICMP may be used as a transport. | Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing)
In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport.
Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan) |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'NGLite Trojan', 'description': 'Robert Falcone, Jeff White, and Peter Renals. (2021, November 7). Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer. Retrieved February 8, 2024.', 'url': 'https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/'} |
[T1564.004] Hide Artifacts: NTFS File Attributes
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0009: Process (Process Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 22:46:56.308000+00:00 | 2024-02-14 21:56:34.831000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
[T1040] Network Sniffing
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may sniff network traffic to capture information | t | Adversaries may passively sniff network traffic to capture i |
| about an environment, including authentication material pas | | nformation about an environment, including authentication ma |
| sed over the network. Network sniffing refers to using the n | | terial passed over the network. Network sniffing refers to u |
| etwork interface on a system to monitor or capture informati | | sing the network interface on a system to monitor or capture |
| on sent over a wired or wireless connection. An adversary ma | | information sent over a wired or wireless connection. An ad |
| y place a network interface into promiscuous mode to passive | | versary may place a network interface into promiscuous mode |
| ly access data in transit over the network, or use span port | | to passively access data in transit over the network, or use |
| s to capture a larger amount of data. Data captured via thi | | span ports to capture a larger amount of data. Data captur |
| s technique may include user credentials, especially those s | | ed via this technique may include user credentials, especial |
| ent over an insecure, unencrypted protocol. Techniques for n | | ly those sent over an insecure, unencrypted protocol. Techni |
| ame service resolution poisoning, such as [LLMNR/NBT-NS Pois | | ques for name service resolution poisoning, such as [LLMNR/N |
| oning and SMB Relay](https://attack.mitre.org/techniques/T15 | | BT-NS Poisoning and SMB Relay](https://attack.mitre.org/tech |
| 57/001), can also be used to capture credentials to websites | | niques/T1557/001), can also be used to capture credentials t |
| , proxies, and internal systems by redirecting traffic to an | | o websites, proxies, and internal systems by redirecting tra |
| adversary. Network sniffing may also reveal configuration | | ffic to an adversary. Network sniffing may reveal configura |
| details, such as running services, version numbers, and othe | | tion details, such as running services, version numbers, and |
| r network characteristics (e.g. IP addresses, hostnames, VLA | | other network characteristics (e.g. IP addresses, hostnames |
| N IDs) necessary for subsequent Lateral Movement and/or Defe | | , VLAN IDs) necessary for subsequent [Lateral Movement](http |
| nse Evasion activities. In cloud-based environments, advers | | s://attack.mitre.org/tactics/TA0008) and/or [Defense Evasion |
| aries may still be able to use traffic mirroring services to | | ](https://attack.mitre.org/tactics/TA0005) activities. Adver |
| sniff network traffic from virtual machines. For example, A | | saries may likely also utilize network sniffing during [Adve |
| WS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap a | | rsary-in-the-Middle](https://attack.mitre.org/techniques/T15 |
| llow users to define specified instances to collect traffic | | 57) (AiTM) to passively gain additional knowledge about the |
| from and specified targets to send collected traffic to.(Cit | | environment. In cloud-based environments, adversaries may s |
| ation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring | | till be able to use traffic mirroring services to sniff netw |
| )(Citation: Azure Virtual Network TAP) Often, much of this t | | ork traffic from virtual machines. For example, AWS Traffic |
| raffic will be in cleartext due to the use of TLS terminatio | | Mirroring, GCP Packet Mirroring, and Azure vTap allow users |
| n at the load balancer level to reduce the strain of encrypt | | to define specified instances to collect traffic from and sp |
| ing and decrypting traffic.(Citation: Rhino Security Labs AW | | ecified targets to send collected traffic to.(Citation: AWS |
| S VPC Traffic Mirroring)(Citation: SpecterOps AWS Traffic Mi | | Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: |
| rroring) The adversary can then use exfiltration techniques | | Azure Virtual Network TAP) Often, much of this traffic will |
| such as Transfer Data to Cloud Account in order to access th | | be in cleartext due to the use of TLS termination at the lo |
| e sniffed traffic.(Citation: Rhino Security Labs AWS VPC Tra | | ad balancer level to reduce the strain of encrypting and dec |
| ffic Mirroring) On network devices, adversaries may perform | | rypting traffic.(Citation: Rhino Security Labs AWS VPC Traff |
| network captures using [Network Device CLI](https://attack. | | ic Mirroring)(Citation: SpecterOps AWS Traffic Mirroring) Th |
| mitre.org/techniques/T1059/008) commands such as `monitor ca | | e adversary can then use exfiltration techniques such as Tra |
| pture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embed | | nsfer Data to Cloud Account in order to access the sniffed t |
| ded_packet_on_software) | | raffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirror |
| | | ing) On network devices, adversaries may perform network ca |
| | | ptures using [Network Device CLI](https://attack.mitre.org/t |
| | | echniques/T1059/008) commands such as `monitor capture`.(Cit |
| | | ation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_ |
| | | on_software) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-10 15:48:01.560000+00:00 | 2024-04-19 12:32:44.370000+00:00 |
| description | Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.
In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)(Citation: SpecterOps AWS Traffic Mirroring) The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)
On network devices, adversaries may perform network captures using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `monitor capture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_on_software) | Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. Techniques for name service resolution poisoning, such as [LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001), can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.
Network sniffing may reveal configuration details, such as running services, version numbers, and other network characteristics (e.g. IP addresses, hostnames, VLAN IDs) necessary for subsequent [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or [Defense Evasion](https://attack.mitre.org/tactics/TA0005) activities. Adversaries may likely also utilize network sniffing during [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) (AiTM) to passively gain additional knowledge about the environment.
In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines. For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.(Citation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: Azure Virtual Network TAP) Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)(Citation: SpecterOps AWS Traffic Mirroring) The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirroring)
On network devices, adversaries may perform network captures using [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `monitor capture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_on_software) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Eliraz Levi, Hunters |
[T1003] OS Credential Dumping
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may attempt to dump credentials to obtain accoun | t | Adversaries may attempt to dump credentials to obtain accoun |
| t login and credential material, normally in the form of a h | | t login and credential material, normally in the form of a h |
| ash or a clear text password, from the operating system and | | ash or a clear text password. Credentials can be obtained fr |
| software. Credentials can then be used to perform [Lateral M | | om OS caches, memory, or structures.(Citation: Brining MimiK |
| ovement](https://attack.mitre.org/tactics/TA0008) and access | | atz to Unix) Credentials can then be used to perform [Latera |
| restricted information. Several of the tools mentioned in | | l Movement](https://attack.mitre.org/tactics/TA0008) and acc |
| associated sub-techniques may be used by both adversaries an | | ess restricted information. Several of the tools mentioned |
| d professional security testers. Additional custom tools lik | | in associated sub-techniques may be used by both adversaries |
| ely exist as well. | | and professional security testers. Additional custom tools |
| | | likely exist as well. |
New Detections:
- DS0022: File (File Creation)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:00:53.436000+00:00 | 2024-04-18 23:47:41.667000+00:00 |
| description | Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
| Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.
Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
|
| x_mitre_detection | ### Windows
Monitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity.
Hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well.
On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.
Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like [Mimikatz](https://attack.mitre.org/software/S0002). [PowerShell](https://attack.mitre.org/techniques/T1059/001) scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, (Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) Note: Domain controllers may not log replication requests originating from the default domain controller account. (Citation: Harmj0y DCSync Sept 2015). Also monitor for network protocols (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft NRPC Dec 2017) and other replication requests (Citation: Microsoft SAMR) from IPs not associated with known domain controllers. (Citation: AdSecurity DCSync Sept 2015)
### Linux
To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path /proc//maps, where the | ### Windows
Monitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity.
Hash dumpers open the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM) or create a dump of the Registry SAM key to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised [Valid Accounts](https://attack.mitre.org/techniques/T1078) in-use by adversaries may help as well.
On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.
Monitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like [Mimikatz](https://attack.mitre.org/software/S0002). [PowerShell](https://attack.mitre.org/techniques/T1059/001) scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, (Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.
Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync. (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) Note: Domain controllers may not log replication requests originating from the default domain controller account. (Citation: Harmj0y DCSync Sept 2015). Also monitor for network protocols (Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft NRPC Dec 2017) and other replication requests (Citation: Microsoft SAMR) from IPs not associated with known domain controllers. (Citation: AdSecurity DCSync Sept 2015)
### Linux
To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc//maps`, where the `` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs. |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Brining MimiKatz to Unix', 'description': 'Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.', 'url': 'https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf'} |
| x_mitre_contributors | | Tim (Wadhwa-)Brown |
| x_mitre_contributors | | Yves Yonan |
| x_mitre_data_sources | | File: File Creation |
[T1027] Obfuscated Files or Information
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-28 19:17:53.015000+00:00 | 2024-04-16 12:27:18.945000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1137.002] Office Application Startup: Office Test
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may abuse the Microsoft Office "Office Test" Reg | t | Adversaries may abuse the Microsoft Office "Office Test" Reg |
| istry key to obtain persistence on a compromised system. An | | istry key to obtain persistence on a compromised system. An |
| Office Test Registry location exists that allows a user to s | | Office Test Registry location exists that allows a user to s |
| pecify an arbitrary DLL that will be executed every time an | | pecify an arbitrary DLL that will be executed every time an |
| Office application is started. This Registry key is thought | | Office application is started. This Registry key is thought |
| to be used by Microsoft to load DLLs for testing and debuggi | | to be used by Microsoft to load DLLs for testing and debuggi |
| ng purposes while developing Office applications. This Regis | | ng purposes while developing Office applications. This Regis |
| try key is not created by default during an Office installat | | try key is not created by default during an Office installat |
| ion.(Citation: Hexacorn Office Test)(Citation: Palo Alto Off | | ion.(Citation: Hexacorn Office Test)(Citation: Palo Alto Off |
| ice Test Sofacy) There exist user and global Registry keys | | ice Test Sofacy) There exist user and global Registry keys |
| for the Office Test feature: * <code>HKEY_CURRENT_USER\Soft | | for the Office Test feature, such as: * <code>HKEY_CURRENT_ |
| ware\Microsoft\Office test\Special\Perf</code> * <code>HKEY_ | | USER\Software\Microsoft\Office test\Special\Perf</code> * <c |
| LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</c | | ode>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Specia |
| ode> Adversaries may add this Registry key and specify a ma | | l\Perf</code> Adversaries may add this Registry key and spe |
| licious DLL that will be executed whenever an Office applica | | cify a malicious DLL that will be executed whenever an Offic |
| tion, such as Word or Excel, is started. | | e application, such as Word or Excel, is started. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
| x_mitre_system_requirements | ['Office 2007, 2010, 2013, and 2016'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:35:17.618000+00:00 | 2024-04-16 12:41:55.175000+00:00 |
| description | Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)
There exist user and global Registry keys for the Office Test feature:
* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started. | Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)
There exist user and global Registry keys for the Office Test feature, such as:
* HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf
* HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf
Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started. |
| x_mitre_version | 1.1 | 1.2 |
[T1110.003] Brute Force: Password Spraying
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:55:18.014000+00:00 | 2024-03-07 14:33:34.201000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1566] Phishing
Current version: 2.5
Version changed from: 2.4 → 2.5
New Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-08 20:27:52.947000+00:00 | 2024-03-01 16:56:32.245000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.4 | 2.5 |
[T1547.010] Boot or Logon Autostart Execution: Port Monitors
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use port monitors to run an adversary suppli | t | Adversaries may use port monitors to run an adversary suppli |
| ed DLL during system boot for persistence or privilege escal | | ed DLL during system boot for persistence or privilege escal |
| ation. A port monitor can be set through the <code>AddMonito | | ation. A port monitor can be set through the <code>AddMonito |
| r</code> API call to set a DLL to be loaded at startup.(Cita | | r</code> API call to set a DLL to be loaded at startup.(Cita |
| tion: AddMonitor) This DLL can be located in <code>C:\Window | | tion: AddMonitor) This DLL can be located in <code>C:\Window |
| s\System32</code> and will be loaded by the print spooler se | | s\System32</code> and will be loaded and run by the print sp |
| rvice, spoolsv.exe, on boot. The spoolsv.exe process also ru | | ooler service, `spoolsv.exe`, under SYSTEM level permissions |
| ns under SYSTEM level permissions.(Citation: Bloxham) Altern | | on boot.(Citation: Bloxham) Alternatively, an arbitrary D |
| atively, an arbitrary DLL can be loaded if permissions allow | | LL can be loaded if permissions allow writing a fully-qualif |
| writing a fully-qualified pathname for that DLL to <code>HK | | ied pathname for that DLL to the `Driver` value of an existi |
| LM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. | | ng or new arbitrarily named subkey of <code>HKLM\SYSTEM\Curr |
| The Registry key contains entries for the following: * Loc | | entControlSet\Control\Print\Monitors</code>. The Registry ke |
| al Port * Standard TCP/IP Port * USB Monitor * WSD Port Adv | | y contains entries for the following: * Local Port * Standa |
| ersaries can use this technique to load malicious code at st | | rd TCP/IP Port * USB Monitor * WSD Port |
| artup that will persist on system reboot and execute as SYST | | |
| EM. | | |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 16:36:31.835000+00:00 | 2024-04-12 02:49:39.980000+00:00 |
| description | Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.
The Registry key contains entries for the following:
* Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port
Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM. | Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)
Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. The Registry key contains entries for the following:
* Local Port
* Standard TCP/IP Port
* USB Monitor
* WSD Port
|
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_detection | Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious.
Monitor Registry writes to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns) | Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious.
Monitor Registry writes to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors, paying particular attention to changes in the "Driver" subkey. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Harun Küßner |
[T1059.001] Command and Scripting Interpreter: PowerShell
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-27 17:19:48.136000+00:00 | 2024-03-01 18:01:37.575000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
[T1542] Pre-OS Boot
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1035: Limit Access to Resource Over Network
- M1047: Audit
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 02:50:42.074000+00:00 | 2024-02-26 14:26:14.364000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[T1003.007] OS Credential Dumping: Proc Filesystem
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may gather credentials from the proc filesystem | t | Adversaries may gather credentials from the proc filesystem |
| or `/proc`. The proc filesystem is a pseudo-filesystem used | | or `/proc`. The proc filesystem is a pseudo-filesystem used |
| as an interface to kernel data structures for Linux based sy | | as an interface to kernel data structures for Linux based sy |
| stems managing virtual memory. For each process, the `/proc/ | | stems managing virtual memory. For each process, the `/proc/ |
| <PID>/maps` file shows how memory is mapped within the proce | | <PID>/maps` file shows how memory is mapped within the proce |
| ss’s virtual address space. And `/proc/<PID>/mem`, exposed f | | ss’s virtual address space. And `/proc/<PID>/mem`, exposed f |
| or debugging purposes, provides access to the process’s virt | | or debugging purposes, provides access to the process’s virt |
| ual address space.(Citation: Picus Labs Proc cump 2022)(Cita | | ual address space.(Citation: Picus Labs Proc cump 2022)(Cita |
| tion: baeldung Linux proc map 2022) When executing with roo | | tion: baeldung Linux proc map 2022) When executing with roo |
| t privileges, adversaries can search these memory locations | | t privileges, adversaries can search these memory locations |
| for all processes on a system that contain patterns that are | | for all processes on a system that contain patterns indicati |
| indicative of credentials, such as looking for fixed string | | ve of credentials. Adversaries may use regex patterns, such |
| s in memory structures or cached hashes. When running withou | | as <code>grep -E "^[0-9a-f-]* r" /proc/"$pid"/maps | cut -d' |
| t privileged access, processes can still view their own virt | | ' -f 1</code>, to look for fixed strings in memory structur |
| ual memory locations. Some services or programs may save cre | | es or cached hashes.(Citation: atomic-red proc file system) |
| dentials in clear text inside the process’s memory.(Citation | | When running without privileged access, processes can still |
| : MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc | | view their own virtual memory locations. Some services or pr |
| Gitbook) If running as or with the permissions of a web br | | ograms may save credentials in clear text inside the process |
| owser, a process can search the `/maps` & `/mem` locations f | | ’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: |
| or common website credential patterns (that can also be used | | Polop Linux PrivEsc Gitbook) If running as or with the perm |
| to find adjacent memory within the same structure) in which | | issions of a web browser, a process can search the `/maps` & |
| hashes or cleartext credentials may be located. | | `/mem` locations for common website credential patterns (th |
| | | at can also be used to find adjacent memory within the same |
| | | structure) in which hashes or cleartext credentials may be l |
| | | ocated. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 01:16:25.566000+00:00 | 2024-04-10 16:41:01.496000+00:00 |
| description | Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)
When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns that are indicative of credentials, such as looking for fixed strings in memory structures or cached hashes. When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc Gitbook)
If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located. | Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)
When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns indicative of credentials. Adversaries may use regex patterns, such as grep -E "^[0-9a-f-]* r" /proc/"$pid"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.(Citation: atomic-red proc file system) When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process’s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc Gitbook)
If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_detection | To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path /proc/\*/maps, where the \* directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs. | To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc/PID/maps`, where the `PID` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'atomic-red proc file system', 'description': 'Atomic Red Team. (2023, November). T1003.007 - OS Credential Dumping: Proc Filesystem. Retrieved March 28, 2024.', 'url': 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.007/T1003.007.md'} |
[T1057] Process Discovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may attempt to get information about running pro | t | Adversaries may attempt to get information about running pro |
| cesses on a system. Information obtained could be used to ga | | cesses on a system. Information obtained could be used to ga |
| in an understanding of common software/applications running | | in an understanding of common software/applications running |
| on systems within the network. Adversaries may use the infor | | on systems within the network. Administrator or otherwise el |
| mation from [Process Discovery](https://attack.mitre.org/tec | | evated access may provide better process details. Adversarie |
| hniques/T1057) during automated discovery to shape follow-on | | s may use the information from [Process Discovery](https://a |
| behaviors, including whether or not the adversary fully inf | | ttack.mitre.org/techniques/T1057) during automated discovery |
| ects the target and/or attempts specific actions. In Window | | to shape follow-on behaviors, including whether or not the |
| s environments, adversaries could obtain details on running | | adversary fully infects the target and/or attempts specific |
| processes using the [Tasklist](https://attack.mitre.org/soft | | actions. In Windows environments, adversaries could obtain |
| ware/S0057) utility via [cmd](https://attack.mitre.org/softw | | details on running processes using the [Tasklist](https://at |
| are/S0106) or <code>Get-Process</code> via [PowerShell](http | | tack.mitre.org/software/S0057) utility via [cmd](https://att |
| s://attack.mitre.org/techniques/T1059/001). Information abou | | ack.mitre.org/software/S0106) or <code>Get-Process</code> vi |
| t processes can also be extracted from the output of [Native | | a [PowerShell](https://attack.mitre.org/techniques/T1059/001 |
| API](https://attack.mitre.org/techniques/T1106) calls such | | ). Information about processes can also be extracted from th |
| as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, | | e output of [Native API](https://attack.mitre.org/techniques |
| this is accomplished with the <code>ps</code> command. Adver | | /T1106) calls such as <code>CreateToolhelp32Snapshot</code>. |
| saries may also opt to enumerate processes via /proc. On ne | | In Mac and Linux, this is accomplished with the <code>ps</c |
| twork devices, [Network Device CLI](https://attack.mitre.org | | ode> command. Adversaries may also opt to enumerate processe |
| /techniques/T1059/008) commands such as `show processes` can | | s via `/proc`. On network devices, [Network Device CLI](ht |
| be used to display current running processes.(Citation: US- | | tps://attack.mitre.org/techniques/T1059/008) commands such a |
| CERT-TA18-106A)(Citation: show_processes_cisco_cmd) | | s `show processes` can be used to display current running pr |
| | | ocesses.(Citation: US-CERT-TA18-106A)(Citation: show_process |
| | | es_cisco_cmd) |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_system_requirements | ['Administrator, SYSTEM may provide better process ownership details'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 21:40:56.448000+00:00 | 2024-04-16 12:43:55.369000+00:00 |
| description | Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.
On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd) | Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`.
On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
[T1037.004] Boot or Logon Initialization Scripts: RC Scripts
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-27 19:58:01.927000+00:00 | 2024-04-16 12:22:29.150000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
[T1620] Reflective Code Loading
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may reflectively load code into a process in ord | t | Adversaries may reflectively load code into a process in ord |
| er to conceal the execution of malicious payloads. Reflectiv | | er to conceal the execution of malicious payloads. Reflectiv |
| e loading involves allocating then executing payloads direct | | e loading involves allocating then executing payloads direct |
| ly within the memory of the process, vice creating a thread | | ly within the memory of the process, vice creating a thread |
| or process backed by a file path on disk. Reflectively loade | | or process backed by a file path on disk (e.g., [Shared Modu |
| d payloads may be compiled binaries, anonymous files (only p | | les](https://attack.mitre.org/techniques/T1129)). Reflectiv |
| resent in RAM), or just snubs of fileless executable code (e | | ely loaded payloads may be compiled binaries, anonymous file |
| x: position-independent shellcode).(Citation: Introducing Do | | s (only present in RAM), or just snubs of fileless executabl |
| nut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart EL | | e code (ex: position-independent shellcode).(Citation: Intro |
| F Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) | | ducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: |
| Reflective code injection is very similar to [Process Inje | | Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandi |
| ction](https://attack.mitre.org/techniques/T1055) except tha | | ant BYOL) For example, the `Assembly.Load()` method executed |
| t the “injection” loads code into the processes’ own memory | | by [PowerShell](https://attack.mitre.org/techniques/T1059/0 |
| instead of that of a separate process. Reflective loading ma | | 01) may be abused to load raw code into the running process. |
| y evade process-based detections since the execution of the | | (Citation: Microsoft AssemblyLoad) Reflective code injectio |
| arbitrary code may be masked within a legitimate or otherwis | | n is very similar to [Process Injection](https://attack.mitr |
| e benign process. Reflectively loading payloads directly int | | e.org/techniques/T1055) except that the “injection” loads co |
| o memory may also avoid creating files or other artifacts on | | de into the processes’ own memory instead of that of a separ |
| disk, while also enabling malware to keep these payloads en | | ate process. Reflective loading may evade process-based dete |
| crypted (or otherwise obfuscated) until execution.(Citation: | | ctions since the execution of the arbitrary code may be mask |
| Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Inte | | ed within a legitimate or otherwise benign process. Reflecti |
| zer ACBackdoor)(Citation: S1 Old Rat New Tricks) | | vely loading payloads directly into memory may also avoid cr |
| | | eating files or other artifacts on disk, while also enabling |
| | | malware to keep these payloads encrypted (or otherwise obfu |
| | | scated) until execution.(Citation: Stuart ELF Memory)(Citati |
| | | on: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: |
| | | S1 Old Rat New Tricks) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-29 21:09:49.267000+00:00 | 2024-02-09 18:49:08.428000+00:00 |
| description | Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)
Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks) | Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).
Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)
Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft AssemblyLoad', 'description': 'Microsoft. (n.d.). Assembly.Load Method. Retrieved February 9, 2024.', 'url': 'https://learn.microsoft.com/dotnet/api/system.reflection.assembly.load'} |
| x_mitre_contributors | | Jiraput Thamsongkrah |
[T1219] Remote Access Software
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | An adversary may use legitimate desktop support and remote a | t | An adversary may use legitimate desktop support and remote a |
| ccess software to establish an interactive command and contr | | ccess software to establish an interactive command and contr |
| ol channel to target systems within networks. These services | | ol channel to target systems within networks. These services |
| , such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, | | , such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, |
| `LogMein`, `AmmyyAdmin`, and other remote monitoring and man | | `LogMein`, `AmmyyAdmin`, and other remote monitoring and man |
| agement (RMM) tools, are commonly used as legitimate technic | | agement (RMM) tools, are commonly used as legitimate technic |
| al support software and may be allowed by application contro | | al support software and may be allowed by application contro |
| l within a target environment.(Citation: Symantec Living off | | l within a target environment.(Citation: Symantec Living off |
| the Land)(Citation: CrowdStrike 2015 Global Threat Report)( | | the Land)(Citation: CrowdStrike 2015 Global Threat Report)( |
| Citation: CrySyS Blog TeamSpy) Remote access software may b | | Citation: CrySyS Blog TeamSpy) Remote access software may b |
| e installed and used post-compromise as an alternate communi | | e installed and used post-compromise as an alternate communi |
| cations channel for redundant access or as a way to establis | | cations channel for redundant access or as a way to establis |
| h an interactive remote desktop session with the target syst | | h an interactive remote desktop session with the target syst |
| em. They may also be used as a component of malware to estab | | em. They may also be used as a component of malware to estab |
| lish a reverse connection or back-connect to a service or ad | | lish a reverse connection or back-connect to a service or ad |
| versary controlled system. Adversaries may similarly abuse | | versary-controlled system. Adversaries may similarly abuse |
| response features included in EDR and other defensive tools | | response features included in EDR and other defensive tools |
| that enable remote access. Installation of many remote acc | | that enable remote access. Installation of many remote acc |
| ess software may also include persistence (e.g., the softwar | | ess software may also include persistence (e.g., the softwar |
| e's installation routine creates a [Windows Service](https:/ | | e's installation routine creates a [Windows Service](https:/ |
| /attack.mitre.org/techniques/T1543/003)). | | /attack.mitre.org/techniques/T1543/003)). Remote access modu |
| | | les/features may also exist as part of otherwise existing so |
| | | ftware (e.g., Google Chrome’s Remote Desktop).(Citation: Goo |
| | | gle Chrome Remote Desktop)(Citation: Chrome Remote Desktop) |
New Mitigations:
- M1042: Disable or Remove Feature or Program
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-28 16:23:51.194000+00:00 | 2024-04-12 23:52:30.489000+00:00 |
| description | An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). | An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary-controlled system.
Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Installation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop) |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Google Chrome Remote Desktop', 'description': 'Google. (n.d.). Retrieved March 14, 2024.', 'url': 'https://support.google.com/chrome/answer/1649523'} |
| external_references | | {'source_name': 'Chrome Remote Desktop', 'description': 'Huntress. (n.d.). Retrieved March 14, 2024.', 'url': 'https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708'} |
| x_mitre_contributors | | Dray Agha, @Purp1eW0lf, Huntress Labs |
[T1563] Remote Service Session Hijacking
Current version: 1.1
Version changed from: 1.0 → 1.1
New Mitigations:
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-23 23:35:58.129000+00:00 | 2024-02-26 14:21:37.818000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1021] Remote Services
Current version: 1.5
Version changed from: 1.4 → 1.5
New Mitigations:
- M1027: Password Policies
- M1035: Limit Access to Resource Over Network
- M1047: Audit
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-06-02 15:31:40.498000+00:00 | 2024-03-01 15:35:38.299000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
[T1496] Resource Hijacking
Current version: 1.5
Version changed from: 1.4 → 1.5
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-02 01:11:32.822000+00:00 | 2024-02-14 21:00:00.467000+00:00 |
| external_references[2]['url'] | https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc | https://medium.com/cloudsploit/the-danger-of-unused-aws-regions-af0bf1b878fc |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
[T1606.002] Forge Web Credentials: SAML Tokens
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-19 21:25:46.568000+00:00 | 2024-03-01 17:55:56.116000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
[T1053.005] Scheduled Task/Job: Scheduled Task
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 21:20:10.882000+00:00 | 2023-11-15 14:33:53.354000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
[T1053] Scheduled Task/Job
Current version: 2.3
Version changed from: 2.2 → 2.3
New Mitigations:
- M1022: Restrict File and Directory Permissions
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:52.697000+00:00 | 2024-03-01 15:29:46.832000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 2.2 | 2.3 |
[T1518.001] Software Discovery: Security Software Discovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may attempt to get a listing of security softwar | t | Adversaries may attempt to get a listing of security softwar |
| e, configurations, defensive tools, and sensors that are ins | | e, configurations, defensive tools, and sensors that are ins |
| talled on a system or in a cloud environment. This may inclu | | talled on a system or in a cloud environment. This may inclu |
| de things such as firewall rules and anti-virus. Adversaries | | de things such as cloud monitoring agents and anti-virus. Ad |
| may use the information from [Security Software Discovery]( | | versaries may use the information from [Security Software Di |
| https://attack.mitre.org/techniques/T1518/001) during automa | | scovery](https://attack.mitre.org/techniques/T1518/001) duri |
| ted discovery to shape follow-on behaviors, including whethe | | ng automated discovery to shape follow-on behaviors, includi |
| r or not the adversary fully infects the target and/or attem | | ng whether or not the adversary fully infects the target and |
| pts specific actions. Example commands that can be used to | | /or attempts specific actions. Example commands that can be |
| obtain security software information are [netsh](https://att | | used to obtain security software information are [netsh](ht |
| ack.mitre.org/software/S0108), <code>reg query</code> with [ | | tps://attack.mitre.org/software/S0108), <code>reg query</cod |
| Reg](https://attack.mitre.org/software/S0075), <code>dir</co | | e> with [Reg](https://attack.mitre.org/software/S0075), <cod |
| de> with [cmd](https://attack.mitre.org/software/S0106), and | | e>dir</code> with [cmd](https://attack.mitre.org/software/S0 |
| [Tasklist](https://attack.mitre.org/software/S0057), but ot | | 106), and [Tasklist](https://attack.mitre.org/software/S0057 |
| her indicators of discovery behavior may be more specific to | | ), but other indicators of discovery behavior may be more sp |
| the type of software or security system the adversary is lo | | ecific to the type of software or security system the advers |
| oking for. It is becoming more common to see macOS malware p | | ary is looking for. It is becoming more common to see macOS |
| erform checks for LittleSnitch and KnockKnock software. Adv | | malware perform checks for LittleSnitch and KnockKnock softw |
| ersaries may also utilize cloud APIs to discover the configu | | are. Adversaries may also utilize the [Cloud API](https://a |
| rations of firewall rules within an environment.(Citation: E | | ttack.mitre.org/techniques/T1059/009) to discover cloud-nati |
| xpel IO Evil in AWS) For example, the permitted IP ranges, p | | ve security software installed on compute infrastructure, su |
| orts or user accounts for the inbound/outbound rules of secu | | ch as the AWS CloudWatch agent, Azure VM Agent, and Google C |
| rity groups, virtual firewalls established within AWS for EC | | loud Monitor agent. These agents may collect metrics and l |
| 2 and/or VPC instances, can be revealed by the <code>Describ | | ogs from the VM, which may be centrally aggregated in a clou |
| eSecurityGroups</code> action with various request parameter | | d-based monitoring platform. |
| s. (Citation: DescribeSecurityGroups - Amazon Elastic Comput | | |
| e Cloud) | | |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-21 12:30:00.939000+00:00 | 2024-04-16 00:15:53.303000+00:00 |
| description | Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS) For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters. (Citation: DescribeSecurityGroups - Amazon Elastic Compute Cloud) | Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.
Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform. |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Expel IO Evil in AWS', 'description': 'A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.', 'url': 'https://expel.io/blog/finding-evil-in-aws/'} | |
| external_references | {'source_name': 'DescribeSecurityGroups - Amazon Elastic Compute Cloud', 'description': 'Amazon Web Services, Inc. . (2022). DescribeSecurityGroups. Retrieved January 28, 2022.', 'url': 'https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html'} | |
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1555.002] Credentials from Password Stores: Securityd Memory
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | An adversary may obtain root access (allowing them to read s | t | An adversary with root access may gather credentials by read |
| ecurityd’s memory), then they can scan through memory to fin | | ing `securityd`’s memory. `securityd` is a service/daemon re |
| d the correct sequence of keys in relatively few tries to de | | sponsible for implementing security protocols such as encryp |
| crypt the user’s logon keychain. This provides the adversary | | tion and authorization.(Citation: Apple Dev SecurityD) A pri |
| with all the plaintext passwords for users, WiFi, mail, bro | | vileged adversary may be able to scan through `securityd`'s |
| wsers, certificates, secure notes, etc.(Citation: OS X Keych | | memory to find the correct sequence of keys to decrypt the u |
| ain)(Citation: OSX Keydnap malware) In OS X prior to El Cap | | ser’s logon keychain. This may provide the adversary with va |
| itan, users with root access can read plaintext keychain pas | | rious plaintext passwords, such as those for users, WiFi, ma |
| swords of logged-in users because Apple’s keychain implement | | il, browsers, certificates, secure notes, etc.(Citation: OS |
| ation allows these credentials to be cached so that users ar | | X Keychain)(Citation: OSX Keydnap malware) In OS X prior to |
| e not repeatedly prompted for passwords.(Citation: OS X Keyc | | El Capitan, users with root access can read plaintext keych |
| hain)(Citation: External to DA, the OS X Way) Apple’s securi | | ain passwords of logged-in users because Apple’s keychain im |
| tyd utility takes the user’s logon password, encrypts it wit | | plementation allows these credentials to be cached so that u |
| h PBKDF2, and stores this master key in memory. Apple also u | | sers are not repeatedly prompted for passwords.(Citation: OS |
| ses a set of keys and algorithms to encrypt the user’s passw | | X Keychain)(Citation: External to DA, the OS X Way) Apple’s |
| ord, but once the master key is found, an adversary need onl | | `securityd` utility takes the user’s logon password, encryp |
| y iterate over the other values to unlock the final password | | ts it with PBKDF2, and stores this master key in memory. App |
| .(Citation: OS X Keychain) | | le also uses a set of keys and algorithms to encrypt the use |
| | | r’s password, but once the master key is found, an adversary |
| | | need only iterate over the other values to unlock the final |
| | | password.(Citation: OS X Keychain) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:43:20.609000+00:00 | 2024-03-29 16:37:34.772000+00:00 |
| description | An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain. This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain) | An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.(Citation: OS X Keychain)(Citation: External to DA, the OS X Way) Apple’s `securityd` utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.(Citation: OS X Keychain) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Apple Dev SecurityD', 'description': 'Apple. (n.d.). Security Server and Security Agent. Retrieved March 29, 2024.', 'url': 'https://developer.apple.com/library/archive/documentation/Security/Conceptual/Security_Overview/Architecture/Architecture.html'} |
[T1583.004] Acquire Infrastructure: Server
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may buy, lease, or rent physical servers that ca | t | Adversaries may buy, lease, rent, or obtain physical servers |
| n be used during targeting. Use of servers allows an adversa | | that can be used during targeting. Use of servers allows an |
| ry to stage, launch, and execute an operation. During post-c | | adversary to stage, launch, and execute an operation. Durin |
| ompromise activity, adversaries may utilize servers for vari | | g post-compromise activity, adversaries may utilize servers |
| ous tasks, including for Command and Control. Adversaries ma | | for various tasks, such as watering hole operations in [Driv |
| y use web servers to support support watering hole operation | | e-by Compromise](https://attack.mitre.org/techniques/T1189), |
| s, as in [Drive-by Compromise](https://attack.mitre.org/tech | | enabling [Phishing](https://attack.mitre.org/techniques/T15 |
| niques/T1189), or email servers to support [Phishing](https: | | 66) operations, or facilitating [Command and Control](https: |
| //attack.mitre.org/techniques/T1566) operations. Instead of | | //attack.mitre.org/tactics/TA0011). Instead of compromising |
| compromising a third-party [Server](https://attack.mitre.org | | a third-party [Server](https://attack.mitre.org/techniques/T |
| /techniques/T1584/004) or renting a [Virtual Private Server] | | 1584/004) or renting a [Virtual Private Server](https://atta |
| (https://attack.mitre.org/techniques/T1583/003), adversaries | | ck.mitre.org/techniques/T1583/003), adversaries may opt to c |
| may opt to configure and run their own servers in support o | | onfigure and run their own servers in support of operations. |
| f operations. Adversaries may only need a lightweight setup | | Free trial periods of cloud servers may also be abused.(Cit |
| if most of their activities will take place using online in | | ation: Free Trial PurpleUrchin)(Citation: Freejacked) Adve |
| frastructure. Or, they may need to build extensive infrastru | | rsaries may only need a lightweight setup if most of their a |
| cture if they want to test, communicate, and control other a | | ctivities will take place using online infrastructure. Or, t |
| spects of their activities on their own systems.(Citation: N | | hey may need to build extensive infrastructure if they want |
| YTStuxnet) | | to test, communicate, and control other aspects of their act |
| | | ivities on their own systems.(Citation: NYTStuxnet) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 20:18:42.003000+00:00 | 2024-02-28 21:22:52.176000+00:00 |
| description | Adversaries may buy, lease, or rent physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Adversaries may use web servers to support support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations. Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations.
Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet) | Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked)
Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Freejacked', 'description': 'Clark, Michael. (2023, August 14). Google’s Vertex AI Platform Gets Freejacked. Retrieved February 28, 2024.', 'url': 'https://sysdig.com/blog/googles-vertex-ai-platform-freejacked/'} |
| external_references | | {'source_name': 'Free Trial PurpleUrchin', 'description': 'Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.', 'url': 'https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/'} |
[T1518] Software Discovery
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may attempt to get a listing of software and sof | t | Adversaries may attempt to get a listing of software and sof |
| tware versions that are installed on a system or in a cloud | | tware versions that are installed on a system or in a cloud |
| environment. Adversaries may use the information from [Softw | | environment. Adversaries may use the information from [Softw |
| are Discovery](https://attack.mitre.org/techniques/T1518) du | | are Discovery](https://attack.mitre.org/techniques/T1518) du |
| ring automated discovery to shape follow-on behaviors, inclu | | ring automated discovery to shape follow-on behaviors, inclu |
| ding whether or not the adversary fully infects the target a | | ding whether or not the adversary fully infects the target a |
| nd/or attempts specific actions. Adversaries may attempt to | | nd/or attempts specific actions. Such software may be deplo |
| enumerate software for a variety of reasons, such as figuri | | yed widely across the environment for configuration manageme |
| ng out what security measures are present or if the compromi | | nt or security reasons, such as [Software Deployment Tools]( |
| sed system has a version of software that is vulnerable to [ | | https://attack.mitre.org/techniques/T1072), and may allow ad |
| Exploitation for Privilege Escalation](https://attack.mitre. | | versaries broad access to infect devices or move laterally. |
| org/techniques/T1068). | | Adversaries may attempt to enumerate software for a variety |
| | | of reasons, such as figuring out what security measures are |
| | | present or if the compromised system has a version of softw |
| | | are that is vulnerable to [Exploitation for Privilege Escala |
| | | tion](https://attack.mitre.org/techniques/T1068). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | </ |