| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse cloud management services to execute c | t | 1 | Adversaries may abuse cloud management services to execute c |
| > | ommands within virtual machines or hybrid-joined devices. Re | > | ommands within virtual machines. Resources such as AWS Syste | ||
| > | sources such as AWS Systems Manager, Azure RunCommand, and R | > | ms Manager, Azure RunCommand, and Runbooks allow users to re | ||
| > | unbooks allow users to remotely run scripts in virtual machi | > | motely run scripts in virtual machines by leveraging install | ||
| > | nes by leveraging installed virtual machine agents. Similarl | > | ed virtual machine agents. (Citation: AWS Systems Manager Ru | ||
| > | y, in Azure AD environments, Microsoft Endpoint Manager allo | > | n Command)(Citation: Microsoft Run Command) If an adversary | ||
| > | ws Global or Intune Administrators to run scripts as SYSTEM | > | gains administrative access to a cloud environment, they ma | ||
| > | on on-premises devices joined to the Azure AD.(Citation: AWS | > | y be able to abuse cloud management services to execute comm | ||
| > | Systems Manager Run Command)(Citation: Microsoft Run Comman | > | ands in the environment\u2019s virtual machines. Additionally, an | ||
| > | d)(Citation: SpecterOps Lateral Movement from Azure to On-Pr | > | adversary that compromises a service provider or delegated | ||
| > | em AD 2020) If an adversary gains administrative access to | > | administrator account may similarly be able to leverage a [T | ||
| > | a cloud environment, they may be able to abuse cloud managem | > | rusted Relationship](https://attack.mitre.org/techniques/T11 | ||
| > | ent services to execute commands in the environment\u2019s virtua | > | 99) to execute commands in connected virtual machines.(Citat | ||
| > | l machines or on-premises hybrid-joined devices. Additionall | > | ion: MSTIC Nobelium Oct 2021) | ||
| > | y, an adversary that compromises a service provider or deleg | ||||
| > | ated administrator account may similarly be able to leverage | ||||
| > | a [Trusted Relationship](https://attack.mitre.org/technique | ||||
| > | s/T1199) to execute commands in connected virtual machines.( | ||||
| > | Citation: MSTIC Nobelium Oct 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify client software binaries to establish | t | 1 | Adversaries may modify host software binaries to establish p |
| > | persistent access to systems. Client software enables users | > | ersistent access to systems. Software binaries/executables p | ||
| > | to access services provided by a server. Common client soft | > | rovide a wide range of system commands or services, programs | ||
| > | ware types are SSH clients, FTP clients, email clients, and | > | , and libraries. Common software binaries are SSH clients, F | ||
| > | web browsers. Adversaries may make modifications to client | > | TP clients, email clients, web browsers, and many other user | ||
| > | software binaries to carry out malicious tasks when those ap | > | or server applications. Adversaries may establish persiste | ||
| > | plications are in use. For example, an adversary may copy so | > | nce though modifications to host software binaries. For exam | ||
| > | urce code for the client software, add a backdoor, compile f | > | ple, an adversary may replace or otherwise infect a legitima | ||
| > | or the target, and replace the legitimate application binary | > | te application binary (or support files) with a backdoor. Si | ||
| > | (or support files) with the backdoored one. An adversary ma | > | nce these binaries may be routinely executed by applications | ||
| > | y also modify an existing binary by patching in malicious fu | > | or the user, the adversary can leverage this for persistent | ||
| > | nctionality (e.g., IAT Hooking/Entry point patching)(Citatio | > | access to the host. An adversary may also modify an existi | ||
| > | n: Unit42 Banking Trojans Hooking 2022) prior to the binary\u2019 | > | ng binary by patching in malicious functionality (e.g., IAT | ||
| > | s legitimate execution. For example, an adversary may modify | > | Hooking/Entry point patching)(Citation: Unit42 Banking Troja | ||
| > | the entry point of a binary to point to malicious code patc | > | ns Hooking 2022) prior to the binary\u2019s legitimate execution. | ||
| > | hed in by the adversary before resuming normal execution flo | > | For example, an adversary may modify the entry point of a b | ||
| > | w.(Citation: ESET FontOnLake Analysis 2021) Since these app | > | inary to point to malicious code patched in by the adversary | ||
| > | lications may be routinely executed by the user, the adversa | > | before resuming normal execution flow.(Citation: ESET FontO | ||
| > | ry can leverage this for persistent access to the host. | > | nLake Analysis 2021) |
Set federation settings on domain and Set domain authentication.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods)(Citation: Microsoft 365 Defender Solorigate) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)\n\nConsider monitoring for commands/cmdlets and command-line arguments that may be leveraged to modify domain policy settings.(Citation: Microsoft - Update or Repair Federated domain) Some domain policy modifications, such as changes to federation settings, are likely to be rare.(Citation: Microsoft 365 Defender Solorigate)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows",
"Azure AD",
"SaaS"
],
"x_mitre_version": "3.0",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_contributors']\": [\"Obsidian Security\"], \"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-19 04:27:31.884000+00:00\", \"old_value\": \"2021-02-09 15:52:24.598000+00:00\"}, \"root['name']\": {\"new_value\": \"Domain or Tenant Policy Modification\", \"old_value\": \"Domain Policy Modification\"}, \"root['description']\": {\"new_value\": \"Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.\\n\\nModifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trusts relationships between domains or tenants.\\n\\nWith sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential attacks malicious outcomes that can stem from this abuse. Examples of such abuse include: \\n\\n* modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions)\\n* modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)\\n* changing configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).\\n* adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant (Citation: Okta Cross-Tenant Impersonation 2023)\\n\\nAdversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\", \"old_value\": \"Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments. Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network. The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment. Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.\\n\\nWith sufficient permissions, adversaries can modify domain policy settings. Since domain configuration settings control many of the interactions within the Active Directory (AD) environment, there are a great number of potential attacks that can stem from this abuse. Examples of such abuse include modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) Adversaries can also change configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).\\n\\nAdversaries may temporarily modify domain policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,12 @@\\n-Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments. Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network. The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment. Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.\\n+Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses and/or escalate privileges in centrally managed environments. Such services provide a centralized means of managing identity resources such as devices and accounts, and often include configuration settings that may apply between domains or tenants such as trust relationships, identity syncing, or identity federation.\\n \\n-With sufficient permissions, adversaries can modify domain policy settings. Since domain configuration settings control many of the interactions within the Active Directory (AD) environment, there are a great number of potential attacks that can stem from this abuse. Examples of such abuse include modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks) Adversaries can also change configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).\\n+Modifications to domain or tenant settings may include altering domain Group Policy Objects (GPOs) in Microsoft Active Directory (AD) or changing trust settings for domains, including federation trusts relationships between domains or tenants.\\n \\n-Adversaries may temporarily modify domain policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\\n+With sufficient permissions, adversaries can modify domain or tenant policy settings. Since configuration settings for these services apply to a large number of identity resources, there are a great number of potential attacks malicious outcomes that can stem from this abuse. Examples of such abuse include: \\n+\\n+* modifying GPOs to push a malicious [Scheduled Task](https://attack.mitre.org/techniques/T1053/005) to computers throughout the domain environment(Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions)\\n+* modifying domain trusts to include an adversary-controlled domain, allowing adversaries to forge access tokens that will subsequently be accepted by victim domain resources(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)\\n+* changing configuration settings within the AD environment to implement a [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207).\\n+* adding new, adversary-controlled federated identity providers to identity tenants, allowing adversaries to authenticate as any user managed by the victim tenant (Citation: Okta Cross-Tenant Impersonation 2023)\\n+\\n+Adversaries may temporarily modify domain or tenant policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.0\", \"old_value\": \"2.0\"}}, \"iterable_item_added\": {\"root['external_references'][7]\": {\"source_name\": \"Okta Cross-Tenant Impersonation 2023\", \"description\": \"Okta Defensive Cyber Operations. (2023, August 31). Cross-Tenant Impersonation: Prevention and Detection. Retrieved February 15, 2024.\", \"url\": \"https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection\"}, \"root['x_mitre_data_sources'][4]\": \"Application Log: Application Log Content\", \"root['x_mitre_platforms'][2]\": \"SaaS\"}}",
"previous_version": "2.0",
"version_change": "2.0 \u2192 3.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify the configuration settings of a domai | t | 1 | Adversaries may modify the configuration settings of a domai |
| > | n to evade defenses and/or escalate privileges in domain env | > | n or identity tenant to evade defenses and/or escalate privi | ||
| > | ironments. Domains provide a centralized means of managing h | > | leges in centrally managed environments. Such services provi | ||
| > | ow computer resources (ex: computers, user accounts) can act | > | de a centralized means of managing identity resources such a | ||
| > | , and interact with each other, on a network. The policy of | > | s devices and accounts, and often include configuration sett | ||
| > | the domain also includes configuration settings that may app | > | ings that may apply between domains or tenants such as trust | ||
| > | ly between domains in a multi-domain/forest environment. Mod | > | relationships, identity syncing, or identity federation. M | ||
| > | ifications to domain settings may include altering domain Gr | > | odifications to domain or tenant settings may include alteri | ||
| > | oup Policy Objects (GPOs) or changing trust settings for dom | > | ng domain Group Policy Objects (GPOs) in Microsoft Active Di | ||
| > | ains, including federation trusts. With sufficient permissi | > | rectory (AD) or changing trust settings for domains, includi | ||
| > | ons, adversaries can modify domain policy settings. Since do | > | ng federation trusts relationships between domains or tenant | ||
| > | main configuration settings control many of the interactions | > | s. With sufficient permissions, adversaries can modify doma | ||
| > | within the Active Directory (AD) environment, there are a g | > | in or tenant policy settings. Since configuration settings f | ||
| > | reat number of potential attacks that can stem from this abu | > | or these services apply to a large number of identity resour | ||
| > | se. Examples of such abuse include modifying GPOs to push a | > | ces, there are a great number of potential attacks malicious | ||
| > | malicious [Scheduled Task](https://attack.mitre.org/techniqu | > | outcomes that can stem from this abuse. Examples of such ab | ||
| > | es/T1053/005) to computers throughout the domain environment | > | use include: * modifying GPOs to push a malicious [Schedu | ||
| > | (Citation: ADSecurity GPO Persistence 2016)(Citation: Wald0 | > | led Task](https://attack.mitre.org/techniques/T1053/005) to | ||
| > | Guide to GPOs)(Citation: Harmj0y Abusing GPO Permissions) or | > | computers throughout the domain environment(Citation: ADSecu | ||
| > | modifying domain trusts to include an adversary controlled | > | rity GPO Persistence 2016)(Citation: Wald0 Guide to GPOs)(Ci | ||
| > | domain where they can control access tokens that will subseq | > | tation: Harmj0y Abusing GPO Permissions) * modifying domain | ||
| > | uently be accepted by victim domain resources.(Citation: Mic | > | trusts to include an adversary-controlled domain, allowing a | ||
| > | rosoft - Customer Guidance on Recent Nation-State Cyber Atta | > | dversaries to forge access tokens that will subsequently be | ||
| > | cks) Adversaries can also change configuration settings with | > | accepted by victim domain resources(Citation: Microsoft - C | ||
| > | in the AD environment to implement a [Rogue Domain Controlle | > | ustomer Guidance on Recent Nation-State Cyber Attacks) * cha | ||
| > | r](https://attack.mitre.org/techniques/T1207). Adversaries | > | nging configuration settings within the AD environment to im | ||
| > | may temporarily modify domain policy, carry out a malicious | > | plement a [Rogue Domain Controller](https://attack.mitre.org | ||
| > | action(s), and then revert the change to remove suspicious i | > | /techniques/T1207). * adding new, adversary-controlled feder | ||
| > | ndicators. | > | ated identity providers to identity tenants, allowing advers | ||
| > | aries to authenticate as any user managed by the victim tena | ||||
| > | nt (Citation: Okta Cross-Tenant Impersonation 2023) Adversa | ||||
| > | ries may temporarily modify domain or tenant policy, carry o | ||||
| > | ut a malicious action(s), and then revert the change to remo | ||||
| > | ve suspicious indicators. |
Set federation settings on domain and Set domain authentication.(Citation: Microsoft - Azure Sentinel ADFSDomainTrustMods) This may also include monitoring for Event ID 307 which can be correlated to relevant Event ID 510 with the same Instance ID for change details.(Citation: Sygnia Golden SAML)(Citation: CISA SolarWinds Cloud Detection)\n\nMonitor for PowerShell commands such as: Update-MSOLFederatedDomain \u2013DomainName: \"Federated Domain Name\", or Update-MSOLFederatedDomain \u2013DomainName: \"Federated Domain Name\" \u2013supportmultipledomain.(Citation: Microsoft - Update or Repair Federated domain)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Windows",
"Azure AD",
"SaaS"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-19 04:27:51.388000+00:00\", \"old_value\": \"2022-10-21 16:09:14.555000+00:00\"}, \"root['name']\": {\"new_value\": \"Trust Modification\", \"old_value\": \"Domain Trust Modification\"}, \"root['description']\": {\"new_value\": \"Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.\\n\\nManipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002) without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain) \\n\\nAn adversary may also add a new federated identity provider to an identity tenant such as Okta, which may enable the adversary to authenticate as any user of the tenant.(Citation: Okta Cross-Tenant Impersonation 2023)\", \"old_value\": \"Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.\\n\\nManipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert a domain to a federated domain, which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain) \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,5 @@\\n-Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges. Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.\\n+Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.\\n \\n-Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002), without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert a domain to a federated domain, which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain) \\n+Manipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002) without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain) \\n+\\n+An adversary may also add a new federated identity provider to an identity tenant such as Okta, which may enable the adversary to authenticate as any user of the tenant.(Citation: Okta Cross-Tenant Impersonation 2023)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['external_references'][6]\": {\"source_name\": \"Okta Cross-Tenant Impersonation 2023\", \"description\": \"Okta Defensive Cyber Operations. (2023, August 31). Cross-Tenant Impersonation: Prevention and Detection. Retrieved February 15, 2024.\", \"url\": \"https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection\"}, \"root['x_mitre_contributors'][2]\": \"Obsidian Security\", \"root['x_mitre_data_sources'][1]\": \"Application Log: Application Log Content\", \"root['x_mitre_platforms'][2]\": \"SaaS\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add new domain trusts or modify the properti | t | 1 | Adversaries may add new domain trusts, modify the properties |
| > | es of existing domain trusts to evade defenses and/or elevat | > | of existing domain trusts, or otherwise change the configur | ||
| > | e privileges. Domain trust details, such as whether or not a | > | ation of trust relationships between domains and tenants to | ||
| > | domain is federated, allow authentication and authorization | > | evade defenses and/or elevate privileges.Trust details, such | ||
| > | properties to apply between domains for the purpose of acce | > | as whether or not user identities are federated, allow auth | ||
| > | ssing shared resources.(Citation: Microsoft - Azure AD Feder | > | entication and authorization properties to apply between dom | ||
| > | ation) These trust objects may include accounts, credentials | > | ains or tenants for the purpose of accessing shared resource | ||
| > | , and other authentication material applied to servers, toke | > | s.(Citation: Microsoft - Azure AD Federation) These trust ob | ||
| > | ns, and domains. Manipulating the domain trusts may allow a | > | jects may include accounts, credentials, and other authentic | ||
| > | n adversary to escalate privileges and/or evade defenses by | > | ation material applied to servers, tokens, and domains. Man | ||
| > | modifying settings to add objects which they control. For ex | > | ipulating these trusts may allow an adversary to escalate pr | ||
| > | ample, this may be used to forge [SAML Tokens](https://attac | > | ivileges and/or evade defenses by modifying settings to add | ||
| > | k.mitre.org/techniques/T1606/002), without the need to compr | > | objects which they control. For example, in Microsoft Active | ||
| > | omise the signing certificate to forge new credentials. Inst | > | Directory (AD) environments, this may be used to forge [SAM | ||
| > | ead, an adversary can manipulate domain trusts to add their | > | L Tokens](https://attack.mitre.org/techniques/T1606/002) wit | ||
| > | own signing certificate. An adversary may also convert a dom | > | hout the need to compromise the signing certificate to forge | ||
| > | ain to a federated domain, which may enable malicious trust | > | new credentials. Instead, an adversary can manipulate domai | ||
| > | modifications such as altering the claim issuance rules to l | > | n trusts to add their own signing certificate. An adversary | ||
| > | og in any valid set of credentials as a specified user.(Cita | > | may also convert an AD domain to a federated domain using Ac | ||
| > | tion: AADInternals zure AD Federated Domain) | > | tive Directory Federation Services (AD FS), which may enable | ||
| > | malicious trust modifications such as altering the claim is | ||||
| > | suance rules to log in any valid set of credentials as a spe | ||||
| > | cified user.(Citation: AADInternals zure AD Federated Domain | ||||
| > | ) An adversary may also add a new federated identity provi | ||||
| > | der to an identity tenant such as Okta, which may enable the | ||||
| > | adversary to authenticate as any user of the tenant.(Citati | ||||
| > | on: Okta Cross-Tenant Impersonation 2023) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gain access to and use third-party software | t | 1 | Adversaries may gain access to and use centralized software |
| > | suites installed within an enterprise network, such as admin | > | suites installed within an enterprise to execute commands an | ||
| > | istration, monitoring, and deployment systems, to move later | > | d move laterally through the network. Configuration manageme | ||
| > | ally through the network. Third-party applications and softw | > | nt and software deployment applications may be used in an en | ||
| > | are deployment systems may be in use in the network environm | > | terprise network or cloud environment for routine administra | ||
| > | ent for administration purposes (e.g., SCCM, HBSS, Altiris, | > | tion purposes. These systems may also be integrated into CI/ | ||
| > | etc.). Access to a third-party network-wide or enterprise | > | CD pipelines. Examples of such solutions include: SCCM, HBSS | ||
| > | -wide software system may enable an adversary to have remote | > | , Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, | ||
| > | code execution on all systems that are connected to such a | > | and GCP Deployment Manager. Access to network-wide or en | ||
| > | system. The access may be used to laterally move to other sy | > | terprise-wide endpoint management software may enable an adv | ||
| > | stems, gather information, or cause a specific effect, such | > | ersary to achieve remote code execution on all connected sys | ||
| > | as wiping the hard drives on all endpoints. Network infrastr | > | tems. The access may be used to laterally move to other syst | ||
| > | ucture may also have administration tools that can be simila | > | ems, gather information, or cause a specific effect, such as | ||
| > | rly abused by adversaries. (Citation: Fortinet Zero-Day and | > | wiping the hard drives on all endpoints. SaaS-based config | ||
| > | Custom Malware Used by Suspected Chinese Actor in Espionage | > | uration management services may allow for broad [Cloud Admin | ||
| > | Operation) The permissions required for this action vary by | > | istration Command](https://attack.mitre.org/techniques/T1651 | ||
| > | system configuration; local credentials may be sufficient w | > | ) on cloud-hosted instances, as well as the execution of arb | ||
| > | ith direct access to the third-party system, or specific dom | > | itrary commands on on-premises endpoints. For example, Micro | ||
| > | ain credentials may be required. However, the system may req | > | soft Configuration Manager allows Global or Intune Administr | ||
| > | uire an administrative account to log in or to perform it's | > | ators to run scripts as SYSTEM on on-premises devices joined | ||
| > | intended purpose. | > | to Azure AD.(Citation: SpecterOps Lateral Movement from Azu | ||
| > | re to On-Prem AD 2020) Such services may also utilize [Web P | ||||
| > | rotocols](https://attack.mitre.org/techniques/T1071/001) to | ||||
| > | communicate back to adversary owned infrastructure.(Citation | ||||
| > | : Mitiga Security Advisory: SSM Agent as Remote Access Troja | ||||
| > | n) Network infrastructure devices may also have configurati | ||||
| > | on management tools that can be similarly abused by adversar | ||||
| > | ies.(Citation: Fortinet Zero-Day and Custom Malware Used by | ||||
| > | Suspected Chinese Actor in Espionage Operation) The permiss | ||||
| > | ions required for this action vary by system configuration; | ||||
| > | local credentials may be sufficient with direct access to th | ||||
| > | e third-party system, or specific domain credentials may be | ||||
| > | required. However, the system may require an administrative | ||||
| > | account to log in or to access specific functionality. |
/usr/libexec/security_authtrampoline executions which may indicate that AuthorizationExecuteWithPrivileges is being executed. MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called. Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.\n\nOn Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo). This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the LOG_INPUT and LOG_OUTPUT directives in the /etc/sudoers file.\n\nThere are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations. Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed. Some UAC bypass methods rely on modifying specific, user-accessible Registry settings. Analysts should monitor Registry settings for unauthorized changes.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Office 365",
"IaaS",
"Google Workspace",
"Azure AD"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-15 20:52:09.908000+00:00\", \"old_value\": \"2023-10-02 00:47:11.369000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.(Citation: TechNet How UAC Works)(Citation: sudo man page 2018) An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.(Citation: OSX Keydnap malware)(Citation: Fortinet Fareit)\", \"old_value\": \"Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"TechNet How UAC Works\", \"description\": \"Lich, B. (2016, May 31). How User Account Control Works. Retrieved June 3, 2016.\", \"url\": \"https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works\"}, \"root['external_references'][2]\": {\"source_name\": \"OSX Keydnap malware\", \"description\": \"Marc-Etienne M.Leveille. (2016, July 6). New OSX/Keydnap malware is hungry for credentials. Retrieved July 3, 2017.\", \"url\": \"https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/\"}, \"root['external_references'][3]\": {\"source_name\": \"Fortinet Fareit\", \"description\": \"Salvio, J., Joven, R. (2016, December 16). Malicious Macro Bypasses UAC to Elevate Privilege for Fareit Malware. Retrieved December 27, 2016.\", \"url\": \"https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware\"}, \"root['external_references'][4]\": {\"source_name\": \"sudo man page 2018\", \"description\": \"Todd C. Miller. (2018). Sudo Man Page. Retrieved March 19, 2018.\", \"url\": \"https://www.sudo.ws/\"}}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may circumvent mechanisms designed to control el | t | 1 | Adversaries may circumvent mechanisms designed to control el |
| > | evate privileges to gain higher-level permissions. Most mode | > | evate privileges to gain higher-level permissions. Most mode | ||
| > | rn systems contain native elevation control mechanisms that | > | rn systems contain native elevation control mechanisms that | ||
| > | are intended to limit privileges that a user can perform on | > | are intended to limit privileges that a user can perform on | ||
| > | a machine. Authorization has to be granted to specific users | > | a machine. Authorization has to be granted to specific users | ||
| > | in order to perform tasks that can be considered of higher | > | in order to perform tasks that can be considered of higher | ||
| > | risk. An adversary can perform several methods to take advan | > | risk.(Citation: TechNet How UAC Works)(Citation: sudo man pa | ||
| > | tage of built-in control mechanisms in order to escalate pri | > | ge 2018) An adversary can perform several methods to take ad | ||
| > | vileges on a system. | > | vantage of built-in control mechanisms in order to escalate | ||
| > | privileges on a system.(Citation: OSX Keydnap malware)(Citat | ||||
| > | ion: Fortinet Fareit) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse permission configurations that allow t | t | 1 | Adversaries may abuse permission configurations that allow t |
| > | hem to gain temporarily elevated access to cloud resources. | > | hem to gain temporarily elevated access to cloud resources. | ||
| > | Many cloud environments allow administrators to grant user o | > | Many cloud environments allow administrators to grant user o | ||
| > | r service accounts permission to request just-in-time access | > | r service accounts permission to request just-in-time access | ||
| > | to roles, impersonate other accounts, pass roles onto resou | > | to roles, impersonate other accounts, pass roles onto resou | ||
| > | rces and services, or otherwise gain short-term access to a | > | rces and services, or otherwise gain short-term access to a | ||
| > | set of privileges that may be distinct from their own. Jus | > | set of privileges that may be distinct from their own. Jus | ||
| > | t-in-time access is a mechanism for granting additional role | > | t-in-time access is a mechanism for granting additional role | ||
| > | s to cloud accounts in a granular, temporary manner. This al | > | s to cloud accounts in a granular, temporary manner. This al | ||
| > | lows accounts to operate with only the permissions they need | > | lows accounts to operate with only the permissions they need | ||
| > | on a daily basis, and to request additional permissions as | > | on a daily basis, and to request additional permissions as | ||
| > | necessary. Sometimes just-in-time access requests are config | > | necessary. Sometimes just-in-time access requests are config | ||
| > | ured to require manual approval, while other times the desir | > | ured to require manual approval, while other times the desir | ||
| > | ed permissions are automatically granted.(Citation: Google C | > | ed permissions are automatically granted.(Citation: Azure Ju | ||
| > | loud Just in Time Access 2023)(Citation: Azure Just in Time | > | st in Time Access 2023) Account impersonation allows user o | ||
| > | Access 2023) Account impersonation allows user or service a | > | r service accounts to temporarily act with the permissions o | ||
| > | ccounts to temporarily act with the permissions of another a | > | f another account. For example, in GCP users with the `iam.s | ||
| > | ccount. For example, in GCP users with the `iam.serviceAccou | > | erviceAccountTokenCreator` role can create temporary access | ||
| > | ntTokenCreator` role can create temporary access tokens or s | > | tokens or sign arbitrary payloads with the permissions of a | ||
| > | ign arbitrary payloads with the permissions of a service acc | > | service account, while service accounts with domain-wide del | ||
| > | ount.(Citation: Google Cloud Service Account Authentication | > | egation permission are permitted to impersonate Google Works | ||
| > | Roles) In Exchange Online, the `ApplicationImpersonation` ro | > | pace accounts.(Citation: Google Cloud Service Account Authen | ||
| > | le allows a service account to use the permissions associate | > | tication Roles)(Citation: Hunters Domain Wide Delegation Goo | ||
| > | d with specified user accounts.(Citation: Microsoft Imperson | > | gle Workspace 2023)(Citation: Google Cloud Just in Time Acce | ||
| > | ation and EWS in Exchange) Many cloud environments also in | > | ss 2023)(Citation: Palo Alto Unit 42 Google Workspace Domain | ||
| > | clude mechanisms for users to pass roles to resources that a | > | Wide Delegation 2023) In Exchange Online, the `ApplicationI | ||
| > | llow them to perform tasks and authenticate to other service | > | mpersonation` role allows a service account to use the permi | ||
| > | s. While the user that creates the resource does not directl | > | ssions associated with specified user accounts.(Citation: Mi | ||
| > | y assume the role they pass to it, they may still be able to | > | crosoft Impersonation and EWS in Exchange) Many cloud envi | ||
| > | take advantage of the role's access -- for example, by conf | > | ronments also include mechanisms for users to pass roles to | ||
| > | iguring the resource to perform certain actions with the per | > | resources that allow them to perform tasks and authenticate | ||
| > | missions it has been granted. In AWS, users with the `PassRo | > | to other services. While the user that creates the resource | ||
| > | le` permission can allow a service they create to assume a g | > | does not directly assume the role they pass to it, they may | ||
| > | iven role, while in GCP, users with the `iam.serviceAccountU | > | still be able to take advantage of the role's access -- for | ||
| > | ser` role can attach a service account to a resource.(Citati | > | example, by configuring the resource to perform certain acti | ||
| > | on: AWS PassRole)(Citation: Google Cloud Service Account Aut | > | ons with the permissions it has been granted. In AWS, users | ||
| > | hentication Roles) While users require specific role assign | > | with the `PassRole` permission can allow a service they crea | ||
| > | ments in order to use any of these features, cloud administr | > | te to assume a given role, while in GCP, users with the `iam | ||
| > | ators may misconfigure permissions. This could result in esc | > | .serviceAccountUser` role can attach a service account to a | ||
| > | alation paths that allow adversaries to gain access to resou | > | resource.(Citation: AWS PassRole)(Citation: Google Cloud Ser | ||
| > | rces beyond what was originally intended.(Citation: Rhino Go | > | vice Account Authentication Roles) While users require spec | ||
| > | ogle Cloud Privilege Escalation)(Citation: Rhino Security La | > | ific role assignments in order to use any of these features, | ||
| > | bs AWS Privilege Escalation) **Note:** this technique is di | > | cloud administrators may misconfigure permissions. This cou | ||
| > | stinct from [Additional Cloud Roles](https://attack.mitre.or | > | ld result in escalation paths that allow adversaries to gain | ||
| > | g/techniques/T1098/003), which involves assigning permanent | > | access to resources beyond what was originally intended.(Ci | ||
| > | roles to accounts rather than abusing existing permissions s | > | tation: Rhino Google Cloud Privilege Escalation)(Citation: R | ||
| > | tructures to gain temporarily elevated access to resources. | > | hino Security Labs AWS Privilege Escalation) **Note:** this | ||
| > | However, adversaries that compromise a sufficiently privileg | > | technique is distinct from [Additional Cloud Roles](https:/ | ||
| > | ed account may grant another account they control [Additiona | > | /attack.mitre.org/techniques/T1098/003), which involves assi | ||
| > | l Cloud Roles](https://attack.mitre.org/techniques/T1098/003 | > | gning permanent roles to accounts rather than abusing existi | ||
| > | ) that would allow them to also abuse these features. This m | > | ng permissions structures to gain temporarily elevated acces | ||
| > | ay also allow for greater stealth than would be had by direc | > | s to resources. However, adversaries that compromise a suffi | ||
| > | tly using the highly privileged account, especially when log | > | ciently privileged account may grant another account they co | ||
| > | s do not clarify when role impersonation is taking place.(Ci | > | ntrol [Additional Cloud Roles](https://attack.mitre.org/tech | ||
| > | tation: CrowdStrike StellarParticle January 2022) | > | niques/T1098/003) that would allow them to also abuse these | ||
| > | features. This may also allow for greater stealth than would | ||||
| > | be had by directly using the highly privileged account, esp | ||||
| > | ecially when logs do not clarify when role impersonation is | ||||
| > | taking place.(Citation: CrowdStrike StellarParticle January | ||||
| > | 2022) |
CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\u2019s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/001",
"external_id": "T1098.001"
},
{
"source_name": "Crowdstrike AWS User Federation Persistence",
"description": " Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.",
"url": "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"
},
{
"source_name": "Expel IO Evil in AWS",
"description": "A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.",
"url": "https://expel.io/blog/finding-evil-in-aws/"
},
{
"source_name": "SpecterOps Azure Privilege Escalation",
"description": "Andy Robbins. (2021, October 12). Azure Privilege Escalation via Service Principal Abuse. Retrieved April 1, 2022.",
"url": "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5"
},
{
"source_name": "Demystifying Azure AD Service Principals",
"description": "Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020.",
"url": "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/"
},
{
"source_name": "GCP SSH Key Add",
"description": "Google. (n.d.). gcloud compute os-login ssh-keys add. Retrieved October 1, 2020.",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/os-login/ssh-keys/add"
},
{
"source_name": "Blue Cloud of Death Video",
"description": "Kunz, Bruce. (2018, October 14). Blue Cloud of Death: Red Teaming Azure. Retrieved November 21, 2019.",
"url": "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815"
},
{
"source_name": "Blue Cloud of Death",
"description": "Kunz, Bryce. (2018, May 11). Blue Cloud of Death: Red Teaming Azure. Retrieved October 23, 2019.",
"url": "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1"
},
{
"source_name": "Microsoft SolarWinds Customer Guidance",
"description": "MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.",
"url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
},
{
"source_name": "Expel Behind the Scenes",
"description": "S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020.",
"url": "https://expel.io/blog/behind-the-scenes-expel-soc-alert-aws/"
},
{
"source_name": "Sysdig ScarletEel 2.0",
"description": "SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. (2023, July 11). SCARLETEEL 2.0: Fargate, Kubernetes, and Crypto. Retrieved July 12, 2023.",
"url": "https://sysdig.com/blog/scarleteel-2-0/"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"description": "Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation \u2013 Methods and Mitigation. Retrieved May 27, 2022.",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Expel",
"Oleg Kolesnikov, Securonix",
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Zur Ulianitzky, XM Cyber",
"Alex Soler, AttackIQ",
"Dylan Silva, AWS Security",
"Arad Inbar, Fidelis Security"
],
"x_mitre_data_sources": [
"User Account: User Account Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor Azure Activity Logs for Service Principal and Application modifications. Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.\n\nMonitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"Azure AD",
"SaaS"
],
"x_mitre_version": "2.7",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-28 14:35:00.862000+00:00\", \"old_value\": \"2023-10-03 17:37:24.011000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n(Citation: Crowdstrike AWS User Federation Persistence)\", \"old_value\": \"Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\\n\\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\\n\\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\\n\\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n\\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n(Citation: Crowdstrike AWS User Federation Persistence)\", \"diff\": \"--- \\n+++ \\n@@ -6,5 +6,5 @@\\n \\n Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal\\u2019s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \\n \\n-In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n+In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account\\u2019s API credentials are deactivated.\\n (Citation: Crowdstrike AWS User Federation Persistence)\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.7\", \"old_value\": \"2.6\"}}}",
"previous_version": "2.6",
"version_change": "2.6 \u2192 2.7",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add adversary-controlled credentials to a cl | t | 1 | Adversaries may add adversary-controlled credentials to a cl |
| > | oud account to maintain persistent access to victim accounts | > | oud account to maintain persistent access to victim accounts | ||
| > | and instances within the environment. For example, adversa | > | and instances within the environment. For example, adversa | ||
| > | ries may add credentials for Service Principals and Applicat | > | ries may add credentials for Service Principals and Applicat | ||
| > | ions in addition to existing legitimate credentials in Azure | > | ions in addition to existing legitimate credentials in Azure | ||
| > | AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat | > | AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat | ||
| > | ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide | > | ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide | ||
| > | o) These credentials include both x509 keys and passwords.(C | > | o) These credentials include both x509 keys and passwords.(C | ||
| > | itation: Microsoft SolarWinds Customer Guidance) With suffic | > | itation: Microsoft SolarWinds Customer Guidance) With suffic | ||
| > | ient permissions, there are a variety of ways to add credent | > | ient permissions, there are a variety of ways to add credent | ||
| > | ials including the Azure Portal, Azure command line interfac | > | ials including the Azure Portal, Azure command line interfac | ||
| > | e, and Azure or Az PowerShell modules.(Citation: Demystifyin | > | e, and Azure or Az PowerShell modules.(Citation: Demystifyin | ||
| > | g Azure AD Service Principals) In infrastructure-as-a-servi | > | g Azure AD Service Principals) In infrastructure-as-a-servi | ||
| > | ce (IaaS) environments, after gaining access through [Cloud | > | ce (IaaS) environments, after gaining access through [Cloud | ||
| > | Accounts](https://attack.mitre.org/techniques/T1078/004), ad | > | Accounts](https://attack.mitre.org/techniques/T1078/004), ad | ||
| > | versaries may generate or import their own SSH keys using ei | > | versaries may generate or import their own SSH keys using ei | ||
| > | ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ | > | ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ | ||
| > | code> API in AWS or the <code>gcloud compute os-login ssh-ke | > | code> API in AWS or the <code>gcloud compute os-login ssh-ke | ||
| > | ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi | > | ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi | ||
| > | s allows persistent access to instances within the cloud env | > | s allows persistent access to instances within the cloud env | ||
| > | ironment without further usage of the compromised cloud acco | > | ironment without further usage of the compromised cloud acco | ||
| > | unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind | > | unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind | ||
| > | the Scenes) Adversaries may also use the <code>CreateAcces | > | the Scenes) Adversaries may also use the <code>CreateAcces | ||
| > | sKey</code> API in AWS or the <code>gcloud iam service-accou | > | sKey</code> API in AWS or the <code>gcloud iam service-accou | ||
| > | nts keys create</code> command in GCP to add access keys to | > | nts keys create</code> command in GCP to add access keys to | ||
| > | an account. If the target account has different permissions | > | an account. If the target account has different permissions | ||
| > | from the requesting account, the adversary may also be able | > | from the requesting account, the adversary may also be able | ||
| > | to escalate their privileges in the environment (i.e. [Cloud | > | to escalate their privileges in the environment (i.e. [Cloud | ||
| > | Accounts](https://attack.mitre.org/techniques/T1078/004)).( | > | Accounts](https://attack.mitre.org/techniques/T1078/004)).( | ||
| > | Citation: Rhino Security Labs AWS Privilege Escalation)(Cita | > | Citation: Rhino Security Labs AWS Privilege Escalation)(Cita | ||
| > | tion: Sysdig ScarletEel 2.0) For example, in Azure AD enviro | > | tion: Sysdig ScarletEel 2.0) For example, in Azure AD enviro | ||
| > | nments, an adversary with the Application Administrator role | > | nments, an adversary with the Application Administrator role | ||
| > | can add a new set of credentials to their application's ser | > | can add a new set of credentials to their application's ser | ||
| > | vice principal. In doing so the adversary would be able to a | > | vice principal. In doing so the adversary would be able to a | ||
| > | ccess the service principal\u2019s roles and permissions, which m | > | ccess the service principal\u2019s roles and permissions, which m | ||
| > | ay be different from those of the Application Administrator. | > | ay be different from those of the Application Administrator. | ||
| > | (Citation: SpecterOps Azure Privilege Escalation) In AWS e | > | (Citation: SpecterOps Azure Privilege Escalation) In AWS e | ||
| > | nvironments, adversaries with the appropriate permissions ma | > | nvironments, adversaries with the appropriate permissions ma | ||
| > | y also use the `sts:GetFederationToken` API call to create a | > | y also use the `sts:GetFederationToken` API call to create a | ||
| > | temporary set of credentials tied to the permissions of the | > | temporary set of credentials to [Forge Web Credentials](htt | ||
| > | original user account. These credentials may remain valid f | > | ps://attack.mitre.org/techniques/T1606) tied to the permissi | ||
| > | or the duration of their lifetime even if the original accou | > | ons of the original user account. These temporary credential | ||
| > | nt\u2019s API credentials are deactivated. (Citation: Crowdstrike | > | s may remain valid for the duration of their lifetime even i | ||
| > | AWS User Federation Persistence) | > | f the original account\u2019s API credentials are deactivated. (C | ||
| > | itation: Crowdstrike AWS User Federation Persistence) |
CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\n\nIn some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/003",
"external_id": "T1098.003"
},
{
"source_name": "Expel AWS Attacker",
"description": " Brian Bahtiarian, David Blanton, Britton Manahan and Kyle Pellett. (2022, April 5). Incident report: From CLI to console, chasing an attacker in AWS. Retrieved April 7, 2022.",
"url": "https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/"
},
{
"source_name": "Microsoft O365 Admin Roles",
"description": "Ako-Adjei, K., Dickhaus, M., Baumgartner, P., Faigel, D., et. al.. (2019, October 8). About admin roles. Retrieved October 18, 2019.",
"url": "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide"
},
{
"source_name": "AWS IAM Policies and Permissions",
"description": "AWS. (n.d.). Policies and permissions in IAM. Retrieved April 1, 2022.",
"url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html"
},
{
"source_name": "Google Cloud IAM Policies",
"description": "Google Cloud. (2022, March 31). Understanding policies. Retrieved April 1, 2022.",
"url": "https://cloud.google.com/iam/docs/policies"
},
{
"source_name": "Invictus IR DangerDev 2024",
"description": "Invictus Incident Response. (2024, January 31). The curious case of DangerDev@protonmail.me. Retrieved March 19, 2024.",
"url": "https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me"
},
{
"source_name": "Microsoft Support O365 Add Another Admin, October 2019",
"description": "Microsoft. (n.d.). Add Another Admin. Retrieved October 18, 2019.",
"url": "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d"
},
{
"source_name": "Rhino Security Labs AWS Privilege Escalation",
"description": "Spencer Gietzen. (n.d.). AWS IAM Privilege Escalation \u2013 Methods and Mitigation. Retrieved May 27, 2022.",
"url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Microsoft Threat Intelligence Center (MSTIC)",
"Alex Parsons, Crowdstrike",
"Chris Romano, Crowdstrike",
"Wojciech Lesicki",
"Pi\u00e0 Consigny, Tenable",
"Cl\u00e9ment Notin, Tenable",
"Praetorian",
"Alex Soler, AttackIQ",
"Arad Inbar, Fidelis Security"
],
"x_mitre_data_sources": [
"User Account: User Account Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Collect activity logs from IAM services and cloud administrator accounts to identify unusual activity in the assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Office 365",
"IaaS",
"SaaS",
"Google Workspace",
"Azure AD"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-29 18:29:06.873000+00:00\", \"old_value\": \"2023-10-03 17:37:41.250000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\\n(Citation: Microsoft O365 Admin Roles) \\n\\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n\\nFor example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\\n\\nIn some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)\", \"old_value\": \"An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\\n(Citation: Microsoft O365 Admin Roles) \\n\\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n\\nFor example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\", \"diff\": \"--- \\n+++ \\n@@ -4,3 +4,5 @@\\n This account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\\n \\n For example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\\n+\\n+In some cases, adversaries may add roles to adversary-controlled accounts outside the victim cloud tenant. This allows these external accounts to perform actions inside the victim tenant without requiring the adversary to [Create Account](https://attack.mitre.org/techniques/T1136) or modify a victim-owned account.(Citation: Invictus IR DangerDev 2024)\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.4\", \"old_value\": \"2.3\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"Invictus IR DangerDev 2024\", \"description\": \"Invictus Incident Response. (2024, January 31). The curious case of DangerDev@protonmail.me. Retrieved March 19, 2024.\", \"url\": \"https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me\"}}}",
"previous_version": "2.3",
"version_change": "2.3 \u2192 2.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may add additional roles or permissions to an a | t | 1 | An adversary may add additional roles or permissions to an a |
| > | dversary-controlled cloud account to maintain persistent acc | > | dversary-controlled cloud account to maintain persistent acc | ||
| > | ess to a tenant. For example, adversaries may update IAM pol | > | ess to a tenant. For example, adversaries may update IAM pol | ||
| > | icies in cloud-based environments or add a new global admini | > | icies in cloud-based environments or add a new global admini | ||
| > | strator in Office 365 environments.(Citation: AWS IAM Polici | > | strator in Office 365 environments.(Citation: AWS IAM Polici | ||
| > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | > | es and Permissions)(Citation: Google Cloud IAM Policies)(Cit | ||
| > | ation: Microsoft Support O365 Add Another Admin, October 201 | > | ation: Microsoft Support O365 Add Another Admin, October 201 | ||
| > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | > | 9)(Citation: Microsoft O365 Admin Roles) With sufficient per | ||
| > | missions, a compromised account can gain almost unlimited ac | > | missions, a compromised account can gain almost unlimited ac | ||
| > | cess to data and settings (including the ability to reset th | > | cess to data and settings (including the ability to reset th | ||
| > | e passwords of other admins).(Citation: Expel AWS Attacker) | > | e passwords of other admins).(Citation: Expel AWS Attacker) | ||
| > | (Citation: Microsoft O365 Admin Roles) This account modifi | > | (Citation: Microsoft O365 Admin Roles) This account modifi | ||
| > | cation may immediately follow [Create Account](https://attac | > | cation may immediately follow [Create Account](https://attac | ||
| > | k.mitre.org/techniques/T1136) or other malicious account act | > | k.mitre.org/techniques/T1136) or other malicious account act | ||
| > | ivity. Adversaries may also modify existing [Valid Accounts] | > | ivity. Adversaries may also modify existing [Valid Accounts] | ||
| > | (https://attack.mitre.org/techniques/T1078) that they have c | > | (https://attack.mitre.org/techniques/T1078) that they have c | ||
| > | ompromised. This could lead to privilege escalation, particu | > | ompromised. This could lead to privilege escalation, particu | ||
| > | larly if the roles added allow for lateral movement to addit | > | larly if the roles added allow for lateral movement to addit | ||
| > | ional accounts. For example, in AWS environments, an advers | > | ional accounts. For example, in AWS environments, an advers | ||
| > | ary with appropriate permissions may be able to use the <cod | > | ary with appropriate permissions may be able to use the <cod | ||
| > | e>CreatePolicyVersion</code> API to define a new version of | > | e>CreatePolicyVersion</code> API to define a new version of | ||
| > | an IAM policy or the <code>AttachUserPolicy</code> API to at | > | an IAM policy or the <code>AttachUserPolicy</code> API to at | ||
| > | tach an IAM policy with additional or distinct permissions t | > | tach an IAM policy with additional or distinct permissions t | ||
| > | o a compromised user account.(Citation: Rhino Security Labs | > | o a compromised user account.(Citation: Rhino Security Labs | ||
| > | AWS Privilege Escalation) | > | AWS Privilege Escalation) In some cases, adversaries may ad | ||
| > | d roles to adversary-controlled accounts outside the victim | ||||
| > | cloud tenant. This allows these external accounts to perform | ||||
| > | actions inside the victim tenant without requiring the adve | ||||
| > | rsary to [Create Account](https://attack.mitre.org/technique | ||||
| > | s/T1136) or modify a victim-owned account.(Citation: Invictu | ||||
| > | s IR DangerDev 2024) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, lease, or rent infrastructure that can | t | 1 | Adversaries may buy, lease, rent, or obtain infrastructure t |
| > | be used during targeting. A wide variety of infrastructure e | > | hat can be used during targeting. A wide variety of infrastr | ||
| > | xists for hosting and orchestrating adversary operations. In | > | ucture exists for hosting and orchestrating adversary operat | ||
| > | frastructure solutions include physical or cloud servers, do | > | ions. Infrastructure solutions include physical or cloud ser | ||
| > | mains, and third-party web services.(Citation: TrendmicroHid | > | vers, domains, and third-party web services.(Citation: Trend | ||
| > | eoutsLease) Additionally, botnets are available for rent or | > | microHideoutsLease) Some infrastructure providers offer free | ||
| > | purchase. Use of these infrastructure solutions allows adve | > | trial periods, enabling infrastructure acquisition at limit | ||
| > | rsaries to stage, launch, and execute operations. Solutions | > | ed to no cost.(Citation: Free Trial PurpleUrchin) Additional | ||
| > | may help adversary operations blend in with traffic that is | > | ly, botnets are available for rent or purchase. Use of thes | ||
| > | seen as normal, such as contacting third-party web services | > | e infrastructure solutions allows adversaries to stage, laun | ||
| > | or acquiring infrastructure to support [Proxy](https://attac | > | ch, and execute operations. Solutions may help adversary ope | ||
| > | k.mitre.org/techniques/T1090), including from residential pr | > | rations blend in with traffic that is seen as normal, such a | ||
| > | oxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI P | > | s contacting third-party web services or acquiring infrastru | ||
| > | roxies Credential Stuffing)(Citation: Mandiant APT29 Microso | > | cture to support [Proxy](https://attack.mitre.org/techniques | ||
| > | ft 365 2022) Depending on the implementation, adversaries ma | > | /T1090), including from residential proxy services.(Citation | ||
| > | y use infrastructure that makes it difficult to physically t | > | : amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuf | ||
| > | ie back to them as well as utilize infrastructure that can b | > | fing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending | ||
| > | e rapidly provisioned, modified, and shut down. | > | on the implementation, adversaries may use infrastructure t | ||
| > | hat makes it difficult to physically tie back to them as wel | ||||
| > | l as utilize infrastructure that can be rapidly provisioned, | ||||
| > | modified, and shut down. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may acquire domains that can be used during targ | t | 1 | Adversaries may acquire domains that can be used during targ |
| > | eting. Domain names are the human readable names used to rep | > | eting. Domain names are the human readable names used to rep | ||
| > | resent one or more IP addresses. They can be purchased or, i | > | resent one or more IP addresses. They can be purchased or, i | ||
| > | n some cases, acquired for free. Adversaries may use acquir | > | n some cases, acquired for free. Adversaries may use acquir | ||
| > | ed domains for a variety of purposes, including for [Phishin | > | ed domains for a variety of purposes, including for [Phishin | ||
| > | g](https://attack.mitre.org/techniques/T1566), [Drive-by Com | > | g](https://attack.mitre.org/techniques/T1566), [Drive-by Com | ||
| > | promise](https://attack.mitre.org/techniques/T1189), and Com | > | promise](https://attack.mitre.org/techniques/T1189), and Com | ||
| > | mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m | > | mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m | ||
| > | ay choose domains that are similar to legitimate domains, in | > | ay choose domains that are similar to legitimate domains, in | ||
| > | cluding through use of homoglyphs or use of a different top- | > | cluding through use of homoglyphs or use of a different top- | ||
| > | level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa | > | level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa | ||
| > | lScam) Typosquatting may be used to aid in delivery of paylo | > | lScam) Typosquatting may be used to aid in delivery of paylo | ||
| > | ads via [Drive-by Compromise](https://attack.mitre.org/techn | > | ads via [Drive-by Compromise](https://attack.mitre.org/techn | ||
| > | iques/T1189). Adversaries may also use internationalized dom | > | iques/T1189). Adversaries may also use internationalized dom | ||
| > | ain names (IDNs) and different character sets (e.g. Cyrillic | > | ain names (IDNs) and different character sets (e.g. Cyrillic | ||
| > | , Greek, etc.) to execute \"IDN homograph attacks,\" creating | > | , Greek, etc.) to execute \"IDN homograph attacks,\" creating | ||
| > | visually similar lookalike domains used to deliver malware t | > | visually similar lookalike domains used to deliver malware t | ||
| > | o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt | > | o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt | ||
| > | _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht | > | _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht | ||
| > | track_unhcr)(Citation: lazgroup_idn_phishing) Adversaries m | > | track_unhcr)(Citation: lazgroup_idn_phishing) Different URIs | ||
| > | ay also acquire and repurpose expired domains, which may be | > | /URLs may also be dynamically generated to uniquely serve ma | ||
| > | potentially already allowlisted/trusted by defenders based o | > | licious content to victims.(Citation: iOS URL Scheme)(Citati | ||
| > | n an existing reputation/history.(Citation: Categorisation_n | > | on: URI)(Citation: URI Use)(Citation: URI Unique) Adversari | ||
| > | ot_boundary)(Citation: Domain_Steal_CC)(Citation: Redirector | > | es may also acquire and repurpose expired domains, which may | ||
| > | s_Domain_Fronting)(Citation: bypass_webproxy_filtering) Dom | > | be potentially already allowlisted/trusted by defenders bas | ||
| > | ain registrars each maintain a publicly viewable database th | > | ed on an existing reputation/history.(Citation: Categorisati | ||
| > | at displays contact information for every registered domain. | > | on_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redire | ||
| > | Private WHOIS services display alternative information, suc | > | ctors_Domain_Fronting)(Citation: bypass_webproxy_filtering) | ||
| > | h as their own company data, rather than the owner of the do | > | Domain registrars each maintain a publicly viewable databas | ||
| > | main. Adversaries may use such private WHOIS services to obs | > | e that displays contact information for every registered dom | ||
| > | cure information about who owns a purchased domain. Adversar | > | ain. Private WHOIS services display alternative information, | ||
| > | ies may further interrupt efforts to track their infrastruct | > | such as their own company data, rather than the owner of th | ||
| > | ure by using varied registration information and purchasing | > | e domain. Adversaries may use such private WHOIS services to | ||
| > | domains with different domain registrars.(Citation: Mandiant | > | obscure information about who owns a purchased domain. Adve | ||
| > | APT1) | > | rsaries may further interrupt efforts to track their infrast | ||
| > | ructure by using varied registration information and purchas | ||||
| > | ing domains with different domain registrars.(Citation: Mand | ||||
| > | iant APT1) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may buy, lease, or rent physical servers\u00a0that ca | t | 1 | Adversaries may buy, lease, rent, or obtain physical servers |
| > | n be used during targeting. Use of servers allows an adversa | > | \u00a0that can be used during targeting. Use of servers allows an | ||
| > | ry to stage, launch, and execute an operation. During post-c | > | adversary to stage, launch, and execute an operation. Durin | ||
| > | ompromise activity, adversaries may utilize servers for vari | > | g post-compromise activity, adversaries may utilize servers | ||
| > | ous tasks, including for Command and Control. Adversaries ma | > | for various tasks, such as watering hole operations in [Driv | ||
| > | y use web servers to support support watering hole operation | > | e-by Compromise](https://attack.mitre.org/techniques/T1189), | ||
| > | s, as in [Drive-by Compromise](https://attack.mitre.org/tech | > | enabling [Phishing](https://attack.mitre.org/techniques/T15 | ||
| > | niques/T1189), or email servers to support [Phishing](https: | > | 66) operations, or facilitating [Command and Control](https: | ||
| > | //attack.mitre.org/techniques/T1566) operations. Instead of | > | //attack.mitre.org/tactics/TA0011). Instead of compromising | ||
| > | compromising a third-party [Server](https://attack.mitre.org | > | a third-party [Server](https://attack.mitre.org/techniques/T | ||
| > | /techniques/T1584/004) or renting a [Virtual Private Server] | > | 1584/004) or renting a [Virtual Private Server](https://atta | ||
| > | (https://attack.mitre.org/techniques/T1583/003), adversaries | > | ck.mitre.org/techniques/T1583/003), adversaries may opt to c | ||
| > | may opt to configure and run their own servers in support o | > | onfigure and run their own servers in support of operations. | ||
| > | f operations. Adversaries may only need a lightweight setup | > | Free trial periods of cloud servers may also be abused.(Cit | ||
| > | if most of their activities will take place using online in | > | ation: Free Trial PurpleUrchin)(Citation: Freejacked) Adve | ||
| > | frastructure. Or, they may need to build extensive infrastru | > | rsaries may only need a lightweight setup if most of their a | ||
| > | cture if they want to test, communicate, and control other a | > | ctivities will take place using online infrastructure. Or, t | ||
| > | spects of their activities on their own systems.(Citation: N | > | hey may need to build extensive infrastructure if they want | ||
| > | YTStuxnet) | > | to test, communicate, and control other aspects of their act | ||
| > | ivities on their own systems.(Citation: NYTStuxnet) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to position themselves between two o | t | 1 | Adversaries may attempt to position themselves between two o |
| > | r more networked devices using an adversary-in-the-middle (A | > | r more networked devices using an adversary-in-the-middle (A | ||
| > | iTM) technique to support follow-on behaviors such as [Netwo | > | iTM) technique to support follow-on behaviors such as [Netwo | ||
| > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | > | rk Sniffing](https://attack.mitre.org/techniques/T1040), [Tr | ||
| > | ansmitted Data Manipulation](https://attack.mitre.org/techni | > | ansmitted Data Manipulation](https://attack.mitre.org/techni | ||
| > | ques/T1565/002), or replay attacks ([Exploitation for Creden | > | ques/T1565/002), or replay attacks ([Exploitation for Creden | ||
| > | tial Access](https://attack.mitre.org/techniques/T1212)). By | > | tial Access](https://attack.mitre.org/techniques/T1212)). By | ||
| > | abusing features of common networking protocols that can de | > | abusing features of common networking protocols that can de | ||
| > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | > | termine the flow of network traffic (e.g. ARP, DNS, LLMNR, e | ||
| > | tc.), adversaries may force a device to communicate through | > | tc.), adversaries may force a device to communicate through | ||
| > | an adversary controlled system so they can collect informati | > | an adversary controlled system so they can collect informati | ||
| > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | > | on or perform additional actions.(Citation: Rapid7 MiTM Basi | ||
| > | cs) For example, adversaries may manipulate victim DNS sett | > | cs) For example, adversaries may manipulate victim DNS sett | ||
| > | ings to enable other malicious activities such as preventing | > | ings to enable other malicious activities such as preventing | ||
| > | /redirecting users from accessing legitimate sites and/or pu | > | /redirecting users from accessing legitimate sites and/or pu | ||
| > | shing additional malware.(Citation: ttint_rat)(Citation: dns | > | shing additional malware.(Citation: ttint_rat)(Citation: dns | ||
| > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | > | _changer_trojans)(Citation: ad_blocker_with_miner) Adversari | ||
| > | es may also manipulate DNS and leverage their position in or | > | es may also manipulate DNS and leverage their position in or | ||
| > | der to intercept user credentials and session cookies.(Citat | > | der to intercept user credentials, including access tokens ( | ||
| > | ion: volexity_0day_sophos_FW) [Downgrade Attack](https://att | > | [Steal Application Access Token](https://attack.mitre.org/te | ||
| > | ack.mitre.org/techniques/T1562/010)s can also be used to est | > | chniques/T1528)) and session cookies ([Steal Web Session Coo | ||
| > | ablish an AiTM position, such as by negotiating a less secur | > | kie](https://attack.mitre.org/techniques/T1539)).(Citation: | ||
| > | e, deprecated, or weaker version of communication protocol ( | > | volexity_0day_sophos_FW)(Citation: Token tactics) [Downgrade | ||
| > | SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgra | > | Attack](https://attack.mitre.org/techniques/T1562/010)s can | ||
| > | de_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlse | > | also be used to establish an AiTM position, such as by nego | ||
| > | minar_downgrade_att) Adversaries may also leverage the AiTM | > | tiating a less secure, deprecated, or weaker version of comm | ||
| > | position to attempt to monitor and/or modify traffic, such | > | unication protocol (SSL/TLS) or encryption algorithm.(Citati | ||
| > | as in [Transmitted Data Manipulation](https://attack.mitre.o | > | on: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att | ||
| > | rg/techniques/T1565/002). Adversaries can setup a position s | > | _tls)(Citation: tlseminar_downgrade_att) Adversaries may al | ||
| > | imilar to AiTM to prevent traffic from flowing to the approp | > | so leverage the AiTM position to attempt to monitor and/or m | ||
| > | riate destination, potentially to [Impair Defenses](https:// | > | odify traffic, such as in [Transmitted Data Manipulation](ht | ||
| > | attack.mitre.org/techniques/T1562) and/or in support of a [N | > | tps://attack.mitre.org/techniques/T1565/002). Adversaries ca | ||
| > | etwork Denial of Service](https://attack.mitre.org/technique | > | n setup a position similar to AiTM to prevent traffic from f | ||
| > | s/T1498). | > | lowing to the appropriate destination, potentially to [Impai | ||
| > | r Defenses](https://attack.mitre.org/techniques/T1562) and/o | ||||
| > | r in support of a [Network Denial of Service](https://attack | ||||
| > | .mitre.org/techniques/T1498). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using OSI application layer prot | t | 1 | Adversaries may communicate using OSI application layer prot |
| > | ocols to avoid detection/network filtering by blending in wi | > | ocols to avoid detection/network filtering by blending in wi | ||
| > | th existing traffic. Commands to the remote system, and ofte | > | th existing traffic. Commands to the remote system, and ofte | ||
| > | n the results of those commands, will be embedded within the | > | n the results of those commands, will be embedded within the | ||
| > | protocol traffic between the client and server. Adversari | > | protocol traffic between the client and server. Adversari | ||
| > | es may utilize many different protocols, including those use | > | es may utilize many different protocols, including those use | ||
| > | d for web browsing, transferring files, electronic mail, or | > | d for web browsing, transferring files, electronic mail, or | ||
| > | DNS. For connections that occur internally within an enclave | > | DNS. For connections that occur internally within an enclave | ||
| > | (such as those between a proxy or pivot node and other node | > | (such as those between a proxy or pivot node and other node | ||
| > | s), commonly used protocols are SMB, SSH, or RDP. | > | s), commonly used protocols are SMB, SSH, or RDP.(Citation: | ||
| > | Mandiant APT29 Eye Spy Email Nov 22) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using application layer protocol | t | 1 | Adversaries may communicate using application layer protocol |
| > | s associated with transferring files to avoid detection/netw | > | s associated with transferring files to avoid detection/netw | ||
| > | ork filtering by blending in with existing traffic. Commands | > | ork filtering by blending in with existing traffic. Commands | ||
| > | to the remote system, and often the results of those comman | > | to the remote system, and often the results of those comman | ||
| > | ds, will be embedded within the protocol traffic between the | > | ds, will be embedded within the protocol traffic between the | ||
| > | client and server. Protocols such as SMB, FTP, FTPS, and | > | client and server. Protocols such as SMB(Citation: US-CER | ||
| > | TFTP that transfer files may be very common in environments. | > | T TA18-074A), FTP(Citation: ESET Machete July 2019), FTPS, a | ||
| > | Packets produced from these protocols may have many fields | > | nd TFTP that transfer files may be very common in environmen | ||
| > | and headers in which data can be concealed. Data could also | > | ts. Packets produced from these protocols may have many fie | ||
| > | be concealed within the transferred files. An adversary may | > | lds and headers in which data can be concealed. Data could a | ||
| > | abuse these protocols to communicate with systems under the | > | lso be concealed within the transferred files. An adversary | ||
| > | ir control within a victim network while also mimicking norm | > | may abuse these protocols to communicate with systems under | ||
| > | al, expected traffic. | > | their control within a victim network while also mimicking n | ||
| > | ormal, expected traffic. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may communicate using application layer protocol | t | 1 | Adversaries may communicate using application layer protocol |
| > | s associated with electronic mail delivery to avoid detectio | > | s associated with electronic mail delivery to avoid detectio | ||
| > | n/network filtering by blending in with existing traffic. Co | > | n/network filtering by blending in with existing traffic. Co | ||
| > | mmands to the remote system, and often the results of those | > | mmands to the remote system, and often the results of those | ||
| > | commands, will be embedded within the protocol traffic betwe | > | commands, will be embedded within the protocol traffic betwe | ||
| > | en the client and server. Protocols such as SMTP/S, POP3/S | > | en the client and server. Protocols such as SMTP/S, POP3/S | ||
| > | , and IMAP that carry electronic mail may be very common in | > | , and IMAP that carry electronic mail may be very common in | ||
| > | environments. Packets produced from these protocols may hav | > | environments. Packets produced from these protocols may hav | ||
| > | e many fields and headers in which data can be concealed. Da | > | e many fields and headers in which data can be concealed. Da | ||
| > | ta could also be concealed within the email messages themsel | > | ta could also be concealed within the email messages themsel | ||
| > | ves. An adversary may abuse these protocols to communicate w | > | ves. An adversary may abuse these protocols to communicate w | ||
| > | ith systems under their control within a victim network whil | > | ith systems under their control within a victim network whil | ||
| > | e also mimicking normal, expected traffic. | > | e also mimicking normal, expected traffic.(Citation: FireEye | ||
| > | APT28) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Once established within a system or network, an adversary ma | t | 1 | Once established within a system or network, an adversary ma |
| > | y use automated techniques for collecting internal data. Met | > | y use automated techniques for collecting internal data. Met | ||
| > | hods for performing this technique could include use of a [C | > | hods for performing this technique could include use of a [C | ||
| > | ommand and Scripting Interpreter](https://attack.mitre.org/t | > | ommand and Scripting Interpreter](https://attack.mitre.org/t | ||
| > | echniques/T1059) to search for and copy information fitting | > | echniques/T1059) to search for and copy information fitting | ||
| > | set criteria such as file type, location, or name at specifi | > | set criteria such as file type, location, or name at specifi | ||
| > | c time intervals. In cloud-based environments, adversaries m | > | c time intervals. In cloud-based environments, adversaries | ||
| > | ay also use cloud APIs, command line interfaces, or extract, | > | may also use cloud APIs, data pipelines, command line inter | ||
| > | transform, and load (ETL) services to automatically collect | > | faces, or extract, transform, and load (ETL) services to aut | ||
| > | data. This functionality could also be built into remote ac | > | omatically collect data.(Citation: Mandiant UNC3944 SMS Phis | ||
| > | cess tools. This technique may incorporate use of other te | > | hing 2023) This functionality could also be built into rem | ||
| > | chniques such as [File and Directory Discovery](https://atta | > | ote access tools. This technique may incorporate use of ot | ||
| > | ck.mitre.org/techniques/T1083) and [Lateral Tool Transfer](h | > | her techniques such as [File and Directory Discovery](https: | ||
| > | ttps://attack.mitre.org/techniques/T1570) to identify and mo | > | //attack.mitre.org/techniques/T1083) and [Lateral Tool Trans | ||
| > | ve files, as well as [Cloud Service Dashboard](https://attac | > | fer](https://attack.mitre.org/techniques/T1570) to identify | ||
| > | k.mitre.org/techniques/T1538) and [Cloud Storage Object Disc | > | and move files, as well as [Cloud Service Dashboard](https:/ | ||
| > | overy](https://attack.mitre.org/techniques/T1619) to identif | > | /attack.mitre.org/techniques/T1538) and [Cloud Storage Objec | ||
| > | y resources in cloud environments. | > | t Discovery](https://attack.mitre.org/techniques/T1619) to i | ||
| > | dentify resources in cloud environments. |
AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) \n\nAlternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors. The Registry key contains entries for the following:\n\n* Local Port\n* Standard TCP/IP Port\n* USB Monitor\n* WSD Port\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/010",
"external_id": "T1547.010"
},
{
"source_name": "Bloxham",
"description": "Bloxham, B. (n.d.). Getting Windows to Play with Itself [PowerPoint slides]. Retrieved November 12, 2014.",
"url": "https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf"
},
{
"source_name": "AddMonitor",
"description": "Microsoft. (n.d.). AddMonitor function. Retrieved November 12, 2014.",
"url": "http://msdn.microsoft.com/en-us/library/dd183341"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Stefan Kanthak",
"Travis Smith, Tripwire",
"Harun K\u00fc\u00dfner"
],
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Modification",
"File: File Creation",
"Module: Module Load",
"Process: OS API Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. \n\nMonitor Registry writes to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors, paying particular attention to changes in the \"Driver\" subkey. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_effective_permissions": [
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"SYSTEM",
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-12 02:49:39.980000+00:00\", \"old_value\": \"2022-04-20 16:36:31.835000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\\\Windows\\\\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) \\n\\nAlternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. The Registry key contains entries for the following:\\n\\n* Local Port\\n* Standard TCP/IP Port\\n* USB Monitor\\n* WSD Port\\n\", \"old_value\": \"Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\\\Windows\\\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. \\n\\nThe Registry key contains entries for the following:\\n\\n* Local Port\\n* Standard TCP/IP Port\\n* USB Monitor\\n* WSD Port\\n\\nAdversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.\", \"diff\": \"--- \\n+++ \\n@@ -1,10 +1,8 @@\\n-Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\\\Windows\\\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. \\n+Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\\\\Windows\\\\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) \\n \\n-The Registry key contains entries for the following:\\n+Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. The Registry key contains entries for the following:\\n \\n * Local Port\\n * Standard TCP/IP Port\\n * USB Monitor\\n * WSD Port\\n-\\n-Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_detection']\": {\"new_value\": \"Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. \\n\\nMonitor Registry writes to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors, paying particular attention to changes in the \\\"Driver\\\" subkey. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)\", \"old_value\": \"Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. \\n\\nMonitor Registry writes to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Monitor process API calls to AddMonitor.(Citation: AddMonitor) Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. \\n \\n-Monitor Registry writes to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)\\n+Monitor Registry writes to HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Print\\\\Monitors, paying particular attention to changes in the \\\"Driver\\\" subkey. Run the Autoruns utility, which checks for this Registry key as a persistence mechanism.(Citation: TechNet Autoruns)\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][2]\": \"Harun K\\u00fc\\u00dfner\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use port monitors to run an adversary suppli | t | 1 | Adversaries may use port monitors to run an adversary suppli |
| > | ed DLL during system boot for persistence or privilege escal | > | ed DLL during system boot for persistence or privilege escal | ||
| > | ation. A port monitor can be set through the <code>AddMonito | > | ation. A port monitor can be set through the <code>AddMonito | ||
| > | r</code> API call to set a DLL to be loaded at startup.(Cita | > | r</code> API call to set a DLL to be loaded at startup.(Cita | ||
| > | tion: AddMonitor) This DLL can be located in <code>C:\\Window | > | tion: AddMonitor) This DLL can be located in <code>C:\\Window | ||
| > | s\\System32</code> and will be loaded by the print spooler se | > | s\\System32</code> and will be loaded and run by the print sp | ||
| > | rvice, spoolsv.exe, on boot. The spoolsv.exe process also ru | > | ooler service, `spoolsv.exe`, under SYSTEM level permissions | ||
| > | ns under SYSTEM level permissions.(Citation: Bloxham) Altern | > | on boot.(Citation: Bloxham) Alternatively, an arbitrary D | ||
| > | atively, an arbitrary DLL can be loaded if permissions allow | > | LL can be loaded if permissions allow writing a fully-qualif | ||
| > | writing a fully-qualified pathname for that DLL to <code>HK | > | ied pathname for that DLL to the `Driver` value of an existi | ||
| > | LM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors</code>. | > | ng or new arbitrarily named subkey of <code>HKLM\\SYSTEM\\Curr | ||
| > | The Registry key contains entries for the following: * Loc | > | entControlSet\\Control\\Print\\Monitors</code>. The Registry ke | ||
| > | al Port * Standard TCP/IP Port * USB Monitor * WSD Port Adv | > | y contains entries for the following: * Local Port * Standa | ||
| > | ersaries can use this technique to load malicious code at st | > | rd TCP/IP Port * USB Monitor * WSD Port | ||
| > | artup that will persist on system reboot and execute as SYST | ||||
| > | EM. |
RegCreateKeyEx and RegSetValueEx as well as execution of the W32tm.exe utility.(Citation: Microsoft W32Time May 2017) There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk.(Citation: Github W32Time Oct 2017)\n\nThe Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers.(Citation: TechNet Autoruns)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"SYSTEM",
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-12 02:34:58.003000+00:00\", \"old_value\": \"2022-04-20 16:31:16.715000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)\\n\\nTime providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Services\\\\W32Time\\\\TimeProviders\\\\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)\\n\\nAdversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)\", \"old_value\": \"Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)\\n\\nTime providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Services\\\\W32Time\\\\TimeProviders\\\\.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)\\n\\nAdversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)\\n \\n-Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Services\\\\W32Time\\\\TimeProviders\\\\.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)\\n+Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of `HKEY_LOCAL_MACHINE\\\\System\\\\CurrentControlSet\\\\Services\\\\W32Time\\\\TimeProviders\\\\`.(Citation: Microsoft TimeProvider) The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.(Citation: Microsoft TimeProvider)\\n \\n-Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)\\n+Adversaries may abuse this architecture to establish persistence, specifically by creating a new arbitrarily named subkey pointing to a malicious DLL in the `DllName` value. Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.(Citation: Github W32Time Oct 2017)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][1]\": \"Harun K\\u00fc\\u00dfner\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse time providers to execute DLLs when th | t | 1 | Adversaries may abuse time providers to execute DLLs when th |
| > | e system boots. The Windows Time service (W32Time) enables t | > | e system boots. The Windows Time service (W32Time) enables t | ||
| > | ime synchronization across and within domains.(Citation: Mic | > | ime synchronization across and within domains.(Citation: Mic | ||
| > | rosoft W32Time Feb 2018) W32Time time providers are responsi | > | rosoft W32Time Feb 2018) W32Time time providers are responsi | ||
| > | ble for retrieving time stamps from hardware/network resourc | > | ble for retrieving time stamps from hardware/network resourc | ||
| > | es and outputting these values to other network clients.(Cit | > | es and outputting these values to other network clients.(Cit | ||
| > | ation: Microsoft TimeProvider) Time providers are implement | > | ation: Microsoft TimeProvider) Time providers are implement | ||
| > | ed as dynamic-link libraries (DLLs) that are registered in t | > | ed as dynamic-link libraries (DLLs) that are registered in t | ||
| > | he subkeys of <code>HKEY_LOCAL_MACHINE\\System\\CurrentContro | > | he subkeys of `HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\S | ||
| > | lSet\\Services\\W32Time\\TimeProviders\\</code>.(Citation: Micro | > | ervices\\W32Time\\TimeProviders\\`.(Citation: Microsoft TimePro | ||
| > | soft TimeProvider) The time provider manager, directed by th | > | vider) The time provider manager, directed by the service co | ||
| > | e service control manager, loads and starts time providers l | > | ntrol manager, loads and starts time providers listed and en | ||
| > | isted and enabled under this key at system startup and/or wh | > | abled under this key at system startup and/or whenever param | ||
| > | enever parameters are changed.(Citation: Microsoft TimeProvi | > | eters are changed.(Citation: Microsoft TimeProvider) Advers | ||
| > | der) Adversaries may abuse this architecture to establish p | > | aries may abuse this architecture to establish persistence, | ||
| > | ersistence, specifically by registering and enabling a malic | > | specifically by creating a new arbitrarily named subkey poi | ||
| > | ious DLL as a time provider. Administrator privileges are re | > | nting to a malicious DLL in the `DllName` value. Administrat | ||
| > | quired for time provider registration, though execution will | > | or privileges are required for time provider registration, t | ||
| > | run in context of the Local Service account.(Citation: Gith | > | hough execution will run in context of the Local Service acc | ||
| > | ub W32Time Oct 2017) | > | ount.(Citation: Github W32Time Oct 2017) |
HKLM\\Software[\\\\Wow6432Node\\\\]\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013) \n\nMalicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. Specifically, the following subkeys have been known to be possibly vulnerable to abuse: (Citation: Cylance Reg Persistence Sept 2013)\n\n* Winlogon\\Notify - points to notification package DLLs that handle Winlogon events\n* Winlogon\\Userinit - points to userinit.exe, the user initialization program executed when a user logs on\n* Winlogon\\Shell - points to explorer.exe, the system shell executed when a user logs on\n\nAdversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1547/004",
"external_id": "T1547.004"
},
{
"source_name": "Cylance Reg Persistence Sept 2013",
"description": "Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.",
"url": "https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Praetorian"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Module: Module Load",
"Process: Process Creation",
"Windows Registry: Windows Registry Key Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles, etc. Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values. (Citation: TechNet Autoruns) New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious.\n\nLook for abnormal process behavior that may be due to a process loading a malicious DLL. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"SYSTEM",
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-14 21:24:37.780000+00:00\", \"old_value\": \"2023-08-14 15:11:30.220000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][2]\": \"Process: Process Creation\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0011: Module (Module Load)",
"DS0017: Command (Command Execution)",
"DS0024: Windows Registry (Windows Registry Key Modification)"
],
"new": [
"DS0009: Process (Process Creation)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:30:38.910000+00:00",
"modified": "2024-04-16 12:23:13.621000+00:00",
"name": "Boot or Logon Initialization Scripts",
"description": "Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \n\nAdversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. \n\nAn adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1037",
"external_id": "T1037"
},
{
"source_name": "Anomali Rocke March 2019",
"description": "Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.",
"url": "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"
},
{
"source_name": "Mandiant APT29 Eye Spy Email Nov 22",
"description": "Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.",
"url": "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"File: File Modification",
"Windows Registry: Windows Registry Key Creation",
"Command: Command Execution",
"File: File Creation",
"Process: Process Creation",
"Active Directory: Active Directory Object Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor logon scripts for unusual access by abnormal users or at abnormal times. Look for files added or modified by unusual accounts outside of normal administration duties. Monitor running process for actions that could be indicative of abnormal programs or executables running upon logon.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Windows",
"Linux",
"Network"
],
"x_mitre_version": "2.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:23:13.621000+00:00\", \"old_value\": \"2023-08-11 20:54:55.991000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \\n\\nAdversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. \\n\\nAn adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.\", \"old_value\": \"Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \\n\\nAdversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. \\n\\nAn adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \\n+Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. \\n \\n Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. \\n \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.3\", \"old_value\": \"2.2\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Anomali Rocke March 2019\", \"description\": \"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.\", \"url\": \"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang\"}, \"root['external_references'][2]\": {\"source_name\": \"Mandiant APT29 Eye Spy Email Nov 22\", \"description\": \"Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023.\", \"url\": \"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email\"}, \"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "2.2",
"version_change": "2.2 \u2192 2.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use scripts automatically executed at boot o | t | 1 | Adversaries may use scripts automatically executed at boot o |
| > | r logon initialization to establish persistence. Initializat | > | r logon initialization to establish persistence.(Citation: M | ||
| > | ion scripts can be used to perform administrative functions, | > | andiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke | ||
| > | which may often execute other programs or send information | > | March 2019) Initialization scripts can be used to perform ad | ||
| > | to an internal logging server. These scripts can vary based | > | ministrative functions, which may often execute other progra | ||
| > | on operating system and whether applied locally or remotely. | > | ms or send information to an internal logging server. These | ||
| > | Adversaries may use these scripts to maintain persistenc | > | scripts can vary based on operating system and whether appli | ||
| > | e on a single system. Depending on the access configuration | > | ed locally or remotely. Adversaries may use these scripts | ||
| > | of the logon scripts, either local credentials or an adminis | > | to maintain persistence on a single system. Depending on th | ||
| > | trator account may be necessary. An adversary may also be | > | e access configuration of the logon scripts, either local cr | ||
| > | able to escalate their privileges since some boot or logon i | > | edentials or an administrator account may be necessary. An | ||
| > | nitialization scripts run with higher privileges. | > | adversary may also be able to escalate their privileges sin | ||
| > | ce some boot or logon initialization scripts run with higher | ||||
| > | privileges. |
rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence.\n\nAdversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware)\n\nSeveral Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1037/004",
"external_id": "T1037.004"
},
{
"source_name": "Apple Developer Doco Archive Launchd",
"description": "Apple. (2016, September 13). Daemons and Services Programming Guide - Creating Launch Daemons and Agents. Retrieved February 24, 2021.",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html"
},
{
"source_name": "Startup Items",
"description": "Apple. (2016, September 13). Startup Items. Retrieved July 11, 2017.",
"url": "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html"
},
{
"source_name": "Ubuntu Manpage systemd rc",
"description": "Canonical Ltd.. (n.d.). systemd-rc-local-generator - Compatibility generator for starting /etc/rc.local and /usr/sbin/halt.local during boot and shutdown. Retrieved February 23, 2021.",
"url": "http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html"
},
{
"source_name": "IranThreats Kittens Dec 2017",
"description": "Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.",
"url": "https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/"
},
{
"source_name": "Methods of Mac Malware Persistence",
"description": "Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.",
"url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
},
{
"source_name": "intezer-kaiji-malware",
"description": "Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware turning to Golang. Retrieved December 17, 2020.",
"url": "https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/"
},
{
"source_name": "Intezer HiddenWasp Map 2019",
"description": "Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.",
"url": "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"File: File Creation",
"Process: Process Creation",
"File: File Modification",
"Command: Command Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for unexpected changes to RC scripts in the /etc/ directory. Monitor process execution resulting from RC scripts for unusual or unknown applications or behavior.\n\nMonitor for /etc/rc.local file creation. Although types of RC scripts vary for each Unix-like distribution, several execute /etc/rc.local if present. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"root"
],
"x_mitre_platforms": [
"macOS",
"Linux",
"Network"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:22:29.150000+00:00\", \"old_value\": \"2021-04-27 19:58:01.927000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.1\", \"old_value\": \"2.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][2]\": \"Network\"}}",
"previous_version": "2.0",
"version_change": "2.0 \u2192 2.1",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Creation)",
"DS0022: File (File Modification)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--389735f1-f21c-4208-b8f0-f8031e7169b8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2024-04-18 23:22:37.874000+00:00",
"name": "Browser Extensions",
"description": "Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)\n\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.\n\nPrevious to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)\n\nOnce the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)\n\nThere have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1176",
"external_id": "T1176"
},
{
"source_name": "Chrome Extension Crypto Miner",
"description": "Brinkmann, M. (2017, September 19). First Chrome extension with JavaScript Crypto Miner detected. Retrieved November 16, 2017.",
"url": "https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/"
},
{
"source_name": "xorrior chrome extensions macOS",
"description": "Chris Ross. (2019, February 8). No Place Like Chrome. Retrieved April 27, 2021.",
"url": "https://www.xorrior.com/No-Place-Like-Chrome/"
},
{
"source_name": "Chrome Extensions Definition",
"description": "Chrome. (n.d.). What are Extensions?. Retrieved November 16, 2017.",
"url": "https://developer.chrome.com/extensions"
},
{
"source_name": "ICEBRG Chrome Extensions",
"description": "De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018.",
"url": "https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses"
},
{
"source_name": "Malicious Chrome Extension Numbers",
"description": "Jagpal, N., et al. (2015, August). Trends and Lessons from Three Years Fighting Malicious Extensions. Retrieved November 17, 2017.",
"url": "https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43824.pdf"
},
{
"source_name": "Chrome Extension C2 Malware",
"description": "Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017.",
"url": "https://kjaer.io/extension-malware/"
},
{
"source_name": "Catch All Chrome Extension",
"description": "Marinho, R. (n.d.). \"Catch-All\" Google Chrome Malicious Extension Steals All Posted Data. Retrieved November 16, 2017.",
"url": "https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)"
},
{
"source_name": "Banker Google Chrome Extension Steals Creds",
"description": "Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. Retrieved November 18, 2017.",
"url": "https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/"
},
{
"source_name": "Browser Adrozek",
"description": "Microsoft Threat Intelligence. (2020, December 10). Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers. Retrieved February 26, 2024.",
"url": "https://www.microsoft.com/en-us/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/"
},
{
"source_name": "Browers FriarFox",
"description": "Raggi, Michael. Proofpoint Threat Research Team. (2021, February 25). TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations. Retrieved February 26, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global"
},
{
"source_name": "Stantinko Botnet",
"description": "Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware campaign operating covertly since 2012. Retrieved November 16, 2017.",
"url": "https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/"
},
{
"source_name": "Wikipedia Browser Extension",
"description": "Wikipedia. (2017, October 8). Browser Extension. Retrieved January 11, 2018.",
"url": "https://en.wikipedia.org/wiki/Browser_extension"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Chris Ross @xorrior",
"Justin Warner, ICEBRG",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Creation",
"Process: Process Creation",
"Command: Command Execution",
"File: File Creation",
"Network Traffic: Network Connection Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates.\n\nMonitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.\n\nOn macOS, monitor the command line for usage of the profiles tool, such as profiles install -type=configuration. Additionally, all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory. Ensure all listed files are in alignment with approved extensions.(Citation: xorrior chrome extensions macOS)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-18 23:22:37.874000+00:00\", \"old_value\": \"2022-04-20 16:46:36.707000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)\\n\\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.\\n\\nPrevious to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)\\n\\nOnce the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)\\n\\nThere have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek) \", \"old_value\": \"Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)\\n\\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.\\n\\nPrevious to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)\\n\\nOnce the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)\\n\\nThere have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)\", \"diff\": \"--- \\n+++ \\n@@ -6,4 +6,4 @@\\n \\n Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension)\\n \\n-There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)\\n+There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions for [Command and Control](https://attack.mitre.org/tactics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Extension C2 Malware) Adversaries may also use browser extensions to modify browser permissions and components, privacy settings, and other security controls for [Defense Evasion](https://attack.mitre.org/tactics/TA0005).(Citation: Browers FriarFox)(Citation: Browser Adrozek) \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][9]\": {\"source_name\": \"Browser Adrozek\", \"description\": \"Microsoft Threat Intelligence. (2020, December 10). Widespread malware campaign seeks to silently inject ads into search results, affects multiple browsers. Retrieved February 26, 2024.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2020/12/10/widespread-malware-campaign-seeks-to-silently-inject-ads-into-search-results-affects-multiple-browsers/\"}, \"root['external_references'][10]\": {\"source_name\": \"Browers FriarFox\", \"description\": \"Raggi, Michael. Proofpoint Threat Research Team. (2021, February 25). TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations. Retrieved February 26, 2024.\", \"url\": \"https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global\"}, \"root['x_mitre_contributors'][2]\": \"Manikantan Srinivasan, NEC Corporation India\"}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Internet browser extensions to establi | t | 1 | Adversaries may abuse Internet browser extensions to establi |
| > | sh persistent access to victim systems. Browser extensions o | > | sh persistent access to victim systems. Browser extensions o | ||
| > | r plugins are small programs that can add functionality and | > | r plugins are small programs that can add functionality and | ||
| > | customize aspects of Internet browsers. They can be installe | > | customize aspects of Internet browsers. They can be installe | ||
| > | d directly or through a browser's app store and generally ha | > | d directly or through a browser's app store and generally ha | ||
| > | ve access and permissions to everything that the browser can | > | ve access and permissions to everything that the browser can | ||
| > | access.(Citation: Wikipedia Browser Extension)(Citation: Ch | > | access.(Citation: Wikipedia Browser Extension)(Citation: Ch | ||
| > | rome Extensions Definition) Malicious extensions can be ins | > | rome Extensions Definition) Malicious extensions can be ins | ||
| > | talled into a browser through malicious app store downloads | > | talled into a browser through malicious app store downloads | ||
| > | masquerading as legitimate extensions, through social engine | > | masquerading as legitimate extensions, through social engine | ||
| > | ering, or by an adversary that has already compromised a sys | > | ering, or by an adversary that has already compromised a sys | ||
| > | tem. Security can be limited on browser app stores so it may | > | tem. Security can be limited on browser app stores so it may | ||
| > | not be difficult for malicious extensions to defeat automat | > | not be difficult for malicious extensions to defeat automat | ||
| > | ed scanners.(Citation: Malicious Chrome Extension Numbers) D | > | ed scanners.(Citation: Malicious Chrome Extension Numbers) D | ||
| > | epending on the browser, adversaries may also manipulate an | > | epending on the browser, adversaries may also manipulate an | ||
| > | extension's update url to install updates from an adversary | > | extension's update url to install updates from an adversary | ||
| > | controlled server or manipulate the mobile configuration fil | > | controlled server or manipulate the mobile configuration fil | ||
| > | e to silently install additional extensions. Previous to ma | > | e to silently install additional extensions. Previous to ma | ||
| > | cOS 11, adversaries could silently install browser extension | > | cOS 11, adversaries could silently install browser extension | ||
| > | s via the command line using the <code>profiles</code> tool | > | s via the command line using the <code>profiles</code> tool | ||
| > | to install malicious <code>.mobileconfig</code> files. In ma | > | to install malicious <code>.mobileconfig</code> files. In ma | ||
| > | cOS 11+, the use of the <code>profiles</code> tool can no lo | > | cOS 11+, the use of the <code>profiles</code> tool can no lo | ||
| > | nger install configuration profiles, however <code>.mobileco | > | nger install configuration profiles, however <code>.mobileco | ||
| > | nfig</code> files can be planted and installed with user int | > | nfig</code> files can be planted and installed with user int | ||
| > | eraction.(Citation: xorrior chrome extensions macOS) Once t | > | eraction.(Citation: xorrior chrome extensions macOS) Once t | ||
| > | he extension is installed, it can browse to websites in the | > | he extension is installed, it can browse to websites in the | ||
| > | background, steal all information that a user enters into a | > | background, steal all information that a user enters into a | ||
| > | browser (including credentials), and be used as an installer | > | browser (including credentials), and be used as an installer | ||
| > | for a RAT for persistence.(Citation: Chrome Extension Crypt | > | for a RAT for persistence.(Citation: Chrome Extension Crypt | ||
| > | o Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banke | > | o Miner)(Citation: ICEBRG Chrome Extensions)(Citation: Banke | ||
| > | r Google Chrome Extension Steals Creds)(Citation: Catch All | > | r Google Chrome Extension Steals Creds)(Citation: Catch All | ||
| > | Chrome Extension) There have also been instances of botnets | > | Chrome Extension) There have also been instances of botnets | ||
| > | using a persistent backdoor through malicious Chrome extens | > | using a persistent backdoor through malicious Chrome extens | ||
| > | ions.(Citation: Stantinko Botnet) There have also been simil | > | ions for [Command and Control](https://attack.mitre.org/tact | ||
| > | ar examples of extensions being used for command & control.( | > | ics/TA0011).(Citation: Stantinko Botnet)(Citation: Chrome Ex | ||
| > | Citation: Chrome Extension C2 Malware) | > | tension C2 Malware) Adversaries may also use browser extensi | ||
| > | ons to modify browser permissions and components, privacy se | ||||
| > | ttings, and other security controls for [Defense Evasion](ht | ||||
| > | tps://attack.mitre.org/tactics/TA0005).(Citation: Browers Fr | ||||
| > | iarFox)(Citation: Browser Adrozek) |
osascript /path/to/script or osascript -e \"script here\". Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows. AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.(Citation: SentinelOne AppleScript)\n\nAppleScripts do not need to call osascript to execute. However, they may be executed from within mach-O binaries by using the macOS [Native API](https://attack.mitre.org/techniques/T1106)s\u00a0NSAppleScript\u00a0or\u00a0OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.\n\nAdversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes. These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely. On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute [Native API](https://attack.mitre.org/techniques/T1106)s, which otherwise would require compilation and execution in a mach-O binary file format.(Citation: SentinelOne macOS Red Team) Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via [Python](https://attack.mitre.org/techniques/T1059/006).(Citation: Macro Malware Targets Macs)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/002",
"external_id": "T1059.002"
},
{
"source_name": "Apple AppleScript",
"description": "Apple. (2016, January 25). Introduction to AppleScript Language Guide. Retrieved March 28, 2020.",
"url": "https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptLangGuide/introduction/ASLR_intro.html"
},
{
"source_name": "SentinelOne macOS Red Team",
"description": "Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.",
"url": "https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/"
},
{
"source_name": "SentinelOne AppleScript",
"description": "Phil Stokes. (2020, March 16). How Offensive Actors Use AppleScript For Attacking macOS. Retrieved July 17, 2020.",
"url": "https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/"
},
{
"source_name": "Macro Malware Targets Macs",
"description": "Yerko Grbic. (2017, February 14). Macro Malware Targets Macs. Retrieved July 8, 2017.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/macro-malware-targets-macs/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Phil Stokes, SentinelOne"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Process: Process Creation",
"Process: OS API Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.\n\nUnderstanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_remote_support": false,
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 19:06:05.126000+00:00\", \"old_value\": \"2022-10-19 15:37:28.071000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention",
"M1045: Code Signing"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (OS API Execution)",
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-09 13:48:55.078000+00:00",
"modified": "2024-03-01 18:01:37.575000+00:00",
"name": "PowerShell",
"description": "Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).\n\nPowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.\n\nA number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack)\n\nPowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/001",
"external_id": "T1059.001"
},
{
"source_name": "Microsoft PSfromCsharp APR 2014",
"description": "Babinec, K. (2014, April 28). Executing PowerShell scripts from C#. Retrieved April 22, 2019.",
"url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
},
{
"source_name": "SilentBreak Offensive PS Dec 2015",
"description": "Christensen, L.. (2015, December 28). The Evolution of Offensive PowerShell Invocation. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
},
{
"source_name": "FireEye PowerShell Logging 2016",
"description": "Dunwoody, M. (2016, February 11). GREATER VISIBILITY THROUGH POWERSHELL LOGGING. Retrieved February 16, 2016.",
"url": "https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html"
},
{
"source_name": "Github PSAttack",
"description": "Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016.",
"url": "https://github.com/jaredhaight/PSAttack"
},
{
"source_name": "inv_ps_attacks",
"description": "Hastings, M. (2014, July 16). Investigating PowerShell Attacks. Retrieved December 1, 2021.",
"url": "https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/"
},
{
"source_name": "Malware Archaeology PowerShell Cheat Sheet",
"description": "Malware Archaeology. (2016, June). WINDOWS POWERSHELL LOGGING CHEAT SHEET - Win 7/Win 2008 or later. Retrieved June 24, 2016.",
"url": "http://www.malwarearchaeology.com/s/Windows-PowerShell-Logging-Cheat-Sheet-ver-June-2016-v2.pdf"
},
{
"source_name": "TechNet PowerShell",
"description": "Microsoft. (n.d.). Windows PowerShell Scripting. Retrieved April 28, 2016.",
"url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
},
{
"source_name": "Sixdub PowerPick Jan 2016",
"description": "Warner, J.. (2015, January 6). Inexorable PowerShell \u2013 A Red Teamer\u2019s Tale of Overcoming Simple AppLocker Policies. Retrieved December 8, 2018.",
"url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Mayuresh Dani, Qualys",
"Praetorian",
"Ross Brittain"
],
"x_mitre_data_sources": [
"Script: Script Execution",
"Process: Process Creation",
"Process: Process Metadata",
"Command: Command Execution",
"Module: Module Load"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line. This change in policy on a system may be a way to detect malicious use of PowerShell. If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.\n\nMonitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)\n\nIt is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations). (Citation: Malware Archaeology PowerShell Cheat Sheet) PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0. Earlier versions of PowerShell do not have many logging features.(Citation: FireEye PowerShell Logging 2016) An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.\n\nConsider monitoring for Windows event ID (EID) 400, which shows the version of PowerShell executing in the EngineVersion field (which may also be relevant to detecting a potential [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)) as well as if PowerShell is running locally or remotely in the HostName field. Furthermore, EID 400 may indicate the start time and EID 403 indicates the end time of a PowerShell session.(Citation: inv_ps_attacks)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": true,
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 18:01:37.575000+00:00\", \"old_value\": \"2023-03-27 17:19:48.136000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1038: Execution Prevention",
"M1042: Disable or Remove Feature or Program",
"M1045: Code Signing",
"M1049: Antivirus/Antimalware"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0009: Process (Process Metadata)",
"DS0011: Module (Module Load)",
"DS0012: Script (Script Execution)",
"DS0017: Command (Command Execution)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-09 14:15:05.330000+00:00",
"modified": "2024-04-16 12:24:40.163000+00:00",
"name": "Unix Shell",
"description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/004",
"external_id": "T1059.004"
},
{
"source_name": "Apple ZShell",
"description": "Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020.",
"url": "https://support.apple.com/HT208050"
},
{
"source_name": "DieNet Bash",
"description": "die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020.",
"url": "https://linux.die.net/man/1/bash"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Process: Process Creation",
"Command: Command Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Linux",
"Network"
],
"x_mitre_remote_support": true,
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"dictionary_item_removed\": {\"root['x_mitre_permissions_required']\": [\"User\", \"root\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:24:40.163000+00:00\", \"old_value\": \"2021-07-26 22:34:43.261000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][2]\": \"Network\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-09 14:12:31.196000+00:00",
"modified": "2024-03-01 17:35:02.889000+00:00",
"name": "Windows Command Shell",
"description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)\n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/003",
"external_id": "T1059.003"
},
{
"source_name": "SSH in Windows",
"description": "Microsoft. (2020, May 19). Tutorial: SSH in Windows Terminal. Retrieved July 26, 2021.",
"url": "https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Command: Command Execution",
"Process: Process Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": true,
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 17:35:02.889000+00:00\", \"old_value\": \"2023-07-28 17:50:21.947000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"changelog_mitigations": {
"shared": [
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-01 00:36:30.759000+00:00",
"modified": "2024-03-28 03:53:28.299000+00:00",
"name": "Compromise Infrastructure",
"description": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)\n\nBy using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "resource-development"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1584",
"external_id": "T1584"
},
{
"source_name": "amnesty_nso_pegasus",
"description": "Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group\u2019s Pegasus. Retrieved February 22, 2022.",
"url": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"
},
{
"source_name": "Sysdig Proxyjacking",
"description": "Crystal Morin. (2023, April 4). Proxyjacking has Entered the Chat. Retrieved July 6, 2023.",
"url": "https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/"
},
{
"source_name": "FireEye DNS Hijack 2019",
"description": "Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html"
},
{
"source_name": "ICANNDomainNameHijacking",
"description": "ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.",
"url": "https://www.icann.org/groups/ssac/documents/sac-007-en"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"description": "Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Talos DNSpionage Nov 2018",
"description": "Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.",
"url": "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
},
{
"source_name": "NSA NCSC Turla OilRig",
"description": "NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.",
"url": "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"description": "Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved October 12, 2021.",
"url": "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"description": "ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.",
"url": "https://threatconnect.com/blog/infrastructure-research-hunting/"
},
{
"source_name": "FireEye EPS Awakens Part 2",
"description": "Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.",
"url": "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Jeremy Galloway",
"Shailesh Tiwary (Indian Army)",
"Goldstein Menachem"
],
"x_mitre_data_sources": [
"Internet Scan: Response Content",
"Domain Name: Domain Registration",
"Domain Name: Active DNS",
"Domain Name: Passive DNS",
"Internet Scan: Response Metadata"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet. \n\nOnce adversaries have provisioned compromised infrastructure (ex: a server for use in command and control), internet scans may help proactively discover compromised infrastructure. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: Mandiant SCANdalous Jul 2020)(Citation: Koczwara Beacon Hunting Sep 2021)\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-28 03:53:28.299000+00:00\", \"old_value\": \"2023-10-02 01:10:49.053000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\\n\\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)\\n\\nBy using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)\", \"old_value\": \"Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\\n\\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)\\n\\nBy using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\\n+Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\\n \\n Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)\\n \"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may compromise third-party infrastructure that c | t | 1 | Adversaries may compromise third-party infrastructure that c |
| > | an be used during targeting. Infrastructure solutions includ | > | an be used during targeting. Infrastructure solutions includ | ||
| > | e physical or cloud servers, domains, and third-party web an | > | e physical or cloud servers, domains, network devices, and t | ||
| > | d DNS services. Instead of buying, leasing, or renting infra | > | hird-party web and DNS services. Instead of buying, leasing, | ||
| > | structure an adversary may compromise infrastructure and use | > | or renting infrastructure an adversary may compromise infra | ||
| > | it during other phases of the adversary lifecycle.(Citation | > | structure and use it during other phases of the adversary li | ||
| > | : Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citatio | > | fecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameH | ||
| > | n: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens | > | ijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: Fir | ||
| > | Part 2) Additionally, adversaries may compromise numerous ma | > | eEye EPS Awakens Part 2) Additionally, adversaries may compr | ||
| > | chines to form a botnet they can leverage. Use of compromis | > | omise numerous machines to form a botnet they can leverage. | ||
| > | ed infrastructure allows adversaries to stage, launch, and e | > | Use of compromised infrastructure allows adversaries to sta | ||
| > | xecute operations. Compromised infrastructure can help adver | > | ge, launch, and execute operations. Compromised infrastructu | ||
| > | sary operations blend in with traffic that is seen as normal | > | re can help adversary operations blend in with traffic that | ||
| > | , such as contact with high reputation or trusted sites. For | > | is seen as normal, such as contact with high reputation or t | ||
| > | example, adversaries may leverage compromised infrastructur | > | rusted sites. For example, adversaries may leverage compromi | ||
| > | e (potentially also in conjunction with [Digital Certificate | > | sed infrastructure (potentially also in conjunction with [Di | ||
| > | s](https://attack.mitre.org/techniques/T1588/004)) to furthe | > | gital Certificates](https://attack.mitre.org/techniques/T158 | ||
| > | r blend in and support staged information gathering and/or [ | > | 8/004)) to further blend in and support staged information g | ||
| > | Phishing](https://attack.mitre.org/techniques/T1566) campaig | > | athering and/or [Phishing](https://attack.mitre.org/techniqu | ||
| > | ns.(Citation: FireEye DNS Hijack 2019) Additionally, adversa | > | es/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Addi | ||
| > | ries may also compromise infrastructure to support [Proxy](h | > | tionally, adversaries may also compromise infrastructure to | ||
| > | ttps://attack.mitre.org/techniques/T1090) and/or proxyware s | > | support [Proxy](https://attack.mitre.org/techniques/T1090) a | ||
| > | ervices.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Pro | > | nd/or proxyware services.(Citation: amnesty_nso_pegasus)(Cit | ||
| > | xyjacking) By using compromised infrastructure, adversaries | > | ation: Sysdig Proxyjacking) By using compromised infrastruc | ||
| > | may make it difficult to tie their actions back to them. Pr | > | ture, adversaries may make it difficult to tie their actions | ||
| > | ior to targeting, adversaries may compromise the infrastruct | > | back to them. Prior to targeting, adversaries may compromis | ||
| > | ure of other adversaries.(Citation: NSA NCSC Turla OilRig) | > | e the infrastructure of other adversaries.(Citation: NSA NCS | ||
| > | C Turla OilRig) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a cloud account to maintain access to | t | 1 | Adversaries may create a cloud account to maintain access to |
| > | victim systems. With a sufficient level of access, such acc | > | victim systems. With a sufficient level of access, such acc | ||
| > | ounts may be used to establish secondary credentialed access | > | ounts may be used to establish secondary credentialed access | ||
| > | that does not require persistent remote access tools to be | > | that does not require persistent remote access tools to be | ||
| > | deployed on the system.(Citation: Microsoft O365 Admin Roles | > | deployed on the system.(Citation: Microsoft O365 Admin Roles | ||
| > | )(Citation: Microsoft Support O365 Add Another Admin, Octobe | > | )(Citation: Microsoft Support O365 Add Another Admin, Octobe | ||
| > | r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create | > | r 2019)(Citation: AWS Create IAM User)(Citation: GCP Create | ||
| > | Cloud Identity Users)(Citation: Microsoft Azure AD Users) A | > | Cloud Identity Users)(Citation: Microsoft Azure AD Users) I | ||
| > | dversaries may create accounts that only have access to spec | > | n addition to user accounts, cloud accounts may be associate | ||
| > | ific cloud services, which can reduce the chance of detectio | > | d with services. Cloud providers handle the concept of servi | ||
| > | n. Once an adversary has created a cloud account, they can | > | ce accounts in different ways. In Azure, service accounts in | ||
| > | then manipulate that account to ensure persistence and allow | > | clude service principals and managed identities, which can b | ||
| > | access to additional resources - for example, by adding [Ad | > | e linked to various resources such as OAuth applications, se | ||
| > | ditional Cloud Credentials](https://attack.mitre.org/techniq | > | rverless functions, and virtual machines in order to grant t | ||
| > | ues/T1098/001) or assigning [Additional Cloud Roles](https:/ | > | hose resources permissions to perform various activities in | ||
| > | /attack.mitre.org/techniques/T1098/003). | > | the environment.(Citation: Microsoft Entra ID Service Princi | ||
| > | pals) In GCP, service accounts can also be linked to specifi | ||||
| > | c resources, as well as be impersonated by other accounts fo | ||||
| > | r [Temporary Elevated Cloud Access](https://attack.mitre.org | ||||
| > | /techniques/T1548/005).(Citation: GCP Service Accounts) Whil | ||||
| > | e AWS has no specific concept of service accounts, resources | ||||
| > | can be directly granted permission to assume roles.(Citatio | ||||
| > | n: AWS Instance Profiles)(Citation: AWS Lambda Execution Rol | ||||
| > | e) Adversaries may create accounts that only have access to | ||||
| > | specific cloud services, which can reduce the chance of det | ||||
| > | ection. Once an adversary has created a cloud account, they | ||||
| > | can then manipulate that account to ensure persistence and | ||||
| > | allow access to additional resources - for example, by addin | ||||
| > | g [Additional Cloud Credentials](https://attack.mitre.org/te | ||||
| > | chniques/T1098/001) or assigning [Additional Cloud Roles](ht | ||||
| > | tps://attack.mitre.org/techniques/T1098/003). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify systemd services to repeate | t | 1 | Adversaries may create or modify systemd services to repeate |
| > | dly execute malicious payloads as part of persistence. Syste | > | dly execute malicious payloads as part of persistence. Syste | ||
| > | md is a system and service manager commonly used for managin | > | md is a system and service manager commonly used for managin | ||
| > | g background daemon processes (also known as services) and o | > | g background daemon processes (also known as services) and o | ||
| > | ther system resources.(Citation: Linux man-pages: systemd Ja | > | ther system resources.(Citation: Linux man-pages: systemd Ja | ||
| > | nuary 2014) Systemd is the default initialization (init) sys | > | nuary 2014) Systemd is the default initialization (init) sys | ||
| > | tem on many Linux distributions replacing legacy init system | > | tem on many Linux distributions replacing legacy init system | ||
| > | s, including SysVinit and Upstart, while remaining backwards | > | s, including SysVinit and Upstart, while remaining backwards | ||
| > | compatible. Systemd utilizes unit configuration files wi | > | compatible. Systemd utilizes unit configuration files wi | ||
| > | th the `.service` file extension to encode information about | > | th the `.service` file extension to encode information about | ||
| > | a service's process. By default, system level unit files ar | > | a service's process. By default, system level unit files ar | ||
| > | e stored in the `/systemd/system` directory of the root owne | > | e stored in the `/systemd/system` directory of the root owne | ||
| > | d directories (`/`). User level unit files are stored in the | > | d directories (`/`). User level unit files are stored in the | ||
| > | `/systemd/user` directories of the user owned directories ( | > | `/systemd/user` directories of the user owned directories ( | ||
| > | `$HOME`).(Citation: lambert systemd 2022) Inside the `.ser | > | `$HOME`).(Citation: lambert systemd 2022) Inside the `.ser | ||
| > | vice` unit files, the following directives are used to execu | > | vice` unit files, the following directives are used to execu | ||
| > | te commands:(Citation: freedesktop systemd.service) * `Ex | > | te commands:(Citation: freedesktop systemd.service) * `Ex | ||
| > | ecStart`, `ExecStartPre`, and `ExecStartPost` directives exe | > | ecStart`, `ExecStartPre`, and `ExecStartPost` directives exe | ||
| > | cute when a service is started manually by `systemctl` or on | > | cute when a service is started manually by `systemctl` or on | ||
| > | system start if the service is set to automatically start. | > | system start if the service is set to automatically start. | ||
| > | * `ExecReload` directive executes when a service restarts. | > | * `ExecReload` directive executes when a service restarts. | ||
| > | * `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives e | > | * `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives e | ||
| > | xecute when a service is stopped. Adversaries have create | > | xecute when a service is stopped. Adversaries have create | ||
| > | d new service files, altered the commands a `.service` file\u2019 | > | d new service files, altered the commands a `.service` file\u2019 | ||
| > | s directive executes, and modified the user directive a `.se | > | s directive executes, and modified the user directive a `.se | ||
| > | rvice` file executes as, which could result in privilege esc | > | rvice` file executes as, which could result in privilege esc | ||
| > | alation. Adversaries may also place symbolic links in these | > | alation. Adversaries may also place symbolic links in these | ||
| > | directories, enabling systemd to find these payloads regardl | > | directories, enabling systemd to find these payloads regardl | ||
| > | ess of where they reside on the filesystem.(Citation: Anomal | > | ess of where they reside on the filesystem.(Citation: Anomal | ||
| > | i Rocke March 2019)(Citation: airwalk backdoor unix systems) | > | i Rocke March 2019)(Citation: airwalk backdoor unix systems) | ||
| > | (Citation: Rapid7 Service Persistence 22JUNE2016) | > | (Citation: Rapid7 Service Persistence 22JUNE2016) The .ser | ||
| > | vice file\u2019s User directive can be used to run service as a s | ||||
| > | pecific user, which could result in privilege escalation bas | ||||
| > | ed on specific user/group permissions. |
HKLM\\SYSTEM\\CurrentControlSet\\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.(Citation: TechNet Autoruns) \n\nCreation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 (Citation: Microsoft 4697 APR 2017)(Citation: Microsoft Windows Event Forwarding FEB 2018)). New, benign services may be created during installation of new software.\n\nSuspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_effective_permissions": [
"Administrator",
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 19:25:51.394000+00:00\", \"old_value\": \"2023-09-15 16:42:25.014000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.\\n\\nAdversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. \\n\\nAdversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as \\\"Bring Your Own Vulnerable Driver\\\" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)\\n\\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002).\\n\\nTo make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create \\u2018hidden\\u2019 services (i.e., [Hide Artifacts](https://attack.mitre.org/techniques/T1564)), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)\", \"old_value\": \"Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.(Citation: TechNet Services) Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.\\n\\nAdversaries may install a new service or modify an existing service to execute at startup in order to persist on a system. Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API. \\n\\nAdversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as \\\"Bring Your Own Vulnerable Driver\\\" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)\\n\\nServices may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component).\", \"diff\": \"--- \\n+++ \\n@@ -4,4 +4,6 @@\\n \\n Adversaries may also use services to install and execute malicious drivers. For example, after dropping a driver file (ex: `.sys`) to disk, the payload can be loaded and registered via [Native API](https://attack.mitre.org/techniques/T1106) functions such as `CreateServiceW()` (or manually via functions such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creating the required service Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)), or by using command-line utilities such as `PnPUtil.exe`.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: Unit42 AcidBox June 2020) Adversaries may leverage these drivers as [Rootkit](https://attack.mitre.org/techniques/T1014)s to hide the presence of malicious activity on a system. Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as \\\"Bring Your Own Vulnerable Driver\\\" (BYOVD)) as part of [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020)\\n \\n-Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002). To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component).\\n+Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges. Adversaries may also directly start services through [Service Execution](https://attack.mitre.org/techniques/T1569/002).\\n+\\n+To make detection analysis more challenging, malicious services may also incorporate [Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) (ex: using a service and/or payload name related to a legitimate OS or benign software component). Adversaries may also create \\u2018hidden\\u2019 services (i.e., [Hide Artifacts](https://attack.mitre.org/techniques/T1564)), for example by using the `sc sdset` command to set service permissions via the Service Descriptor Definition Language (SDDL). This may hide a Windows service from the view of standard service enumeration methods such as `Get-Service`, `sc query`, and `services.exe`.(Citation: SANS 1)(Citation: SANS 2)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"SANS 1\", \"description\": \"Joshua Wright. (2020, October 13). Retrieved March 22, 2024.\", \"url\": \"https://www.sans.org/blog/red-team-tactics-hiding-windows-services/\"}, \"root['external_references'][4]\": {\"source_name\": \"SANS 2\", \"description\": \"Joshua Wright. (2020, October 14). Retrieved March 22, 2024.\", \"url\": \"https://www.sans.org/blog/defense-spotlight-finding-hidden-windows-services/\"}, \"root['x_mitre_contributors'][5]\": \"Wirapong Petshagun\"}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create or modify Windows services to repeate | t | 1 | Adversaries may create or modify Windows services to repeate |
| > | dly execute malicious payloads as part of persistence. When | > | dly execute malicious payloads as part of persistence. When | ||
| > | Windows boots up, it starts programs or applications called | > | Windows boots up, it starts programs or applications called | ||
| > | services that perform background system functions.(Citation: | > | services that perform background system functions.(Citation: | ||
| > | TechNet Services) Windows service configuration information | > | TechNet Services) Windows service configuration information | ||
| > | , including the file path to the service's executable or rec | > | , including the file path to the service's executable or rec | ||
| > | overy programs/commands, is stored in the Windows Registry. | > | overy programs/commands, is stored in the Windows Registry. | ||
| > | Adversaries may install a new service or modify an existing | > | Adversaries may install a new service or modify an existing | ||
| > | service to execute at startup in order to persist on a syst | > | service to execute at startup in order to persist on a syst | ||
| > | em. Service configurations can be set or modified using syst | > | em. Service configurations can be set or modified using syst | ||
| > | em utilities (such as sc.exe), by directly modifying the Reg | > | em utilities (such as sc.exe), by directly modifying the Reg | ||
| > | istry, or by interacting directly with the Windows API. Ad | > | istry, or by interacting directly with the Windows API. Ad | ||
| > | versaries may also use services to install and execute malic | > | versaries may also use services to install and execute malic | ||
| > | ious drivers. For example, after dropping a driver file (ex: | > | ious drivers. For example, after dropping a driver file (ex: | ||
| > | `.sys`) to disk, the payload can be loaded and registered v | > | `.sys`) to disk, the payload can be loaded and registered v | ||
| > | ia [Native API](https://attack.mitre.org/techniques/T1106) f | > | ia [Native API](https://attack.mitre.org/techniques/T1106) f | ||
| > | unctions such as `CreateServiceW()` (or manually via functio | > | unctions such as `CreateServiceW()` (or manually via functio | ||
| > | ns such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creat | > | ns such as `ZwLoadDriver()` and `ZwSetValueKey()`), by creat | ||
| > | ing the required service Registry values (i.e. [Modify Regis | > | ing the required service Registry values (i.e. [Modify Regis | ||
| > | try](https://attack.mitre.org/techniques/T1112)), or by usin | > | try](https://attack.mitre.org/techniques/T1112)), or by usin | ||
| > | g command-line utilities such as `PnPUtil.exe`.(Citation: Sy | > | g command-line utilities such as `PnPUtil.exe`.(Citation: Sy | ||
| > | mantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlay | > | mantec W.32 Stuxnet Dossier)(Citation: Crowdstrike DriveSlay | ||
| > | er February 2022)(Citation: Unit42 AcidBox June 2020) Advers | > | er February 2022)(Citation: Unit42 AcidBox June 2020) Advers | ||
| > | aries may leverage these drivers as [Rootkit](https://attack | > | aries may leverage these drivers as [Rootkit](https://attack | ||
| > | .mitre.org/techniques/T1014)s to hide the presence of malici | > | .mitre.org/techniques/T1014)s to hide the presence of malici | ||
| > | ous activity on a system. Adversaries may also load a signed | > | ous activity on a system. Adversaries may also load a signed | ||
| > | yet vulnerable driver onto a compromised machine (known as | > | yet vulnerable driver onto a compromised machine (known as | ||
| > | \"Bring Your Own Vulnerable Driver\" (BYOVD)) as part of [Expl | > | \"Bring Your Own Vulnerable Driver\" (BYOVD)) as part of [Expl | ||
| > | oitation for Privilege Escalation](https://attack.mitre.org/ | > | oitation for Privilege Escalation](https://attack.mitre.org/ | ||
| > | techniques/T1068).(Citation: ESET InvisiMole June 2020)(Cita | > | techniques/T1068).(Citation: ESET InvisiMole June 2020)(Cita | ||
| > | tion: Unit42 AcidBox June 2020) Services may be created wit | > | tion: Unit42 AcidBox June 2020) Services may be created wit | ||
| > | h administrator privileges but are executed under SYSTEM pri | > | h administrator privileges but are executed under SYSTEM pri | ||
| > | vileges, so an adversary may also use a service to escalate | > | vileges, so an adversary may also use a service to escalate | ||
| > | privileges. Adversaries may also directly start services thr | > | privileges. Adversaries may also directly start services thr | ||
| > | ough [Service Execution](https://attack.mitre.org/techniques | > | ough [Service Execution](https://attack.mitre.org/techniques | ||
| > | /T1569/002). To make detection analysis more challenging, ma | > | /T1569/002). To make detection analysis more challenging, m | ||
| > | licious services may also incorporate [Masquerade Task or Se | > | alicious services may also incorporate [Masquerade Task or S | ||
| > | rvice](https://attack.mitre.org/techniques/T1036/004) (ex: u | > | ervice](https://attack.mitre.org/techniques/T1036/004) (ex: | ||
| > | sing a service and/or payload name related to a legitimate O | > | using a service and/or payload name related to a legitimate | ||
| > | S or benign software component). | > | OS or benign software component). Adversaries may also creat | ||
| > | e \u2018hidden\u2019 services (i.e., [Hide Artifacts](https://attack.m | ||||
| > | itre.org/techniques/T1564)), for example by using the `sc sd | ||||
| > | set` command to set service permissions via the Service Desc | ||||
| > | riptor Definition Language (SDDL). This may hide a Windows s | ||||
| > | ervice from the view of standard service enumeration methods | ||||
| > | such as `Get-Service`, `sc query`, and `services.exe`.(Cita | ||||
| > | tion: SANS 1)(Citation: SANS 2) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search for common password storage locations | t | 1 | Adversaries may search for common password storage locations |
| > | to obtain user credentials. Passwords are stored in several | > | to obtain user credentials.(Citation: F-Secure The Dukes) P | ||
| > | places on a system, depending on the operating system or ap | > | asswords are stored in several places on a system, depending | ||
| > | plication holding the credentials. There are also specific a | > | on the operating system or application holding the credenti | ||
| > | pplications and services that store passwords to make them e | > | als. There are also specific applications and services that | ||
| > | asier for users to manage and maintain, such as password man | > | store passwords to make them easier for users to manage and | ||
| > | agers and cloud secrets vaults. Once credentials are obtaine | > | maintain, such as password managers and cloud secrets vaults | ||
| > | d, they can be used to perform lateral movement and access r | > | . Once credentials are obtained, they can be used to perform | ||
| > | estricted information. | > | lateral movement and access restricted information. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may obtain root access (allowing them to read s | t | 1 | An adversary with root access may gather credentials by read |
| > | ecurityd\u2019s memory), then they can scan through memory to fin | > | ing `securityd`\u2019s memory. `securityd` is a service/daemon re | ||
| > | d the correct sequence of keys in relatively few tries to de | > | sponsible for implementing security protocols such as encryp | ||
| > | crypt the user\u2019s logon keychain. This provides the adversary | > | tion and authorization.(Citation: Apple Dev SecurityD) A pri | ||
| > | with all the plaintext passwords for users, WiFi, mail, bro | > | vileged adversary may be able to scan through `securityd`'s | ||
| > | wsers, certificates, secure notes, etc.(Citation: OS X Keych | > | memory to find the correct sequence of keys to decrypt the u | ||
| > | ain)(Citation: OSX Keydnap malware) In OS X prior to El Cap | > | ser\u2019s logon keychain. This may provide the adversary with va | ||
| > | itan, users with root access can read plaintext keychain pas | > | rious plaintext passwords, such as those for users, WiFi, ma | ||
| > | swords of logged-in users because Apple\u2019s keychain implement | > | il, browsers, certificates, secure notes, etc.(Citation: OS | ||
| > | ation allows these credentials to be cached so that users ar | > | X Keychain)(Citation: OSX Keydnap malware) In OS X prior to | ||
| > | e not repeatedly prompted for passwords.(Citation: OS X Keyc | > | El Capitan, users with root access can read plaintext keych | ||
| > | hain)(Citation: External to DA, the OS X Way) Apple\u2019s securi | > | ain passwords of logged-in users because Apple\u2019s keychain im | ||
| > | tyd utility takes the user\u2019s logon password, encrypts it wit | > | plementation allows these credentials to be cached so that u | ||
| > | h PBKDF2, and stores this master key in memory. Apple also u | > | sers are not repeatedly prompted for passwords.(Citation: OS | ||
| > | ses a set of keys and algorithms to encrypt the user\u2019s passw | > | X Keychain)(Citation: External to DA, the OS X Way) Apple\u2019s | ||
| > | ord, but once the master key is found, an adversary need onl | > | `securityd` utility takes the user\u2019s logon password, encryp | ||
| > | y iterate over the other values to unlock the final password | > | ts it with PBKDF2, and stores this master key in memory. App | ||
| > | .(Citation: OS X Keychain) | > | le also uses a set of keys and algorithms to encrypt the use | ||
| > | r\u2019s password, but once the master key is found, an adversary | ||||
| > | need only iterate over the other values to unlock the final | ||||
| > | password.(Citation: OS X Keychain) |
create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1610",
"external_id": "T1610"
},
{
"source_name": "AppSecco Kubernetes Namespace Breakout 2020",
"description": "Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume \u2014 Part 1. Retrieved January 16, 2024.",
"url": "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"
},
{
"source_name": "Aqua Build Images on Hosts",
"description": "Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.",
"url": "https://blog.aquasec.com/malicious-container-image-docker-container-host"
},
{
"source_name": "Docker Containers API",
"description": "Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021.",
"url": "https://docs.docker.com/engine/api/v1.41/#tag/Container"
},
{
"source_name": "Kubernetes Workload Management",
"description": "Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.",
"url": "https://kubernetes.io/docs/concepts/workloads/controllers/"
},
{
"source_name": "Kubeflow Pipelines",
"description": "The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines. Retrieved March 29, 2021.",
"url": "https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/"
},
{
"source_name": "Kubernetes Dashboard",
"description": "The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.",
"url": "https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Pawan Kinger, @kingerpawan, Trend Micro",
"Alfredo Oliveira, Trend Micro",
"Idan Frimark, Cisco",
"Center for Threat-Informed Defense (CTID)",
"Magno Logan, @magnologan, Trend Micro",
"Ariel Shuper, Cisco",
"Vishwas Manral, McAfee",
"Yossi Weizman, Azure Defender Research Team",
"Joas Antonio dos Santos, @C0d3Cr4zy"
],
"x_mitre_data_sources": [
"Container: Container Start",
"Application Log: Application Log Content",
"Pod: Pod Creation",
"Container: Container Creation",
"Pod: Pod Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for suspicious or unknown container images and pods in your environment. Deploy logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application pods to detect malicious activity at the cluster level. In Docker, the daemon log provides insight into remote API calls, including those that deploy containers. Logs for management services or applications used to deploy containers other than the native technologies themselves should also be monitored.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Containers"
],
"x_mitre_remote_support": true,
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 21:24:42.680000+00:00\", \"old_value\": \"2023-04-15 16:13:40.232000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n\\nContainers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\", \"old_value\": \"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.\\n\\nContainers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.\\n+Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)\\n \\n-Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\\n+Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"AppSecco Kubernetes Namespace Breakout 2020\", \"description\": \"Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume \\u2014 Part 1. Retrieved January 16, 2024.\", \"url\": \"https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216\"}, \"root['external_references'][4]\": {\"source_name\": \"Kubernetes Workload Management\", \"description\": \"Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.\", \"url\": \"https://kubernetes.io/docs/concepts/workloads/controllers/\"}, \"root['x_mitre_contributors'][8]\": \"Joas Antonio dos Santos, @C0d3Cr4zy\"}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may deploy a container into an environment to fa | t | 1 | Adversaries may deploy a container into an environment to fa |
| > | cilitate execution or evade defenses. In some cases, adversa | > | cilitate execution or evade defenses. In some cases, adversa | ||
| > | ries may deploy a new container to execute processes associa | > | ries may deploy a new container to execute processes associa | ||
| > | ted with a particular image or deployment, such as processes | > | ted with a particular image or deployment, such as processes | ||
| > | that execute or download malware. In others, an adversary m | > | that execute or download malware. In others, an adversary m | ||
| > | ay deploy a new container configured without network rules, | > | ay deploy a new container configured without network rules, | ||
| > | user limitations, etc. to bypass existing defenses within th | > | user limitations, etc. to bypass existing defenses within th | ||
| > | e environment. Containers can be deployed by various means, | > | e environment. In Kubernetes environments, an adversary may | ||
| > | such as via Docker's <code>create</code> and <code>start</c | > | attempt to deploy a privileged or vulnerable container into | ||
| > | ode> APIs or via a web application such as the Kubernetes da | > | a specific node in order to [Escape to Host](https://attack. | ||
| > | shboard or Kubeflow.(Citation: Docker Containers API)(Citati | > | mitre.org/techniques/T1611) and access other containers runn | ||
| > | on: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adve | > | ing on the node. (Citation: AppSecco Kubernetes Namespace Br | ||
| > | rsaries may deploy containers based on retrieved or built ma | > | eakout 2020) Containers can be deployed by various means, s | ||
| > | licious images or from benign images that download and execu | > | uch as via Docker's <code>create</code> and <code>start</cod | ||
| > | te malicious payloads at runtime.(Citation: Aqua Build Image | > | e> APIs or via a web application such as the Kubernetes dash | ||
| > | s on Hosts) | > | board or Kubeflow. (Citation: Docker Containers API)(Citatio | ||
| > | n: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Ku | ||||
| > | bernetes environments, containers may be deployed through wo | ||||
| > | rkloads such as ReplicaSets or DaemonSets, which can allow c | ||||
| > | ontainers to be deployed across multiple nodes.(Citation: Ku | ||||
| > | bernetes Workload Management) Adversaries may deploy contain | ||||
| > | ers based on retrieved or built malicious images or from ben | ||||
| > | ign images that download and execute malicious payloads at r | ||||
| > | untime.(Citation: Aqua Build Images on Hosts) |
\\\\\\\\.\\\\ notation.(Citation: Microsoft Sysmon v6 May 2017) Monitor for unusual kernel driver installation activity.\n\nFor network infrastructure devices, collect AAA logging to monitor for `erase` commands that delete critical configuration files.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 13:00:33.303000+00:00\", \"old_value\": \"2023-04-12 23:42:59.868000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1053: Data Backup"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0016: Drive (Drive Access)",
"DS0016: Drive (Drive Modification)",
"DS0017: Command (Command Execution)",
"DS0027: Driver (Driver Load)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-16 15:33:01.739000+00:00",
"modified": "2024-04-16 12:29:47.903000+00:00",
"name": "Encrypted Channel",
"description": "Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1573",
"external_id": "T1573"
},
{
"source_name": "SANS Decrypting SSL",
"description": "Butler, M. (2013, November). Finding Hidden Threats by Decrypting SSL. Retrieved April 5, 2016.",
"url": "http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840"
},
{
"source_name": "SEI SSL Inspection Risks",
"description": "Dormann, W. (2015, March 13). The Risks of SSL Inspection. Retrieved April 5, 2016.",
"url": "https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Network Traffic: Network Traffic Content"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "SSL/TLS inspection is one way of detecting command and control traffic within some encrypted communication channels.(Citation: SANS Decrypting SSL) SSL/TLS inspection does come with certain risks that should be considered before implementing to avoid potential security issues such as incomplete certificate validation.(Citation: SEI SSL Inspection Risks)\n\nIn general, analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:29:47.903000+00:00\", \"old_value\": \"2021-04-20 19:27:46.650000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\", \"old_value\": \"Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ a known encryption algorithm to conce | t | 1 | Adversaries may employ an encryption algorithm to conceal co |
| > | al command and control traffic rather than relying on any in | > | mmand and control traffic rather than relying on any inheren | ||
| > | herent protections provided by a communication protocol. Des | > | t protections provided by a communication protocol. Despite | ||
| > | pite the use of a secure algorithm, these implementations ma | > | the use of a secure algorithm, these implementations may be | ||
| > | y be vulnerable to reverse engineering if secret keys are en | > | vulnerable to reverse engineering if secret keys are encoded | ||
| > | coded and/or generated within malware samples/configuration | > | and/or generated within malware samples/configuration files | ||
| > | files. | > | . |
mount (as well as resulting process activity) that may indicate an attempt to escape from a privileged container to host. In Kubernetes, monitor for cluster-level events associated with changing containers' volume configurations.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"User",
"root"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"Containers"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-19 12:42:18.632000+00:00\", \"old_value\": \"2023-04-15 16:21:04.265000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)\\n\\nThere are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host\\u2019s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)\\n\\nAdditionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)\\n\\nGaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers running on the host, or setting up a command and control channel on the host.\", \"old_value\": \"Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)\\n\\nThere are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host\\u2019s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host; utilizing a privileged container to run commands or load a malicious kernel module on the underlying host; or abusing system calls such as `unshare` and `keyctl` to escalate privileges and steal secrets.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20)(Citation: Container Escape)(Citation: Crowdstrike Kubernetes Container Escape)(Citation: Keyctl-unmask)\\n\\nAdditionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)\\n\\nGaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.\", \"diff\": \"--- \\n+++ \\n@@ -4,4 +4,4 @@\\n \\n Additionally, an adversary may be able to exploit a compromised container with a mounted container management socket, such as `docker.sock`, to break out of the container via a [Container Administration Command](https://attack.mitre.org/techniques/T1609).(Citation: Container Escape) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)\\n \\n-Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.\\n+Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, accessing other containers running on the host, or setting up a command and control channel on the host.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][13]\": \"Joas Antonio dos Santos, @C0d3Cr4zy\"}, \"iterable_item_removed\": {\"root['x_mitre_contributors'][2]\": \"Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics\"}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may break out of a container to gain access to t | t | 1 | Adversaries may break out of a container to gain access to t |
| > | he underlying host. This can allow an adversary access to ot | > | he underlying host. This can allow an adversary access to ot | ||
| > | her containerized resources from the host level or to the ho | > | her containerized resources from the host level or to the ho | ||
| > | st itself. In principle, containerized resources should prov | > | st itself. In principle, containerized resources should prov | ||
| > | ide a clear separation of application functionality and be i | > | ide a clear separation of application functionality and be i | ||
| > | solated from the host environment.(Citation: Docker Overview | > | solated from the host environment.(Citation: Docker Overview | ||
| > | ) There are multiple ways an adversary may escape to a host | > | ) There are multiple ways an adversary may escape to a host | ||
| > | environment. Examples include creating a container configur | > | environment. Examples include creating a container configur | ||
| > | ed to mount the host\u2019s filesystem using the bind parameter, | > | ed to mount the host\u2019s filesystem using the bind parameter, | ||
| > | which allows the adversary to drop payloads and execute cont | > | which allows the adversary to drop payloads and execute cont | ||
| > | rol utilities such as cron on the host; utilizing a privileg | > | rol utilities such as cron on the host; utilizing a privileg | ||
| > | ed container to run commands or load a malicious kernel modu | > | ed container to run commands or load a malicious kernel modu | ||
| > | le on the underlying host; or abusing system calls such as ` | > | le on the underlying host; or abusing system calls such as ` | ||
| > | unshare` and `keyctl` to escalate privileges and steal secre | > | unshare` and `keyctl` to escalate privileges and steal secre | ||
| > | ts.(Citation: Docker Bind Mounts)(Citation: Trend Micro Priv | > | ts.(Citation: Docker Bind Mounts)(Citation: Trend Micro Priv | ||
| > | ileged Container)(Citation: Intezer Doki July 20)(Citation: | > | ileged Container)(Citation: Intezer Doki July 20)(Citation: | ||
| > | Container Escape)(Citation: Crowdstrike Kubernetes Container | > | Container Escape)(Citation: Crowdstrike Kubernetes Container | ||
| > | Escape)(Citation: Keyctl-unmask) Additionally, an adversar | > | Escape)(Citation: Keyctl-unmask) Additionally, an adversar | ||
| > | y may be able to exploit a compromised container with a moun | > | y may be able to exploit a compromised container with a moun | ||
| > | ted container management socket, such as `docker.sock`, to b | > | ted container management socket, such as `docker.sock`, to b | ||
| > | reak out of the container via a [Container Administration Co | > | reak out of the container via a [Container Administration Co | ||
| > | mmand](https://attack.mitre.org/techniques/T1609).(Citation: | > | mmand](https://attack.mitre.org/techniques/T1609).(Citation: | ||
| > | Container Escape) Adversaries may also escape via [Exploita | > | Container Escape) Adversaries may also escape via [Exploita | ||
| > | tion for Privilege Escalation](https://attack.mitre.org/tech | > | tion for Privilege Escalation](https://attack.mitre.org/tech | ||
| > | niques/T1068), such as exploiting vulnerabilities in global | > | niques/T1068), such as exploiting vulnerabilities in global | ||
| > | symbolic links in order to access the root directory of a ho | > | symbolic links in order to access the root directory of a ho | ||
| > | st machine.(Citation: Windows Server Containers Are Open) G | > | st machine.(Citation: Windows Server Containers Are Open) G | ||
| > | aining access to the host may provide the adversary with the | > | aining access to the host may provide the adversary with the | ||
| > | opportunity to achieve follow-on objectives, such as establ | > | opportunity to achieve follow-on objectives, such as establ | ||
| > | ishing persistence, moving laterally within the environment, | > | ishing persistence, moving laterally within the environment, | ||
| > | or setting up a command and control channel on the host. | > | accessing other containers running on the host, or setting | ||
| > | up a command and control channel on the host. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create and cultivate accounts with services | t | 1 | Adversaries may create and cultivate accounts with services |
| > | that can be used during targeting. Adversaries can create ac | > | that can be used during targeting. Adversaries can create ac | ||
| > | counts that can be used to build a persona to further operat | > | counts that can be used to build a persona to further operat | ||
| > | ions. Persona development consists of the development of pub | > | ions. Persona development consists of the development of pub | ||
| > | lic information, presence, history and appropriate affiliati | > | lic information, presence, history and appropriate affiliati | ||
| > | ons. This development could be applied to social media, webs | > | ons. This development could be applied to social media, webs | ||
| > | ite, or other publicly available information that could be r | > | ite, or other publicly available information that could be r | ||
| > | eferenced and scrutinized for legitimacy over the course of | > | eferenced and scrutinized for legitimacy over the course of | ||
| > | an operation using that persona or identity.(Citation: NEWSC | > | an operation using that persona or identity.(Citation: NEWSC | ||
| > | ASTER2014)(Citation: BlackHatRobinSage) For operations inco | > | ASTER2014)(Citation: BlackHatRobinSage) For operations inco | ||
| > | rporating social engineering, the utilization of an online p | > | rporating social engineering, the utilization of an online p | ||
| > | ersona may be important. These personas may be fictitious or | > | ersona may be important. These personas may be fictitious or | ||
| > | impersonate real people. The persona may exist on a single | > | impersonate real people. The persona may exist on a single | ||
| > | site or across multiple sites (ex: Facebook, LinkedIn, Twitt | > | site or across multiple sites (ex: Facebook, LinkedIn, Twitt | ||
| > | er, Google, GitHub, Docker Hub, etc.). Establishing a person | > | er, Google, GitHub, Docker Hub, etc.). Establishing a person | ||
| > | a may require development of additional documentation to mak | > | a may require development of additional documentation to mak | ||
| > | e them seem real. This could include filling out profile inf | > | e them seem real. This could include filling out profile inf | ||
| > | ormation, developing social networks, or incorporating photo | > | ormation, developing social networks, or incorporating photo | ||
| > | s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) E | > | s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) E | ||
| > | stablishing accounts can also include the creation of accoun | > | stablishing accounts can also include the creation of accoun | ||
| > | ts with email providers, which may be directly leveraged for | > | ts with email providers, which may be directly leveraged for | ||
| > | [Phishing for Information](https://attack.mitre.org/techniq | > | [Phishing for Information](https://attack.mitre.org/techniq | ||
| > | ues/T1598) or [Phishing](https://attack.mitre.org/techniques | > | ues/T1598) or [Phishing](https://attack.mitre.org/techniques | ||
| > | /T1566).(Citation: Mandiant APT1) | > | /T1566).(Citation: Mandiant APT1) In addition, establishing | ||
| > | accounts may allow adversaries to abuse free services, such | ||||
| > | as registering for trial periods to [Acquire Infrastructure] | ||||
| > | (https://attack.mitre.org/techniques/T1583) for malicious pu | ||||
| > | rposes.(Citation: Free Trial PurpleUrchin) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create email accounts that can be used durin | t | 1 | Adversaries may create email accounts that can be used durin |
| > | g targeting. Adversaries can use accounts created with email | > | g targeting. Adversaries can use accounts created with email | ||
| > | providers to further their operations, such as leveraging t | > | providers to further their operations, such as leveraging t | ||
| > | hem to conduct [Phishing for Information](https://attack.mit | > | hem to conduct [Phishing for Information](https://attack.mit | ||
| > | re.org/techniques/T1598) or [Phishing](https://attack.mitre. | > | re.org/techniques/T1598) or [Phishing](https://attack.mitre. | ||
| > | org/techniques/T1566).(Citation: Mandiant APT1) Adversaries | > | org/techniques/T1566).(Citation: Mandiant APT1) Establishing | ||
| > | may also take steps to cultivate a persona around the email | > | email accounts may also allow adversaries to abuse free ser | ||
| > | account, such as through use of [Social Media Accounts](http | > | vices \u2013 such as trial periods \u2013 to [Acquire Infrastructure]( | ||
| > | s://attack.mitre.org/techniques/T1585/001), to increase the | > | https://attack.mitre.org/techniques/T1583) for follow-on pur | ||
| > | chance of success of follow-on behaviors. Created email acco | > | poses.(Citation: Free Trial PurpleUrchin) Adversaries may a | ||
| > | unts can also be used in the acquisition of infrastructure ( | > | lso take steps to cultivate a persona around the email accou | ||
| > | ex: [Domains](https://attack.mitre.org/techniques/T1583/001) | > | nt, such as through use of [Social Media Accounts](https://a | ||
| > | ).(Citation: Mandiant APT1) To decrease the chance of physi | > | ttack.mitre.org/techniques/T1585/001), to increase the chanc | ||
| > | cally tying back operations to themselves, adversaries may m | > | e of success of follow-on behaviors. Created email accounts | ||
| > | ake use of disposable email services.(Citation: Trend Micro | > | can also be used in the acquisition of infrastructure (ex: [ | ||
| > | R980 2016) | > | Domains](https://attack.mitre.org/techniques/T1583/001)).(Ci | ||
| > | tation: Mandiant APT1) To decrease the chance of physically | ||||
| > | tying back operations to themselves, adversaries may make u | ||||
| > | se of disposable email services.(Citation: Trend Micro R980 | ||||
| > | 2016) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and elevate privileges | t | 1 | Adversaries may establish persistence and elevate privileges |
| > | by using an installer to trigger the execution of malicious | > | by using an installer to trigger the execution of malicious | ||
| > | content. Installer packages are OS specific and contain the | > | content. Installer packages are OS specific and contain the | ||
| > | resources an operating system needs to install applications | > | resources an operating system needs to install applications | ||
| > | on a system. Installer packages can include scripts that ru | > | on a system. Installer packages can include scripts that ru | ||
| > | n prior to installation as well as after installation is com | > | n prior to installation as well as after installation is com | ||
| > | plete. Installer scripts may inherit elevated permissions wh | > | plete. Installer scripts may inherit elevated permissions wh | ||
| > | en executed. Developers often use these scripts to prepare t | > | en executed. Developers often use these scripts to prepare t | ||
| > | he environment for installation, check requirements, downloa | > | he environment for installation, check requirements, downloa | ||
| > | d dependencies, and remove files after installation.(Citatio | > | d dependencies, and remove files after installation.(Citatio | ||
| > | n: Installer Package Scripting Rich Trouton) Using legitima | > | n: Installer Package Scripting Rich Trouton) Using legitima | ||
| > | te applications, adversaries have distributed applications w | > | te applications, adversaries have distributed applications w | ||
| > | ith modified installer scripts to execute malicious content. | > | ith modified installer scripts to execute malicious content. | ||
| > | When a user installs the application, they may be required | > | When a user installs the application, they may be required | ||
| > | to grant administrative permissions to allow the installatio | > | to grant administrative permissions to allow the installatio | ||
| > | n. At the end of the installation process of the legitimate | > | n. At the end of the installation process of the legitimate | ||
| > | application, content such as macOS `postinstall` scripts can | > | application, content such as macOS `postinstall` scripts can | ||
| > | be executed with the inherited elevated permissions. Advers | > | be executed with the inherited elevated permissions. Advers | ||
| > | aries can use these scripts to execute a malicious executabl | > | aries can use these scripts to execute a malicious executabl | ||
| > | e or install other malicious components (such as a [Launch D | > | e or install other malicious components (such as a [Launch D | ||
| > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | > | aemon](https://attack.mitre.org/techniques/T1543/004)) with | ||
| > | the elevated permissions.(Citation: Application Bundle Manip | > | the elevated permissions.(Citation: Application Bundle Manip | ||
| > | ulation Brandon Dalton)(Citation: wardle evilquest parti) D | > | ulation Brandon Dalton)(Citation: wardle evilquest parti)(Ci | ||
| > | epending on the distribution, Linux versions of package inst | > | tation: Windows AppleJeus GReAT)(Citation: Debian Manual Mai | ||
| > | aller scripts are sometimes called maintainer scripts or pos | > | ntainer Scripts) Depending on the distribution, Linux versi | ||
| > | t installation scripts. These scripts can include `preinst`, | > | ons of package installer scripts are sometimes called mainta | ||
| > | `postinst`, `prerm`, `postrm` scripts and run as root when | > | iner scripts or post installation scripts. These scripts can | ||
| > | executed. For Windows, the Microsoft Installer services use | > | include `preinst`, `postinst`, `prerm`, `postrm` scripts an | ||
| > | s `.msi` files to manage the installing, updating, and unins | > | d run as root when executed. For Windows, the Microsoft Ins | ||
| > | talling of applications. Adversaries have leveraged `Prebuil | > | taller services uses `.msi` files to manage the installing, | ||
| > | d` and `Postbuild` events to run commands before or after a | > | updating, and uninstalling of applications. These installati | ||
| > | build when installing .msi files.(Citation: Windows AppleJeu | > | on routines may also include instructions to perform additio | ||
| > | s GReAT)(Citation: Debian Manual Maintainer Scripts) | > | nal actions that may be abused by adversaries.(Citation: Mic | ||
| > | rosoft Installation Procedures) |
EventFilter, EventConsumer, and FilterToConsumerBinding events. Event ID 5861 is logged on Windows 10 systems when new EventFilterToConsumerBinding events are created.(Citation: Elastic - Hunting for Persistence Part 1)\n\nMonitor processes and command-line arguments that can be used to register WMI persistence, such as the Register-WmiEvent [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, as well as those that result from the execution of subscriptions (i.e. spawning from the WmiPrvSe.exe WMI Provider Host process).(Citation: Microsoft Register-WmiEvent)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"SYSTEM"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-13 14:08:20.882000+00:00\", \"old_value\": \"2023-04-21 12:32:38.796000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)\\n\\nAdversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts \\u2013 using `mofcomp.exe` \\u2013into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018)\\n\\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\", \"old_value\": \"Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015)\\n\\nAdversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018)\\n\\nWMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.(Citation: Mandiant M-Trends 2015)\\n+Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)\\n \\n-Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018)\\n+Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.(Citation: FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversaries may also compile WMI scripts \\u2013 using `mofcomp.exe` \\u2013into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.(Citation: Dell WMI Persistence)(Citation: Microsoft MOF May 2018)\\n \\n WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}, \"iterable_item_added\": {\"root['x_mitre_contributors'][2]\": \"Viren Chaudhari, Qualys\", \"root['x_mitre_data_sources'][0]\": \"File: File Creation\"}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may establish persistence and elevate privileges | t | 1 | Adversaries may establish persistence and elevate privileges |
| > | by executing malicious content triggered by a Windows Manag | > | by executing malicious content triggered by a Windows Manag | ||
| > | ement Instrumentation (WMI) event subscription. WMI can be u | > | ement Instrumentation (WMI) event subscription. WMI can be u | ||
| > | sed to install event filters, providers, consumers, and bind | > | sed to install event filters, providers, consumers, and bind | ||
| > | ings that execute code when a defined event occurs. Examples | > | ings that execute code when a defined event occurs. Examples | ||
| > | of events that may be subscribed to are the wall clock time | > | of events that may be subscribed to are the wall clock time | ||
| > | , user loging, or the computer's uptime.(Citation: Mandiant | > | , user login, or the computer's uptime.(Citation: Mandiant M | ||
| > | M-Trends 2015) Adversaries may use the capabilities of WMI | > | -Trends 2015) Adversaries may use the capabilities of WMI t | ||
| > | to subscribe to an event and execute arbitrary code when tha | > | o subscribe to an event and execute arbitrary code when that | ||
| > | t event occurs, providing persistence on a system.(Citation: | > | event occurs, providing persistence on a system.(Citation: | ||
| > | FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversar | > | FireEye WMI SANS 2015)(Citation: FireEye WMI 2015) Adversari | ||
| > | ies may also compile WMI scripts into Windows Management Obj | > | es may also compile WMI scripts \u2013 using `mofcomp.exe` \u2013into | ||
| > | ect (MOF) files (.mof extension) that can be used to create | > | Windows Management Object (MOF) files (.mof extension) that | ||
| > | a malicious subscription.(Citation: Dell WMI Persistence)(Ci | > | can be used to create a malicious subscription.(Citation: D | ||
| > | tation: Microsoft MOF May 2018) WMI subscription execution | > | ell WMI Persistence)(Citation: Microsoft MOF May 2018) WMI | ||
| > | is proxied by the WMI Provider Host process (WmiPrvSe.exe) a | > | subscription execution is proxied by the WMI Provider Host p | ||
| > | nd thus may result in elevated SYSTEM privileges. | > | rocess (WmiPrvSe.exe) and thus may result in elevated SYSTEM | ||
| > | privileges. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to exploit a weakness in an Internet | t | 1 | Adversaries may attempt to exploit a weakness in an Internet |
| > | -facing host or system to initially access a network. The we | > | -facing host or system to initially access a network. The we | ||
| > | akness in the system can be a software bug, a temporary glit | > | akness in the system can be a software bug, a temporary glit | ||
| > | ch, or a misconfiguration. Exploited applications are often | > | ch, or a misconfiguration. Exploited applications are often | ||
| > | websites/web servers, but can also include databases (like | > | websites/web servers, but can also include databases (like | ||
| > | SQL), standard services (like SMB or SSH), network device ad | > | SQL), standard services (like SMB or SSH), network device ad | ||
| > | ministration and management protocols (like SNMP and Smart I | > | ministration and management protocols (like SNMP and Smart I | ||
| > | nstall), and any other system with Internet accessible open | > | nstall), and any other system with Internet accessible open | ||
| > | sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple | > | sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple | ||
| > | SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In | > | SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In | ||
| > | frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic | > | frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic | ||
| > | e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla | > | e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla | ||
| > | w being exploited this may also involve [Exploitation for De | > | w being exploited this may also involve [Exploitation for De | ||
| > | fense Evasion](https://attack.mitre.org/techniques/T1211). | > | fense Evasion](https://attack.mitre.org/techniques/T1211) or | ||
| > | If an application is hosted on cloud-based infrastructure a | > | [Exploitation for Client Execution](https://attack.mitre.or | ||
| > | nd/or is containerized, then exploiting it may lead to compr | > | g/techniques/T1203). If an application is hosted on cloud-b | ||
| > | omise of the underlying instance or container. This can allo | > | ased infrastructure and/or is containerized, then exploiting | ||
| > | w an adversary a path to access the cloud or container APIs, | > | it may lead to compromise of the underlying instance or con | ||
| > | exploit container host access via [Escape to Host](https:// | > | tainer. This can allow an adversary a path to access the clo | ||
| > | attack.mitre.org/techniques/T1611), or take advantage of wea | > | ud or container APIs, exploit container host access via [Esc | ||
| > | k identity and access management policies. Adversaries may | > | ape to Host](https://attack.mitre.org/techniques/T1611), or | ||
| > | also exploit edge network infrastructure and related applian | > | take advantage of weak identity and access management polici | ||
| > | ces, specifically targeting devices that do not support robu | > | es. Adversaries may also exploit edge network infrastructur | ||
| > | st host-based defenses.(Citation: Mandiant Fortinet Zero Day | > | e and related appliances, specifically targeting devices tha | ||
| > | )(Citation: Wired Russia Cyberwar) For websites and databas | > | t do not support robust host-based defenses.(Citation: Mandi | ||
| > | es, the OWASP top 10 and CWE top 25 highlight the most commo | > | ant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) For | ||
| > | n web-based vulnerabilities.(Citation: OWASP Top 10)(Citatio | > | websites and databases, the OWASP top 10 and CWE top 25 hig | ||
| > | n: CWE top 25) | > | hlight the most common web-based vulnerabilities.(Citation: | ||
| > | OWASP Top 10)(Citation: CWE top 25) |
dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)\n\nSome files and directories may require elevated or specific user permissions to access.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1083",
"external_id": "T1083"
},
{
"source_name": "Windows Commands JPCERT",
"description": "Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.",
"url": "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Process: Process Creation",
"Process: OS API Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Further, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands may also be used to gather file and directory information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"dictionary_item_removed\": {\"root['x_mitre_system_requirements']\": [\"Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:40:10.978000+00:00\", \"old_value\": \"2023-03-30 21:01:42.631000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)\\n\\nSome files and directories may require elevated or specific user permissions to access.\", \"old_value\": \"Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,5 @@\\n Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n \\n Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)\\n+\\n+Some files and directories may require elevated or specific user permissions to access.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.6\", \"old_value\": \"1.5\"}}}",
"previous_version": "1.5",
"version_change": "1.5 \u2192 1.6",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may enumerate files and directories or may searc | t | 1 | Adversaries may enumerate files and directories or may searc |
| > | h in specific locations of a host or network share for certa | > | h in specific locations of a host or network share for certa | ||
| > | in information within a file system. Adversaries may use the | > | in information within a file system. Adversaries may use the | ||
| > | information from [File and Directory Discovery](https://att | > | information from [File and Directory Discovery](https://att | ||
| > | ack.mitre.org/techniques/T1083) during automated discovery t | > | ack.mitre.org/techniques/T1083) during automated discovery t | ||
| > | o shape follow-on behaviors, including whether or not the ad | > | o shape follow-on behaviors, including whether or not the ad | ||
| > | versary fully infects the target and/or attempts specific ac | > | versary fully infects the target and/or attempts specific ac | ||
| > | tions. Many command shell utilities can be used to obtain t | > | tions. Many command shell utilities can be used to obtain t | ||
| > | his information. Examples include <code>dir</code>, <code>tr | > | his information. Examples include <code>dir</code>, <code>tr | ||
| > | ee</code>, <code>ls</code>, <code>find</code>, and <code>loc | > | ee</code>, <code>ls</code>, <code>find</code>, and <code>loc | ||
| > | ate</code>.(Citation: Windows Commands JPCERT) Custom tools | > | ate</code>.(Citation: Windows Commands JPCERT) Custom tools | ||
| > | may also be used to gather file and directory information an | > | may also be used to gather file and directory information an | ||
| > | d interact with the [Native API](https://attack.mitre.org/te | > | d interact with the [Native API](https://attack.mitre.org/te | ||
| > | chniques/T1106). Adversaries may also leverage a [Network De | > | chniques/T1106). Adversaries may also leverage a [Network De | ||
| > | vice CLI](https://attack.mitre.org/techniques/T1059/008) on | > | vice CLI](https://attack.mitre.org/techniques/T1059/008) on | ||
| > | network devices to gather file and directory information (e. | > | network devices to gather file and directory information (e. | ||
| > | g. <code>dir</code>, <code>show flash</code>, and/or <code>n | > | g. <code>dir</code>, <code>show flash</code>, and/or <code>n | ||
| > | vram</code>).(Citation: US-CERT-TA18-106A) | > | vram</code>).(Citation: US-CERT-TA18-106A) Some files and d | ||
| > | irectories may require elevated or specific user permissions | ||||
| > | to access. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may steal monetary resources from targets throug | t | 1 | Adversaries may steal monetary resources from targets throug |
| > | h extortion, social engineering, technical theft, or other m | > | h extortion, social engineering, technical theft, or other m | ||
| > | ethods aimed at their own financial gain at the expense of t | > | ethods aimed at their own financial gain at the expense of t | ||
| > | he availability of these resources for victims. Financial th | > | he availability of these resources for victims. Financial th | ||
| > | eft is the ultimate objective of several popular campaign ty | > | eft is the ultimate objective of several popular campaign ty | ||
| > | pes including extortion by ransomware,(Citation: FBI-ransomw | > | pes including extortion by ransomware,(Citation: FBI-ransomw | ||
| > | are) business email compromise (BEC) and fraud,(Citation: FB | > | are) business email compromise (BEC) and fraud,(Citation: FB | ||
| > | I-BEC) \"pig butchering,\"(Citation: wired-pig butchering) ban | > | I-BEC) \"pig butchering,\"(Citation: wired-pig butchering) ban | ||
| > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | > | k hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocu | ||
| > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | > | rrency networks.(Citation: BBC-Ronin) Adversaries may [Com | ||
| > | promise Accounts](https://attack.mitre.org/techniques/T1586) | > | promise Accounts](https://attack.mitre.org/techniques/T1586) | ||
| > | to conduct unauthorized transfers of funds.(Citation: Inter | > | to conduct unauthorized transfers of funds.(Citation: Inter | ||
| > | net crime report 2022) In the case of business email comprom | > | net crime report 2022) In the case of business email comprom | ||
| > | ise or email fraud, an adversary may utilize [Impersonation] | > | ise or email fraud, an adversary may utilize [Impersonation] | ||
| > | (https://attack.mitre.org/techniques/T1656) of a trusted ent | > | (https://attack.mitre.org/techniques/T1656) of a trusted ent | ||
| > | ity. Once the social engineering is successful, victims can | > | ity. Once the social engineering is successful, victims can | ||
| > | be deceived into sending money to financial accounts control | > | be deceived into sending money to financial accounts control | ||
| > | led by an adversary.(Citation: FBI-BEC) This creates the pot | > | led by an adversary.(Citation: FBI-BEC) This creates the pot | ||
| > | ential for multiple victims (i.e., compromised accounts as w | > | ential for multiple victims (i.e., compromised accounts as w | ||
| > | ell as the ultimate monetary loss) in incidents involving fi | > | ell as the ultimate monetary loss) in incidents involving fi | ||
| > | nancial theft.(Citation: VEC) Extortion by ransomware may o | > | nancial theft.(Citation: VEC) Extortion by ransomware may o | ||
| > | ccur, for example, when an adversary demands payment from a | > | ccur, for example, when an adversary demands payment from a | ||
| > | victim after [Data Encrypted for Impact](https://attack.mitr | > | victim after [Data Encrypted for Impact](https://attack.mitr | ||
| > | e.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfilt | > | e.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfilt | ||
| > | ration](https://attack.mitre.org/tactics/TA0010) of data, fo | > | ration](https://attack.mitre.org/tactics/TA0010) of data, fo | ||
| > | llowed by threatening public exposure unless payment is made | > | llowed by threatening to leak sensitive data to the public u | ||
| > | to the adversary.(Citation: Mandiant-leaks) Due to the pot | > | nless payment is made to the adversary.(Citation: Mandiant-l | ||
| > | entially immense business impact of financial theft, an adve | > | eaks) Adversaries may use dedicated leak sites to distribute | ||
| > | rsary may abuse the possibility of financial theft and seeki | > | victim data.(Citation: Crowdstrike-leaks) Due to the poten | ||
| > | ng monetary gain to divert attention from their true goals s | > | tially immense business impact of financial theft, an advers | ||
| > | uch as [Data Destruction](https://attack.mitre.org/technique | > | ary may abuse the possibility of financial theft and seeking | ||
| > | s/T1485) and business disruption.(Citation: AP-NotPetya) | > | monetary gain to divert attention from their true goals suc | ||
| > | h as [Data Destruction](https://attack.mitre.org/techniques/ | ||||
| > | T1485) and business disruption.(Citation: AP-NotPetya) |
NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)\n\nAn adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.\n\nAn adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1606/002",
"external_id": "T1606.002"
},
{
"source_name": "Microsoft SolarWinds Steps",
"description": "Lambert, J. (2020, December 13). Important steps for customers to protect themselves from recent nation-state cyberattacks. Retrieved December 17, 2020.",
"url": "https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/"
},
{
"source_name": "Microsoft SAML Token Lifetimes",
"description": "Microsoft. (2020, December 14). Configurable token lifetimes in Microsoft Identity Platform. Retrieved December 22, 2020.",
"url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes"
},
{
"source_name": "Microsoft SolarWinds Customer Guidance",
"description": "MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.",
"url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
},
{
"source_name": "Cyberark Golden SAML",
"description": "Reiner, S. (2017, November 21). Golden SAML: Newly Discovered Attack Technique Forges Authentication to Cloud Apps. Retrieved December 17, 2020.",
"url": "https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps"
},
{
"source_name": "Sygnia Golden SAML",
"description": "Sygnia. (2020, December). Detection and Hunting of Golden SAML Attack. Retrieved January 6, 2021.",
"url": "https://www.sygnia.co/golden-saml-advisory"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Blake Strom, Microsoft 365 Defender",
"Oleg Kolesnikov, Securonix",
"Jack Burns, HubSpot"
],
"x_mitre_data_sources": [
"Web Credential: Web Credential Usage",
"Web Credential: Web Credential Creation",
"Logon Session: Logon Session Creation",
"User Account: User Account Authentication",
"Logon Session: Logon Session Metadata",
"Process: Process Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "This technique may be difficult to detect as SAML tokens are signed by a trusted certificate. The forging process may not be detectable since it is likely to happen outside of a defender's visibility, but subsequent usage of the forged token may be seen. Monitor for anomalous logins using SAML tokens created by a compromised or adversary generated token-signing certificate. These logins may occur on any on-premises resources as well as from any cloud environment that trusts the certificate.(Citation: Microsoft SolarWinds Customer Guidance) Search for logins to service providers using SAML SSO which do not have corresponding 4769, 1200, and 1202 events in the Domain.(Citation: Sygnia Golden SAML)\n\nConsider modifying SAML responses to include custom elements for each service provider. Monitor these custom elements in service provider access logs to detect any anomalous requests.(Citation: Sygnia Golden SAML)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Azure AD",
"SaaS",
"Windows",
"Office 365",
"Google Workspace",
"IaaS"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 17:55:56.116000+00:00\", \"old_value\": \"2023-09-19 21:25:46.568000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][5]\": \"Process: Process Creation\"}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"changelog_mitigations": {
"shared": [
"M1015: Active Directory Configuration",
"M1018: User Account Management",
"M1026: Privileged Account Management",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0002: User Account (User Account Authentication)",
"DS0006: Web Credential (Web Credential Creation)",
"DS0006: Web Credential (Web Credential Usage)",
"DS0028: Logon Session (Logon Session Creation)",
"DS0028: Logon Session (Logon Session Metadata)"
],
"new": [
"DS0009: Process (Process Creation)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-10-02 14:54:59.263000+00:00",
"modified": "2024-04-19 04:27:00.005000+00:00",
"name": "Gather Victim Identity Information",
"description": "Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames.(Citation: GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)\n\nGathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "reconnaissance"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1589",
"external_id": "T1589"
},
{
"source_name": "OPM Leak",
"description": "Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020.",
"url": "https://www.opm.gov/cybersecurity/cybersecurity-incidents/"
},
{
"source_name": "Detectify Slack Tokens",
"description": "Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved October 19, 2020.",
"url": "https://labs.detectify.com/2016/04/28/slack-bot-token-leakage-exposing-business-critical-information/"
},
{
"source_name": "GitHub truffleHog",
"description": "Dylan Ayrey. (2016, December 31). truffleHog. Retrieved October 19, 2020.",
"url": "https://github.com/dxa4481/truffleHog"
},
{
"source_name": "GrimBlog UsernameEnum",
"description": "GrimHacker. (2017, July 24). Office365 ActiveSync Username Enumeration. Retrieved December 9, 2021.",
"url": "https://grimhacker.com/2017/07/24/office365-activesync-username-enumeration/"
},
{
"source_name": "Register Uber",
"description": "McCarthy, K. (2015, February 28). FORK ME! Uber hauls GitHub into court to find who hacked database of 50,000 drivers. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2015/02/28/uber_subpoenas_github_for_hacker_details/"
},
{
"source_name": "GitHub Gitrob",
"description": "Michael Henriksen. (2018, June 9). Gitrob: Putting the Open Source in OSINT. Retrieved October 19, 2020.",
"url": "https://github.com/michenriksen/gitrob"
},
{
"source_name": "CNET Leaks",
"description": "Ng, A. (2019, January 17). Massive breach leaks 773 million email addresses, 21 million passwords. Retrieved October 20, 2020.",
"url": "https://www.cnet.com/news/massive-breach-leaks-773-million-emails-21-million-passwords/"
},
{
"source_name": "Obsidian SSPR Abuse 2023",
"description": "Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.",
"url": "https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/"
},
{
"source_name": "Forbes GitHub Creds",
"description": "Sandvik, R. (2014, January 14). Attackers Scrape GitHub For Cloud Service Credentials, Hijack Account To Mine Virtual Currency. Retrieved October 19, 2020.",
"url": "https://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/#242c479d3196"
},
{
"source_name": "Register Deloitte",
"description": "Thomson, I. (2017, September 26). Deloitte is a sitting duck: Key systems with RDP open, VPN and proxy 'login details leaked'. Retrieved October 19, 2020.",
"url": "https://www.theregister.com/2017/09/26/deloitte_leak_github_and_google/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Obsidian Security"
],
"x_mitre_data_sources": [
"Network Traffic: Network Traffic Content"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for suspicious network traffic that could be indicative of probing for user information, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.\n\nMuch of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"PRE"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-19 04:27:00.005000+00:00\", \"old_value\": \"2022-04-21 14:39:39.857000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.\\n\\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames.(Citation: GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)\\n\\nGathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\", \"old_value\": \"Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.\\n\\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)\\n\\nGathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, etc.) as well as sensitive details such as credentials.\\n+Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.\\n \\n-Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.(Citation: GrimBlog UsernameEnum) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)\\n+Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about users could also be enumerated via other active means (i.e. [Active Scanning](https://attack.mitre.org/techniques/T1595)) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system or permitted MFA /methods associated with those usernames.(Citation: GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks)\\n \\n Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][8]\": {\"source_name\": \"Obsidian SSPR Abuse 2023\", \"description\": \"Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.\", \"url\": \"https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/\"}, \"root['x_mitre_contributors'][1]\": \"Obsidian Security\"}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather information about the victim's identi | t | 1 | Adversaries may gather information about the victim's identi |
| > | ty that can be used during targeting. Information about iden | > | ty that can be used during targeting. Information about iden | ||
| > | tities may include a variety of details, including personal | > | tities may include a variety of details, including personal | ||
| > | data (ex: employee names, email addresses, etc.) as well as | > | data (ex: employee names, email addresses, security question | ||
| > | sensitive details such as credentials. Adversaries may gath | > | responses, etc.) as well as sensitive details such as crede | ||
| > | er this information in various ways, such as direct elicitat | > | ntials or multi-factor authentication (MFA) configurations. | ||
| > | ion via [Phishing for Information](https://attack.mitre.org/ | > | Adversaries may gather this information in various ways, su | ||
| > | techniques/T1598). Information about users could also be enu | > | ch as direct elicitation via [Phishing for Information](http | ||
| > | merated via other active means (i.e. [Active Scanning](https | > | s://attack.mitre.org/techniques/T1598). Information about us | ||
| > | ://attack.mitre.org/techniques/T1595)) such as probing and a | > | ers could also be enumerated via other active means (i.e. [A | ||
| > | nalyzing responses from authentication services that may rev | > | ctive Scanning](https://attack.mitre.org/techniques/T1595)) | ||
| > | eal valid usernames in a system.(Citation: GrimBlog Username | > | such as probing and analyzing responses from authentication | ||
| > | Enum) Information about victims may also be exposed to adver | > | services that may reveal valid usernames in a system or perm | ||
| > | saries via online or other accessible data sets (ex: [Social | > | itted MFA /methods associated with those usernames.(Citation | ||
| > | Media](https://attack.mitre.org/techniques/T1593/001) or [S | > | : GrimBlog UsernameEnum)(Citation: Obsidian SSPR Abuse 2023) | ||
| > | earch Victim-Owned Websites](https://attack.mitre.org/techni | > | Information about victims may also be exposed to adversarie | ||
| > | ques/T1594)).(Citation: OPM Leak)(Citation: Register Deloitt | > | s via online or other accessible data sets (ex: [Social Medi | ||
| > | e)(Citation: Register Uber)(Citation: Detectify Slack Tokens | > | a](https://attack.mitre.org/techniques/T1593/001) or [Search | ||
| > | )(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog | > | Victim-Owned Websites](https://attack.mitre.org/techniques/ | ||
| > | )(Citation: GitHub Gitrob)(Citation: CNET Leaks) Gathering | > | T1594)).(Citation: OPM Leak)(Citation: Register Deloitte)(Ci | ||
| > | this information may reveal opportunities for other forms of | > | tation: Register Uber)(Citation: Detectify Slack Tokens)(Cit | ||
| > | reconnaissance (ex: [Search Open Websites/Domains](https:// | > | ation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Cit | ||
| > | attack.mitre.org/techniques/T1593) or [Phishing for Informat | > | ation: GitHub Gitrob)(Citation: CNET Leaks) Gathering this | ||
| > | ion](https://attack.mitre.org/techniques/T1598)), establishi | > | information may reveal opportunities for other forms of reco | ||
| > | ng operational resources (ex: [Compromise Accounts](https:// | > | nnaissance (ex: [Search Open Websites/Domains](https://attac | ||
| > | attack.mitre.org/techniques/T1586)), and/or initial access ( | > | k.mitre.org/techniques/T1593) or [Phishing for Information]( | ||
| > | ex: [Phishing](https://attack.mitre.org/techniques/T1566) or | > | https://attack.mitre.org/techniques/T1598)), establishing op | ||
| > | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | > | erational resources (ex: [Compromise Accounts](https://attac | ||
| > | ). | > | k.mitre.org/techniques/T1586)), and/or initial access (ex: [ | ||
| > | Phishing](https://attack.mitre.org/techniques/T1566) or [Val | ||||
| > | id Accounts](https://attack.mitre.org/techniques/T1078)). |
apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\n\nSimilarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden.(Citation: PowerShell About 2019)\n\nIn addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding explorer.exe process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1564/003",
"external_id": "T1564.003"
},
{
"source_name": "Hidden VNC",
"description": "Hutchins, Marcus. (2015, September 13). Hidden VNC for Beginners. Retrieved November 28, 2023.",
"url": "https://www.malwaretech.com/2015/09/hidden-vnc-for-beginners.html"
},
{
"source_name": "Anatomy of an hVNC Attack",
"description": "Keshet, Lior. Kessem, Limor. (2017, January 25). Anatomy of an hVNC Attack. Retrieved November 28, 2023.",
"url": "https://securityintelligence.com/anatomy-of-an-hvnc-attack/"
},
{
"source_name": "Antiquated Mac Malware",
"description": "Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.",
"url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
},
{
"source_name": "PowerShell About 2019",
"description": "Wheeler, S. et al.. (2019, May 1). About PowerShell.exe. Retrieved October 11, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/Microsoft.PowerShell.Core/About/about_PowerShell_exe?view=powershell-5.1"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Travis Smith, Tripwire",
"Mark Tsipershtein"
],
"x_mitre_data_sources": [
"File: File Modification",
"Command: Command Execution",
"Process: Process Creation",
"Script: Script Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor processes and command-line arguments for actions indicative of hidden windows. In Windows, enable and configure event logging and PowerShell logging to check for the hidden window style. In MacOS, plist files are ASCII text files with a specific format, so they're relatively easy to parse. File monitoring can check for the apple.awt.UIElement or any other suspicious plist tag in plist files and flag them.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Windows",
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"dictionary_item_removed\": {\"root['x_mitre_permissions_required']\": [\"User\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-13 14:28:20.651000+00:00\", \"old_value\": \"2022-03-15 21:09:43.489000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. \\n\\nAdversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)\\n\\nOn macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\\n\\nSimilarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden.(Citation: PowerShell About 2019)\\n\\nIn addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding explorer.exe process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows.\", \"old_value\": \"Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. \\n\\nOn Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)\\n\\nSimilarly, on macOS the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\\n\\nAdversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)\", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,9 @@\\n Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. \\n \\n-On Windows, there are a variety of features in scripting languages in Windows, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden. (Citation: PowerShell About 2019)\\n+Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)\\n \\n-Similarly, on macOS the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\\n+On macOS, the configurations for how applications run are listed in property list (plist) files. One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock. A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.\\n \\n-Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.(Citation: Antiquated Mac Malware)\\n+Similarly, on Windows there are a variety of features in scripting languages, such as [PowerShell](https://attack.mitre.org/techniques/T1059/001), Jscript, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005) to make windows hidden. One example of this is powershell.exe -WindowStyle Hidden.(Citation: PowerShell About 2019)\\n+\\n+In addition, Windows supports the `CreateDesktop()` API that can create a hidden desktop window with its own corresponding explorer.exe process.(Citation: Hidden VNC)(Citation: Anatomy of an hVNC Attack) All applications running on the hidden desktop window, such as a hidden VNC (hVNC) session,(Citation: Hidden VNC) will be invisible to other desktops windows.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Hidden VNC\", \"description\": \"Hutchins, Marcus. (2015, September 13). Hidden VNC for Beginners. Retrieved November 28, 2023.\", \"url\": \"https://www.malwaretech.com/2015/09/hidden-vnc-for-beginners.html\"}, \"root['external_references'][2]\": {\"source_name\": \"Anatomy of an hVNC Attack\", \"description\": \"Keshet, Lior. Kessem, Limor. (2017, January 25). Anatomy of an hVNC Attack. Retrieved November 28, 2023.\", \"url\": \"https://securityintelligence.com/anatomy-of-an-hvnc-attack/\"}, \"root['x_mitre_contributors'][1]\": \"Mark Tsipershtein\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use hidden windows to conceal malicious acti | t | 1 | Adversaries may use hidden windows to conceal malicious acti |
| > | vity from the plain sight of users. In some cases, windows t | > | vity from the plain sight of users. In some cases, windows t | ||
| > | hat would typically be displayed when an application carries | > | hat would typically be displayed when an application carries | ||
| > | out an operation can be hidden. This may be utilized by sys | > | out an operation can be hidden. This may be utilized by sys | ||
| > | tem administrators to avoid disrupting user work environment | > | tem administrators to avoid disrupting user work environment | ||
| > | s when carrying out administrative tasks. On Windows, ther | > | s when carrying out administrative tasks. Adversaries may | ||
| > | e are a variety of features in scripting languages in Window | > | abuse these functionalities to hide otherwise visible window | ||
| > | s, such as [PowerShell](https://attack.mitre.org/techniques/ | > | s from users so as not to alert the user to adversary activi | ||
| > | T1059/001), Jscript, and [Visual Basic](https://attack.mitre | > | ty on the system.(Citation: Antiquated Mac Malware) On macO | ||
| > | .org/techniques/T1059/005) to make windows hidden. One examp | > | S, the configurations for how applications run are listed in | ||
| > | le of this is <code>powershell.exe -WindowStyle Hidden</code | > | property list (plist) files. One of the tags in these files | ||
| > | >. (Citation: PowerShell About 2019) Similarly, on macOS th | > | can be <code>apple.awt.UIElement</code>, which allows for J | ||
| > | e configurations for how applications run are listed in prop | > | ava applications to prevent the application's icon from appe | ||
| > | erty list (plist) files. One of the tags in these files can | > | aring in the Dock. A common use for this is when application | ||
| > | be <code>apple.awt.UIElement</code>, which allows for Java a | > | s run in the system tray, but don't also want to show up in | ||
| > | pplications to prevent the application's icon from appearing | > | the Dock. Similarly, on Windows there are a variety of feat | ||
| > | in the Dock. A common use for this is when applications run | > | ures in scripting languages, such as [PowerShell](https://at | ||
| > | in the system tray, but don't also want to show up in the D | > | tack.mitre.org/techniques/T1059/001), Jscript, and [Visual B | ||
| > | ock. Adversaries may abuse these functionalities to hide ot | > | asic](https://attack.mitre.org/techniques/T1059/005) to make | ||
| > | herwise visible windows from users so as not to alert the us | > | windows hidden. One example of this is <code>powershell.exe | ||
| > | er to adversary activity on the system.(Citation: Antiquated | > | -WindowStyle Hidden</code>.(Citation: PowerShell About 2019 | ||
| > | Mac Malware) | > | ) In addition, Windows supports the `CreateDesktop()` API t | ||
| > | hat can create a hidden desktop window with its own correspo | ||||
| > | nding <code>explorer.exe</code> process.(Citation: Hidden VN | ||||
| > | C)(Citation: Anatomy of an hVNC Attack) All applications ru | ||||
| > | nning on the hidden desktop window, such as a hidden VNC (hV | ||||
| > | NC) session,(Citation: Hidden VNC) will be invisible to othe | ||||
| > | r desktops windows. |
ZwSetEaFile and ZwQueryEaFile Windows API functions as well as binaries used to interact with EA, (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) and consider regularly scanning for the presence of modified information. (Citation: SpectorOps Host-Based Jul 2017)\n\nThere are many ways to create and interact with ADSs using Windows utilities. Monitor for operations (execution, copies, etc.) with file names that contain colons. This syntax (ex: file.ext:ads[.ext]) is commonly associated with ADSs. (Citation: Microsoft ADS Mar 2014) (Citation: Oddvar Moe ADS1 Jan 2018) (Citation: Oddvar Moe ADS2 Apr 2018) For a more exhaustive list of utilities that can be used to execute and create ADSs, see https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f.\n\nThe Streams tool of Sysinternals can be used to uncover files with ADSs. The dir /r command can also be used to display ADSs. (Citation: Symantec ADS May 2009) Many PowerShell commands (such as Get-Item, Set-Item, Remove-Item, and Get-ChildItem) can also accept a -stream parameter to interact with ADSs. (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_system_requirements": [
"NTFS partitioned hard drive"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-14 21:56:34.831000+00:00\", \"old_value\": \"2020-03-29 22:46:56.308000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][2]\": \"Process: Process Creation\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (OS API Execution)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Metadata)",
"DS0022: File (File Modification)"
],
"new": [
"DS0009: Process (Process Creation)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-13 18:11:08.357000+00:00",
"modified": "2024-04-18 22:54:54.668000+00:00",
"name": "DLL Search Order Hijacking",
"description": "Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.\n\nThere are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)\n\nPhantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.\n\nAdversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)\n\nIf a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1574/001",
"external_id": "T1574.001"
},
{
"source_name": "Adversaries Hijack DLLs",
"description": "CrowdStrike, Falcon OverWatch Team. (2022, December 30). Retrieved October 19, 2023.",
"url": "https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/"
},
{
"source_name": "FireEye Hijacking July 2010",
"description": "Harbour, N. (2010, July 15). Malware Persistence without the Windows Registry. Retrieved November 17, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html"
},
{
"source_name": "FireEye fxsst June 2011",
"description": "Harbour, N. (2011, June 3). What the fxsst?. Retrieved November 17, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html"
},
{
"source_name": "Microsoft Security Advisory 2269637",
"description": "Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020.",
"url": "https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637"
},
{
"source_name": "Microsoft Dynamic-Link Library Redirection",
"description": "Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020.",
"url": "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft Dynamic Link Library Search Order",
"description": "Microsoft. (2018, May 31). Dynamic-Link Library Search Order. Retrieved November 30, 2014.",
"url": "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN"
},
{
"source_name": "Microsoft Manifests",
"description": "Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.",
"url": "https://msdn.microsoft.com/en-US/library/aa375365"
},
{
"source_name": "FireEye DLL Search Order Hijacking",
"description": "Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html"
},
{
"source_name": "OWASP Binary Planting",
"description": "OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.",
"url": "https://www.owasp.org/index.php/Binary_planting"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Travis Smith, Tripwire",
"Stefan Kanthak",
"Marina Liang",
"Will Alexander",
"Ami Holeston"
],
"x_mitre_data_sources": [
"File: File Modification",
"Module: Module Load",
"File: File Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of `.manifest` and `.local` redirection files that do not correlate with software updates are suspicious.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-18 22:54:54.668000+00:00\", \"old_value\": \"2023-03-30 21:01:51.098000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.\\n\\nThere are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)\\n\\nPhantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.\\n\\nAdversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)\\n\\nIf a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.\", \"old_value\": \"Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.\\n\\nThere are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)\\n\\nAdversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)\\n\\nIf a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.\", \"diff\": \"--- \\n+++ \\n@@ -2,6 +2,8 @@\\n \\n There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)\\n \\n+Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.\\n+\\n Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)\\n \\n If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Adversaries Hijack DLLs\", \"description\": \"CrowdStrike, Falcon OverWatch Team. (2022, December 30). Retrieved October 19, 2023.\", \"url\": \"https://www.crowdstrike.com/blog/4-ways-adversaries-hijack-dlls/\"}, \"root['x_mitre_contributors'][2]\": \"Marina Liang\", \"root['x_mitre_contributors'][3]\": \"Will Alexander\", \"root['x_mitre_contributors'][4]\": \"Ami Holeston\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may execute their own malicious payloads by hija | t | 1 | Adversaries may execute their own malicious payloads by hija |
| > | cking the search order used to load DLLs. Windows systems us | > | cking the search order used to load DLLs. Windows systems us | ||
| > | e a common method to look for required DLLs to load into a p | > | e a common method to look for required DLLs to load into a p | ||
| > | rogram. (Citation: Microsoft Dynamic Link Library Search Ord | > | rogram. (Citation: Microsoft Dynamic Link Library Search Ord | ||
| > | er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa | > | er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa | ||
| > | ds may be for the purpose of establishing persistence as wel | > | ds may be for the purpose of establishing persistence as wel | ||
| > | l as elevating privileges and/or evading restrictions on fil | > | l as elevating privileges and/or evading restrictions on fil | ||
| > | e execution. There are many ways an adversary can hijack DL | > | e execution. There are many ways an adversary can hijack DL | ||
| > | L loads. Adversaries may plant trojan dynamic-link library f | > | L loads. Adversaries may plant trojan dynamic-link library f | ||
| > | iles (DLLs) in a directory that will be searched before the | > | iles (DLLs) in a directory that will be searched before the | ||
| > | location of a legitimate library that will be requested by a | > | location of a legitimate library that will be requested by a | ||
| > | program, causing Windows to load their malicious library wh | > | program, causing Windows to load their malicious library wh | ||
| > | en it is called for by the victim program. Adversaries may a | > | en it is called for by the victim program. Adversaries may a | ||
| > | lso perform DLL preloading, also called binary planting atta | > | lso perform DLL preloading, also called binary planting atta | ||
| > | cks, (Citation: OWASP Binary Planting) by placing a maliciou | > | cks, (Citation: OWASP Binary Planting) by placing a maliciou | ||
| > | s DLL with the same name as an ambiguously specified DLL in | > | s DLL with the same name as an ambiguously specified DLL in | ||
| > | a location that Windows searches before the legitimate DLL. | > | a location that Windows searches before the legitimate DLL. | ||
| > | Often this location is the current working directory of the | > | Often this location is the current working directory of the | ||
| > | program.(Citation: FireEye fxsst June 2011) Remote DLL prelo | > | program.(Citation: FireEye fxsst June 2011) Remote DLL prelo | ||
| > | ading attacks occur when a program sets its current director | > | ading attacks occur when a program sets its current director | ||
| > | y to a remote location such as a Web share before loading a | > | y to a remote location such as a Web share before loading a | ||
| > | DLL. (Citation: Microsoft Security Advisory 2269637) Advers | > | DLL. (Citation: Microsoft Security Advisory 2269637) Phanto | ||
| > | aries may also directly modify the search order via DLL redi | > | m DLL hijacking is a specific type of DLL search order hijac | ||
| > | rection, which after being enabled (in the Registry and crea | > | king where adversaries target references to non-existent DLL | ||
| > | tion of a redirection file) may cause a program to load a di | > | files.(Citation: Adversaries Hijack DLLs) They may be able | ||
| > | fferent DLL.(Citation: Microsoft Dynamic-Link Library Redire | > | to load their own malicious DLL by planting it with the corr | ||
| > | ction)(Citation: Microsoft Manifests)(Citation: FireEye DLL | > | ect name in the location of the missing module. Adversaries | ||
| > | Search Order Hijacking) If a search order-vulnerable progra | > | may also directly modify the search order via DLL redirecti | ||
| > | m is configured to run at a higher privilege level, then the | > | on, which after being enabled (in the Registry and creation | ||
| > | adversary-controlled DLL that is loaded will also be execut | > | of a redirection file) may cause a program to load a differe | ||
| > | ed at the higher level. In this case, the technique could be | > | nt DLL.(Citation: Microsoft Dynamic-Link Library Redirection | ||
| > | used for privilege escalation from user to administrator or | > | )(Citation: Microsoft Manifests)(Citation: FireEye DLL Searc | ||
| > | SYSTEM or from administrator to SYSTEM, depending on the pr | > | h Order Hijacking) If a search order-vulnerable program is | ||
| > | ogram. Programs that fall victim to path hijacking may appea | > | configured to run at a higher privilege level, then the adve | ||
| > | r to behave normally because malicious DLLs may be configure | > | rsary-controlled DLL that is loaded will also be executed at | ||
| > | d to also load the legitimate DLLs they were meant to replac | > | the higher level. In this case, the technique could be used | ||
| > | e. | > | for privilege escalation from user to administrator or SYST | ||
| > | EM or from administrator to SYSTEM, depending on the program | ||||
| > | . Programs that fall victim to path hijacking may appear to | ||||
| > | behave normally because malicious DLLs may be configured to | ||||
| > | also load the legitimate DLLs they were meant to replace. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may disable or modify system firewalls in order | t | 1 | Adversaries may disable or modify system firewalls in order |
| > | to bypass controls limiting network usage. Changes could be | > | to bypass controls limiting network usage. Changes could be | ||
| > | disabling the entire mechanism as well as adding, deleting, | > | disabling the entire mechanism as well as adding, deleting, | ||
| > | or modifying particular rules. This can be done numerous way | > | or modifying particular rules. This can be done numerous way | ||
| > | s depending on the operating system, including via command-l | > | s depending on the operating system, including via command-l | ||
| > | ine, editing Windows Registry keys, and Windows Control Pane | > | ine, editing Windows Registry keys, and Windows Control Pane | ||
| > | l. Modifying or disabling a system firewall may enable adve | > | l. Modifying or disabling a system firewall may enable adve | ||
| > | rsary C2 communications, lateral movement, and/or data exfil | > | rsary C2 communications, lateral movement, and/or data exfil | ||
| > | tration that would otherwise not be allowed. For example, ad | > | tration that would otherwise not be allowed. For example, ad | ||
| > | versaries may add a new firewall rule for a well-known proto | > | versaries may add a new firewall rule for a well-known proto | ||
| > | col (such as RDP) using a non-traditional and potentially le | > | col (such as RDP) using a non-traditional and potentially le | ||
| > | ss securitized port (i.e. [Non-Standard Port](https://attack | > | ss securitized port (i.e. [Non-Standard Port](https://attack | ||
| > | .mitre.org/techniques/T1571)).(Citation: change_rdp_port_con | > | .mitre.org/techniques/T1571)).(Citation: change_rdp_port_con | ||
| > | ti) | > | ti) Adversaries may also modify host networking settings th | ||
| > | at indirectly manipulate system firewalls, such as interface | ||||
| > | bandwidth or network connection request thresholds.(Citatio | ||||
| > | n: Huntress BlackCat) Settings related to enabling abuse of | ||||
| > | various [Remote Services](https://attack.mitre.org/technique | ||||
| > | s/T1021) may also indirectly modify firewall rules. |
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\EventLog\\Security to hide their malicious actions in a new or different .evtx log file. This action does not require a system reboot and takes effect immediately.(Citation: disable_win_evt_logging) \n\nETW interruption can be achieved multiple ways, however most directly by defining conditions using the [PowerShell](https://attack.mitre.org/techniques/T1059/001) Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.\n\nIn the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.\n\nIn Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors (Citation: LemonDuck).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562/006",
"external_id": "T1562.006"
},
{
"source_name": "disable_win_evt_logging",
"description": "Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.",
"url": "https://ptylu.github.io/content/report/report.html?report=25"
},
{
"source_name": "LemonDuck",
"description": "Manoj Ahuje. (2022, April 21). LemonDuck Targets Docker for Cryptomining Operations. Retrieved June 30, 2022.",
"url": "https://www.crowdstrike.com/blog/lemonduck-botnet-targets-docker-for-cryptomining-operations/"
},
{
"source_name": "Microsoft Lamin Sept 2017",
"description": "Microsoft. (2009, May 17). Backdoor:Win32/Lamin.A. Retrieved September 6, 2018.",
"url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A"
},
{
"source_name": "Microsoft About Event Tracing 2018",
"description": "Microsoft. (2018, May 30). About Event Tracing. Retrieved June 7, 2019.",
"url": "https://docs.microsoft.com/en-us/windows/desktop/etw/consuming-events"
},
{
"source_name": "Medium Event Tracing Tampering 2018",
"description": "Palantir. (2018, December 24). Tampering with Windows Event Tracing: Background, Offense, and Defense. Retrieved June 7, 2019.",
"url": "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Rob Smith",
"Lucas Heiligenstein"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Sensor Health: Host Status",
"Windows Registry: Windows Registry Key Modification",
"Process: Process Creation"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Host intrusion prevention systems"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Detect lack of reported activity from a host sensor. Different methods of blocking may cause different disruptions in reporting. Systems may suddenly stop reporting all data or only certain kinds of data.\n\nDepending on the types of host information collected, an analyst may be able to detect the event that triggered a process to stop or connection to be blocked. For example, Sysmon will log when its configuration state has changed (Event ID 16) and Windows Management Instrumentation (WMI) may be used to subscribe ETW providers that log any provider removal from a specific trace session. (Citation: Medium Event Tracing Tampering 2018) To detect changes in ETW you can also monitor the registry key which contains configurations for all ETW event providers: HKLM\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\AUTOLOGGER_NAME\\{PROVIDER_GUID}",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-14 21:50:32.531000+00:00\", \"old_value\": \"2023-09-18 22:23:55.329000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][3]\": \"Process: Process Creation\"}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0013: Sensor Health (Host Status)",
"DS0017: Command (Command Execution)",
"DS0024: Windows Registry (Windows Registry Key Modification)"
],
"new": [
"DS0009: Process (Process Creation)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-31 12:32:08.228000+00:00",
"modified": "2024-02-14 20:07:44.756000+00:00",
"name": "Clear Command History",
"description": "In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.\n\nOn Linux and macOS, these command histories can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions.\n\nAdversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history. \n\nAdversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to clear command history data (clear logging and/or clear history).(Citation: US-CERT-TA18-106A)\n\nOn Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module. The built-in history only tracks the commands used in the current session. This command history is not available to other sessions and is deleted when the session ends.\n\nThe PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt by default). This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.(Citation: Microsoft PowerShell Command History)\n\nAdversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session. This, however, will not delete/flush the ConsoleHost_history.txt file. Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.(Citation: Sophos PowerShell command audit)(Citation: Sophos PowerShell Command History Forensics)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/003",
"external_id": "T1070.003"
},
{
"source_name": "Sophos PowerShell command audit",
"description": "jak. (2020, June 27). Live Discover - PowerShell command audit. Retrieved August 21, 2020.",
"url": "https://community.sophos.com/products/intercept/early-access-program/f/live-discover-response-queries/121529/live-discover---powershell-command-audit"
},
{
"source_name": "Microsoft PowerShell Command History",
"description": "Microsoft. (2020, May 13). About History. Retrieved September 4, 2020.",
"url": "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_history?view=powershell-7"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Sophos PowerShell Command History Forensics",
"description": "Vikas, S. (2020, August 26). PowerShell Command History Forensics. Retrieved September 4, 2020.",
"url": "https://community.sophos.com/products/malware/b/blog/posts/powershell-command-history-forensics"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Vikas Singh, Sophos",
"Emile Kenning, Sophos",
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Process: Process Creation",
"File: File Deletion",
"File: File Modification",
"Command: Command Execution",
"User Account: User Account Authentication"
],
"x_mitre_defense_bypassed": [
"Host forensic analysis",
"Log analysis"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "User authentication, especially via remote terminal services like SSH, without new entries in that user's ~/.bash_history is suspicious. Additionally, the removal/clearing of the ~/.bash_history file can be an indicator of suspicious activity.\n\nMonitor for suspicious modifications or deletion of ConsoleHost_history.txt and use of the Clear-History command.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-14 20:07:44.756000+00:00\", \"old_value\": \"2023-04-07 17:20:44.770000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][0]\": \"Process: Process Creation\"}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"changelog_mitigations": {
"shared": [
"M1022: Restrict File and Directory Permissions",
"M1029: Remote Data Storage",
"M1039: Environment Variable Permissions"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0002: User Account (User Account Authentication)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Deletion)",
"DS0022: File (File Modification)"
],
"new": [
"DS0009: Process (Process Creation)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-01-28 17:05:14.707000+00:00",
"modified": "2024-04-16 12:40:58.536000+00:00",
"name": "Clear Windows Event Logs",
"description": "Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.\n\n\nWith administrator privileges, the event logs can be cleared with the following utility commands:\n\n* wevtutil cl system\n* wevtutil cl application\n* wevtutil cl security\n\nThese logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)\n\nAdversaries may also attempt to clear logs by directly deleting the stored log files within `C:\\Windows\\System32\\winevt\\logs\\`.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1070/001",
"external_id": "T1070.001"
},
{
"source_name": "disable_win_evt_logging",
"description": "Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.",
"url": "https://ptylu.github.io/content/report/report.html?report=25"
},
{
"source_name": "Microsoft Clear-EventLog",
"description": "Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.",
"url": "https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog"
},
{
"source_name": "Microsoft EventLog.Clear",
"description": "Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.",
"url": "https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx"
},
{
"source_name": "Microsoft wevtutil Oct 2017",
"description": "Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.",
"url": "https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Lucas Heiligenstein"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"File: File Deletion",
"Process: OS API Execution",
"Process: Process Creation"
],
"x_mitre_defense_bypassed": [
"Anti Virus",
"Host Intrusion Prevention Systems",
"Log Analysis"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Deleting Windows event logs (via native binaries (Citation: Microsoft wevtutil Oct 2017), API functions (Citation: Microsoft EventLog.Clear), or [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation: Microsoft Clear-EventLog)) may also generate an alterable event (Event ID 1102: \"The audit log was cleared\").",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"dictionary_item_removed\": {\"root['x_mitre_system_requirements']\": [\"Clearing the Windows event logs requires Administrator permissions\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:40:58.536000+00:00\", \"old_value\": \"2023-08-11 21:43:04.568000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.\\n\\n\\nWith administrator privileges, the event logs can be cleared with the following utility commands:\\n\\n* wevtutil cl system\\n* wevtutil cl application\\n* wevtutil cl security\\n\\nThese logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)\\n\\nAdversaries may also attempt to clear logs by directly deleting the stored log files within `C:\\\\Windows\\\\System32\\\\winevt\\\\logs\\\\`.\", \"old_value\": \"Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.\\n\\nThe event logs can be cleared with the following utility commands:\\n\\n* wevtutil cl system\\n* wevtutil cl application\\n* wevtutil cl security\\n\\nThese logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)\", \"diff\": \"--- \\n+++ \\n@@ -1,9 +1,12 @@\\n Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.\\n \\n-The event logs can be cleared with the following utility commands:\\n+\\n+With administrator privileges, the event logs can be cleared with the following utility commands:\\n \\n * wevtutil cl system\\n * wevtutil cl application\\n * wevtutil cl security\\n \\n-These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)\\n+These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)\\n+\\n+Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\\\\Windows\\\\System32\\\\winevt\\\\logs\\\\`.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may clear Windows Event Logs to hide the activit | t | 1 | Adversaries may clear Windows Event Logs to hide the activit |
| > | y of an intrusion. Windows Event Logs are a record of a comp | > | y of an intrusion. Windows Event Logs are a record of a comp | ||
| > | uter's alerts and notifications. There are three system-defi | > | uter's alerts and notifications. There are three system-defi | ||
| > | ned sources of events: System, Application, and Security, wi | > | ned sources of events: System, Application, and Security, wi | ||
| > | th five event types: Error, Warning, Information, Success Au | > | th five event types: Error, Warning, Information, Success Au | ||
| > | dit, and Failure Audit. The event logs can be cleared with | > | dit, and Failure Audit. With administrator privileges, the | ||
| > | the following utility commands: * <code>wevtutil cl system< | > | event logs can be cleared with the following utility comman | ||
| > | /code> * <code>wevtutil cl application</code> * <code>wevtut | > | ds: * <code>wevtutil cl system</code> * <code>wevtutil cl a | ||
| > | il cl security</code> These logs may also be cleared throug | > | pplication</code> * <code>wevtutil cl security</code> These | ||
| > | h other mechanisms, such as the event viewer GUI or [PowerSh | > | logs may also be cleared through other mechanisms, such as | ||
| > | ell](https://attack.mitre.org/techniques/T1059/001). For exa | > | the event viewer GUI or [PowerShell](https://attack.mitre.or | ||
| > | mple, adversaries may use the PowerShell command <code>Remov | > | g/techniques/T1059/001). For example, adversaries may use th | ||
| > | e-EventLog -LogName Security</code> to delete the Security E | > | e PowerShell command <code>Remove-EventLog -LogName Security | ||
| > | ventLog and after reboot, disable future logging. Note: even | > | </code> to delete the Security EventLog and after reboot, di | ||
| > | ts may still be generated and logged in the .evtx file betwe | > | sable future logging. Note: events may still be generated a | ||
| > | en the time the command is run and the reboot.(Citation: dis | > | nd logged in the .evtx file between the time the command is | ||
| > | able_win_evt_logging) | > | run and the reboot.(Citation: disable_win_evt_logging) Adve | ||
| > | rsaries may also attempt to clear logs by directly deleting | ||||
| > | the stored log files within `C:\\Windows\\System32\\winevt\\logs | ||||
| > | \\`. |
IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)\n\nAdversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)\n\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "command-and-control"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1105",
"external_id": "T1105"
},
{
"source_name": "T1105: Trellix_search-ms",
"description": " Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the \"search-ms\" URI Protocol Handler. Retrieved March 15, 2024.",
"url": "https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/"
},
{
"source_name": "Dropbox Malware Sync",
"description": "David Talbot. (2013, August 21). Dropbox and Similar Services Can Sync Malware. Retrieved May 31, 2023.",
"url": "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/"
},
{
"source_name": "University of Birmingham C2",
"description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.",
"url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
},
{
"source_name": "t1105_lolbas",
"description": "LOLBAS. (n.d.). LOLBAS Mapped to T1105. Retrieved March 11, 2022.",
"url": "https://lolbas-project.github.io/#t1105"
},
{
"source_name": "PTSecurity Cobalt Dec 2016",
"description": "Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.",
"url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"John Page (aka hyp3rlinx), ApparitionSec",
"Mark Wee",
"Shailesh Tiwary (Indian Army)",
"The DFIR Report",
"Alain Homewood",
"Joe Wise",
"Jeremy Hedges",
"Selena Larson, @selenalarson"
],
"x_mitre_data_sources": [
"File: File Creation",
"Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow",
"Command: Command Execution",
"Network Traffic: Network Connection Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for file creation and files transferred into the network. Unusual processes with external network connections creating files on-system may be suspicious. Use of utilities, such as [ftp](https://attack.mitre.org/software/S0095), that does not normally occur may also be suspicious.\n\nAnalyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Specifically, for the finger utility on Windows and Linux systems, monitor command line or terminal execution for the finger command. Monitor network activity for TCP port 79, which is used by the finger utility, and Windows netsh interface portproxy modifications to well-known ports such as 80 and 443. Furthermore, monitor file system for the download/creation and execution of suspicious files, which may indicate adversary-downloaded payloads. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.(Citation: University of Birmingham C2)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 15:08:01.731000+00:00\", \"old_value\": \"2023-10-03 21:27:20.702000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). \\n\\nOn Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)\\n\\nAdversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)\\n\\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)\", \"old_value\": \"Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). \\n\\nOn Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)\\n\\nAdversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts.\\n\\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)\", \"diff\": \"--- \\n+++ \\n@@ -2,6 +2,6 @@\\n \\n On Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)\\n \\n-Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts.\\n+Adversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts. Adversaries have also abused file application features, such as the Windows `search-ms` protocol handler, to deliver malicious files to victims through remote file searches invoked by [User Execution](https://attack.mitre.org/techniques/T1204) (typically after interacting with [Phishing](https://attack.mitre.org/techniques/T1566) lures).(Citation: T1105: Trellix_search-ms)\\n \\n Files can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.4\", \"old_value\": \"2.3\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"T1105: Trellix_search-ms\", \"description\": \" Mathanraj Thangaraju, Sijo Jacob. (2023, July 26). Beyond File Search: A Novel Method for Exploiting the \\\"search-ms\\\" URI Protocol Handler. Retrieved March 15, 2024.\", \"url\": \"https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/\"}, \"root['x_mitre_contributors'][5]\": \"Joe Wise\", \"root['x_mitre_contributors'][6]\": \"Jeremy Hedges\", \"root['x_mitre_contributors'][7]\": \"Selena Larson, @selenalarson\", \"root['x_mitre_platforms'][3]\": \"Network\"}}",
"previous_version": "2.3",
"version_change": "2.3 \u2192 2.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may transfer tools or other files from an extern | t | 1 | Adversaries may transfer tools or other files from an extern |
| > | al system into a compromised environment. Tools or files may | > | al system into a compromised environment. Tools or files may | ||
| > | be copied from an external adversary-controlled system to t | > | be copied from an external adversary-controlled system to t | ||
| > | he victim network through the command and control channel or | > | he victim network through the command and control channel or | ||
| > | through alternate protocols such as [ftp](https://attack.mi | > | through alternate protocols such as [ftp](https://attack.mi | ||
| > | tre.org/software/S0095). Once present, adversaries may also | > | tre.org/software/S0095). Once present, adversaries may also | ||
| > | transfer/spread tools between victim devices within a compro | > | transfer/spread tools between victim devices within a compro | ||
| > | mised environment (i.e. [Lateral Tool Transfer](https://atta | > | mised environment (i.e. [Lateral Tool Transfer](https://atta | ||
| > | ck.mitre.org/techniques/T1570)). On Windows, adversaries m | > | ck.mitre.org/techniques/T1570)). On Windows, adversaries m | ||
| > | ay use various utilities to download tools, such as `copy`, | > | ay use various utilities to download tools, such as `copy`, | ||
| > | `finger`, [certutil](https://attack.mitre.org/software/S0160 | > | `finger`, [certutil](https://attack.mitre.org/software/S0160 | ||
| > | ), and [PowerShell](https://attack.mitre.org/techniques/T105 | > | ), and [PowerShell](https://attack.mitre.org/techniques/T105 | ||
| > | 9/001) commands such as <code>IEX(New-Object Net.WebClient). | > | 9/001) commands such as <code>IEX(New-Object Net.WebClient). | ||
| > | downloadString()</code> and <code>Invoke-WebRequest</code>. | > | downloadString()</code> and <code>Invoke-WebRequest</code>. | ||
| > | On Linux and macOS systems, a variety of utilities also exis | > | On Linux and macOS systems, a variety of utilities also exis | ||
| > | t, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, | > | t, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, | ||
| > | and `wget`.(Citation: t1105_lolbas) Adversaries may also a | > | and `wget`.(Citation: t1105_lolbas) Adversaries may also a | ||
| > | buse installers and package managers, such as `yum` or `wing | > | buse installers and package managers, such as `yum` or `wing | ||
| > | et`, to download tools to victim hosts. Files can also be t | > | et`, to download tools to victim hosts. Adversaries have als | ||
| > | ransferred using various [Web Service](https://attack.mitre. | > | o abused file application features, such as the Windows `sea | ||
| > | org/techniques/T1102)s as well as native or otherwise presen | > | rch-ms` protocol handler, to deliver malicious files to vict | ||
| > | t tools on the victim system.(Citation: PTSecurity Cobalt De | > | ims through remote file searches invoked by [User Execution] | ||
| > | c 2016) In some cases, adversaries may be able to leverage s | > | (https://attack.mitre.org/techniques/T1204) (typically after | ||
| > | ervices that sync between a web-based and an on-premises cli | > | interacting with [Phishing](https://attack.mitre.org/techni | ||
| > | ent, such as Dropbox or OneDrive, to transfer files onto vic | > | ques/T1566) lures).(Citation: T1105: Trellix_search-ms) Fil | ||
| > | tim systems. For example, by compromising a cloud account an | > | es can also be transferred using various [Web Service](https | ||
| > | d logging into the service's web portal, an adversary may be | > | ://attack.mitre.org/techniques/T1102)s as well as native or | ||
| > | able to trigger an automatic syncing process that transfers | > | otherwise present tools on the victim system.(Citation: PTSe | ||
| > | the file onto the victim's machine.(Citation: Dropbox Malwa | > | curity Cobalt Dec 2016) In some cases, adversaries may be ab | ||
| > | re Sync) | > | le to leverage services that sync between a web-based and an | ||
| > | on-premises client, such as Dropbox or OneDrive, to transfe | ||||
| > | r files onto victim systems. For example, by compromising a | ||||
| > | cloud account and logging into the service's web portal, an | ||||
| > | adversary may be able to trigger an automatic syncing proces | ||||
| > | s that transfers the file onto the victim's machine.(Citatio | ||||
| > | n: Dropbox Malware Sync) |
vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\n* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)\n\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\n\nAdversaries may also delete \u201conline\u201d backups that are connected to their network \u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "impact"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1490",
"external_id": "T1490"
},
{
"source_name": "Dark Reading Code Spaces Cyber Attack",
"description": " Brian Prince. (2014, June 20). Code Hosting Service Shuts Down After Cyber Attack. Retrieved March 21, 2023.",
"url": "https://www.darkreading.com/attacks-breaches/code-hosting-service-shuts-down-after-cyber-attack"
},
{
"source_name": "FireEye WannaCry 2017",
"description": "Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.",
"url": "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"
},
{
"source_name": "Talos Olympic Destroyer 2018",
"description": "Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.",
"url": "https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
},
{
"source_name": "Diskshadow",
"description": "Microsoft Windows Server. (2023, February 3). Diskshadow. Retrieved November 21, 2023.",
"url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"
},
{
"source_name": "Crytox Ransomware",
"description": "Romain Dumont . (2022, September 21). Technical Analysis of Crytox Ransomware. Retrieved November 22, 2023.",
"url": "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware"
},
{
"source_name": "Rhino Security Labs AWS S3 Ransomware",
"description": "Spencer Gietzen. (n.d.). AWS Simple Storage Service S3 Ransomware Part 2: Prevention and Defense. Retrieved March 21, 2023.",
"url": "https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/"
},
{
"source_name": "ZDNet Ransomware Backups 2020",
"description": "Steve Ranger. (2020, February 27). Ransomware victims thought their backups were safe. They were wrong. Retrieved March 21, 2023.",
"url": "https://www.zdnet.com/article/ransomware-victims-thought-their-backups-were-safe-they-were-wrong/"
},
{
"source_name": "disable_notif_synology_ransom",
"description": "TheDFIRReport. (2022, March 1). Disabling notifications on Synology servers before ransom. Retrieved October 19, 2022.",
"url": "https://twitter.com/TheDFIRReport/status/1498657590259109894"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Yonatan Gotlib, Deep Instinct",
"Austin Clark, @c2defense",
"Pallavi Sivakumaran, WithSecure",
"Joey Lei",
"Harjot Shah Singh"
],
"x_mitre_data_sources": [
"Process: Process Creation",
"Windows Registry: Windows Registry Key Modification",
"Cloud Storage: Cloud Storage Deletion",
"Command: Command Execution",
"Service: Service Metadata",
"Snapshot: Snapshot Deletion",
"File: File Deletion"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit, REAgentC, and diskshadow. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.\n\nMonitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\PreviousVersions\\DisableLocalPage).\n\nFor network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_impact_type": [
"Availability"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux",
"Network",
"IaaS",
"Containers"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-12 02:30:08.379000+00:00\", \"old_value\": \"2023-10-03 17:30:59.482000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.\\n\\nOperating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)\\n\\nA number of native Windows utilities have been used by adversaries to disable or delete system recovery features:\\n\\n* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)\\n\\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n\\nAdversaries may also delete \\u201conline\\u201d backups that are connected to their network \\u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)\", \"old_value\": \"Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.\\n\\nOperating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)\\n\\nA number of native Windows utilities have been used by adversaries to disable or delete system recovery features:\\n\\n* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet\\n* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete\\n* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n\\nOn network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n\\nAdversaries may also delete \\u201conline\\u201d backups that are connected to their network \\u2013 whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware)\", \"diff\": \"--- \\n+++ \\n@@ -9,6 +9,7 @@\\n * wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet\\n * bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no\\n * REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system\\n+* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)\\n \\n On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.\\n \"}, \"root['x_mitre_detection']\": {\"new_value\": \"Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit, REAgentC, and diskshadow. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.\\n\\nMonitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\\\\Software\\\\Policies\\\\Microsoft\\\\PreviousVersions\\\\DisableLocalPage).\\n\\nFor network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession.\", \"old_value\": \"Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit and REAgentC. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.\\n\\nMonitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\\\\Software\\\\Policies\\\\Microsoft\\\\PreviousVersions\\\\DisableLocalPage).\\n\\nFor network infrastructure devices, collect AAA logging to monitor for `erase`, `format`, and `reload` commands being run in succession.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit and REAgentC. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.\\n+Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, bcdedit, REAgentC, and diskshadow. The Windows event logs, ex. Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.\\n \\n Monitor the status of services involved in system recovery. Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\\\\Software\\\\Policies\\\\Microsoft\\\\PreviousVersions\\\\DisableLocalPage).\\n \"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}, \"iterable_item_added\": {\"root['external_references'][4]\": {\"source_name\": \"Diskshadow\", \"description\": \"Microsoft Windows Server. (2023, February 3). Diskshadow. Retrieved November 21, 2023.\", \"url\": \"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow\"}, \"root['external_references'][5]\": {\"source_name\": \"Crytox Ransomware\", \"description\": \"Romain Dumont . (2022, September 21). Technical Analysis of Crytox Ransomware. Retrieved November 22, 2023.\", \"url\": \"https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware\"}, \"root['x_mitre_contributors'][4]\": \"Harjot Shah Singh\"}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may delete or remove built-in data and turn off | t | 1 | Adversaries may delete or remove built-in data and turn off |
| > | services designed to aid in the recovery of a corrupted syst | > | services designed to aid in the recovery of a corrupted syst | ||
| > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | > | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | ||
| > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | > | 18)(Citation: FireEye WannaCry 2017) This may deny access to | ||
| > | available backups and recovery options. Operating systems | > | available backups and recovery options. Operating systems | ||
| > | may contain features that can help fix corrupted systems, su | > | may contain features that can help fix corrupted systems, su | ||
| > | ch as a backup catalog, volume shadow copies, and automatic | > | ch as a backup catalog, volume shadow copies, and automatic | ||
| > | repair features. Adversaries may disable or delete system re | > | repair features. Adversaries may disable or delete system re | ||
| > | covery features to augment the effects of [Data Destruction] | > | covery features to augment the effects of [Data Destruction] | ||
| > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | > | (https://attack.mitre.org/techniques/T1485) and [Data Encryp | ||
| > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | > | ted for Impact](https://attack.mitre.org/techniques/T1486).( | ||
| > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | > | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | ||
| > | nnaCry 2017) Furthermore, adversaries may disable recovery n | > | nnaCry 2017) Furthermore, adversaries may disable recovery n | ||
| > | otifications, then corrupt backups.(Citation: disable_notif_ | > | otifications, then corrupt backups.(Citation: disable_notif_ | ||
| > | synology_ransom) A number of native Windows utilities have | > | synology_ransom) A number of native Windows utilities have | ||
| > | been used by adversaries to disable or delete system recover | > | been used by adversaries to disable or delete system recover | ||
| > | y features: * <code>vssadmin.exe</code> can be used to dele | > | y features: * <code>vssadmin.exe</code> can be used to dele | ||
| > | te all volume shadow copies on a system - <code>vssadmin.exe | > | te all volume shadow copies on a system - <code>vssadmin.exe | ||
| > | delete shadows /all /quiet</code> * [Windows Management Ins | > | delete shadows /all /quiet</code> * [Windows Management Ins | ||
| > | trumentation](https://attack.mitre.org/techniques/T1047) can | > | trumentation](https://attack.mitre.org/techniques/T1047) can | ||
| > | be used to delete volume shadow copies - <code>wmic shadowc | > | be used to delete volume shadow copies - <code>wmic shadowc | ||
| > | opy delete</code> * <code>wbadmin.exe</code> can be used to | > | opy delete</code> * <code>wbadmin.exe</code> can be used to | ||
| > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | > | delete the Windows Backup Catalog - <code>wbadmin.exe delete | ||
| > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | > | catalog -quiet</code> * <code>bcdedit.exe</code> can be use | ||
| > | d to disable automatic Windows recovery features by modifyin | > | d to disable automatic Windows recovery features by modifyin | ||
| > | g boot configuration data - <code>bcdedit.exe /set {default} | > | g boot configuration data - <code>bcdedit.exe /set {default} | ||
| > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | > | bootstatuspolicy ignoreallfailures & bcdedit /set {default} | ||
| > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | > | recoveryenabled no</code> * <code>REAgentC.exe</code> can b | ||
| > | e used to disable Windows Recovery Environment (WinRE) repai | > | e used to disable Windows Recovery Environment (WinRE) repai | ||
| > | r/recovery options of an infected system On network devices | > | r/recovery options of an infected system * <code>diskshadow. | ||
| > | , adversaries may leverage [Disk Wipe](https://attack.mitre. | > | exe</code> can be used to delete all volume shadow copies on | ||
| > | org/techniques/T1561) to delete backup firmware images and r | > | a system - <code>diskshadow delete shadows all</code> (Cita | ||
| > | eformat the file system, then [System Shutdown/Reboot](https | > | tion: Diskshadow) (Citation: Crytox Ransomware) On network | ||
| > | ://attack.mitre.org/techniques/T1529) to reload the device. | > | devices, adversaries may leverage [Disk Wipe](https://attack | ||
| > | Together this activity may leave network devices completely | > | .mitre.org/techniques/T1561) to delete backup firmware image | ||
| > | inoperable and inhibit recovery operations. Adversaries may | > | s and reformat the file system, then [System Shutdown/Reboot | ||
| > | also delete \u201conline\u201d backups that are connected to their ne | > | ](https://attack.mitre.org/techniques/T1529) to reload the d | ||
| > | twork \u2013 whether via network storage media or through folders | > | evice. Together this activity may leave network devices comp | ||
| > | that sync to cloud services.(Citation: ZDNet Ransomware Bac | > | letely inoperable and inhibit recovery operations. Adversar | ||
| > | kups 2020) In cloud environments, adversaries may disable ve | > | ies may also delete \u201conline\u201d backups that are connected to t | ||
| > | rsioning and backup policies and delete snapshots, machine i | > | heir network \u2013 whether via network storage media or through | ||
| > | mages, and prior versions of objects designed to be used in | > | folders that sync to cloud services.(Citation: ZDNet Ransomw | ||
| > | disaster recovery scenarios.(Citation: Dark Reading Code Spa | > | are Backups 2020) In cloud environments, adversaries may dis | ||
| > | ces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ranso | > | able versioning and backup policies and delete snapshots, ma | ||
| > | mware) | > | chine images, and prior versions of objects designed to be u | ||
| > | sed in disaster recovery scenarios.(Citation: Dark Reading C | ||||
| > | ode Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S | ||||
| > | 3 Ransomware) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may mimic common operating system GUI components | t | 1 | Adversaries may mimic common operating system GUI components |
| > | to prompt users for credentials with a seemingly legitimate | > | to prompt users for credentials with a seemingly legitimate | ||
| > | prompt. When programs are executed that need additional pri | > | prompt. When programs are executed that need additional pri | ||
| > | vileges than are present in the current user context, it is | > | vileges than are present in the current user context, it is | ||
| > | common for the operating system to prompt the user for prope | > | common for the operating system to prompt the user for prope | ||
| > | r credentials to authorize the elevated privileges for the t | > | r credentials to authorize the elevated privileges for the t | ||
| > | ask (ex: [Bypass User Account Control](https://attack.mitre. | > | ask (ex: [Bypass User Account Control](https://attack.mitre. | ||
| > | org/techniques/T1548/002)). Adversaries may mimic this func | > | org/techniques/T1548/002)). Adversaries may mimic this func | ||
| > | tionality to prompt users for credentials with a seemingly l | > | tionality to prompt users for credentials with a seemingly l | ||
| > | egitimate prompt for a number of reasons that mimic normal u | > | egitimate prompt for a number of reasons that mimic normal u | ||
| > | sage, such as a fake installer requiring additional access o | > | sage, such as a fake installer requiring additional access o | ||
| > | r a fake malware removal suite.(Citation: OSX Malware Exploi | > | r a fake malware removal suite.(Citation: OSX Malware Exploi | ||
| > | ts MacKeeper) This type of prompt can be used to collect cre | > | ts MacKeeper) This type of prompt can be used to collect cre | ||
| > | dentials via various languages such as [AppleScript](https:/ | > | dentials via various languages such as [AppleScript](https:/ | ||
| > | /attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm | > | /attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm | ||
| > | Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citati | > | Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citati | ||
| > | on: Spoofing credential dialogs) and [PowerShell](https://at | > | on: Spoofing credential dialogs) and [PowerShell](https://at | ||
| > | tack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do | > | tack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do | ||
| > | You Trust Oct 2014)(Citation: Enigma Phishing for Credentia | > | You Trust Oct 2014)(Citation: Enigma Phishing for Credentia | ||
| > | ls Jan 2015)(Citation: Spoofing credential dialogs) On Linux | > | ls Jan 2015)(Citation: Spoofing credential dialogs) On Linux | ||
| > | systems adversaries may launch dialog boxes prompting users | > | systems adversaries may launch dialog boxes prompting users | ||
| > | for credentials from malicious shell scripts or the command | > | for credentials from malicious shell scripts or the command | ||
| > | line (i.e. [Unix Shell](https://attack.mitre.org/techniques | > | line (i.e. [Unix Shell](https://attack.mitre.org/techniques | ||
| > | /T1059/004)).(Citation: Spoofing credential dialogs) | > | /T1059/004)).(Citation: Spoofing credential dialogs) Advers | ||
| > | aries may also mimic common software authentication requests | ||||
| > | , such as those from browsers or email clients. This may als | ||||
| > | o be paired with user activity monitoring (i.e., [Browser In | ||||
| > | formation Discovery](https://attack.mitre.org/techniques/T12 | ||||
| > | 17) and/or [Application Window Discovery](https://attack.mit | ||||
| > | re.org/techniques/T1010)) to spoof prompts when users are na | ||||
| > | turally accessing sensitive sites/data. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use internal spearphishing to gain access to | t | 1 | After they already have access to accounts or systems within |
| > | additional information or exploit other users within the sa | > | the environment, adversaries may use internal spearphishing | ||
| > | me organization after they already have access to accounts o | > | to gain access to additional information or compromise othe | ||
| > | r systems within the environment. Internal spearphishing is | > | r users within the same organization. Internal spearphishing | ||
| > | multi-staged campaign where an email account is owned either | > | is multi-staged campaign where a legitimate account is init | ||
| > | by controlling the user's device with previously installed | > | ially compromised either by controlling the user's device or | ||
| > | malware or by compromising the account credentials of the us | > | by compromising the account credentials of the user. Advers | ||
| > | er. Adversaries attempt to take advantage of a trusted inter | > | aries may then attempt to take advantage of the trusted inte | ||
| > | nal account to increase the likelihood of tricking the targe | > | rnal account to increase the likelihood of tricking more vic | ||
| > | t into falling for the phish attempt.(Citation: Trend Micro | > | tims into falling for phish attempts, often incorporating [I | ||
| > | When Phishing Starts from the Inside 2017) Adversaries may | > | mpersonation](https://attack.mitre.org/techniques/T1656).(Ci | ||
| > | leverage [Spearphishing Attachment](https://attack.mitre.org | > | tation: Trend Micro - Int SP) For example, adversaries may | ||
| > | /techniques/T1566/001) or [Spearphishing Link](https://attac | > | leverage [Spearphishing Attachment](https://attack.mitre.org | ||
| > | k.mitre.org/techniques/T1566/002) as part of internal spearp | > | /techniques/T1566/001) or [Spearphishing Link](https://attac | ||
| > | hishing to deliver a payload or redirect to an external site | > | k.mitre.org/techniques/T1566/002) as part of internal spearp | ||
| > | to capture credentials through [Input Capture](https://atta | > | hishing to deliver a payload or redirect to an external site | ||
| > | ck.mitre.org/techniques/T1056) on sites that mimic email log | > | to capture credentials through [Input Capture](https://atta | ||
| > | in interfaces. There have been notable incidents where inte | > | ck.mitre.org/techniques/T1056) on sites that mimic login int | ||
| > | rnal spearphishing has been used. The Eye Pyramid campaign u | > | erfaces. Adversaries may also leverage internal chat apps, | ||
| > | sed phishing emails with malicious attachments for lateral m | > | such as Microsoft Teams, to spread malicious content or enga | ||
| > | ovement between victims, compromising nearly 18,000 email ac | > | ge users in attempts to capture sensitive information and/or | ||
| > | counts in the process.(Citation: Trend Micro When Phishing S | > | credentials.(Citation: Int SP - chat apps) | ||
| > | tarts from the Inside 2017) The Syrian Electronic Army (SEA) | ||||
| > | compromised email accounts at the Financial Times (FT) to s | ||||
| > | teal additional account credentials. Once FT learned of the | ||||
| > | campaign and began warning employees of the threat, the SEA | ||||
| > | sent phishing emails mimicking the Financial Times IT depart | ||||
| > | ment and were able to compromise even more users.(Citation: | ||||
| > | THE FINANCIAL TIMES LTD 2019.) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to manipulate features of their arti | t | 1 | Adversaries may attempt to manipulate features of their arti |
| > | facts to make them appear legitimate or benign to users and/ | > | facts to make them appear legitimate or benign to users and/ | ||
| > | or security tools. Masquerading occurs when the name or loca | > | or security tools. Masquerading occurs when the name or loca | ||
| > | tion of an object, legitimate or malicious, is manipulated o | > | tion of an object, legitimate or malicious, is manipulated o | ||
| > | r abused for the sake of evading defenses and observation. T | > | r abused for the sake of evading defenses and observation. T | ||
| > | his may include manipulating file metadata, tricking users i | > | his may include manipulating file metadata, tricking users i | ||
| > | nto misidentifying the file type, and giving legitimate task | > | nto misidentifying the file type, and giving legitimate task | ||
| > | or service names. Renaming abusable system utilities to ev | > | or service names. Renaming abusable system utilities to ev | ||
| > | ade security monitoring is also a form of [Masquerading](htt | > | ade security monitoring is also a form of [Masquerading](htt | ||
| > | ps://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Ma | > | ps://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Ma | ||
| > | in Site) Masquerading may also include the use of [Proxy](ht | > | in Site) | ||
| > | tps://attack.mitre.org/techniques/T1090) or VPNs to disguise | ||||
| > | IP addresses, which can allow adversaries to blend in with | ||||
| > | normal network traffic and bypass conditional access policie | ||||
| > | s or anti-abuse protections. |
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Notification Packages) and correlate then investigate the DLL files these files reference. \n\nPassword filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013)\n\nMonitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) \n\nMonitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.\n\nMonitor for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation: Xorrior Authorization Plugins)\n\nConfigure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).\n\nMonitor property changes in Group Policy that manage authentication mechanisms (i.e. [Group Policy Modification](https://attack.mitre.org/techniques/T1484/001)). The Store passwords using reversible encryption configuration should be set to Disabled. Additionally, monitor and/or block suspicious command/script execution of -AllowReversiblePasswordEncryption $true, Set-ADUser and Set-ADAccountControl. Finally, monitor Fine-Grained Password Policies and regularly audit user accounts and group settings.(Citation: dump_pwd_dcsync)\n",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS",
"Network",
"Azure AD",
"Google Workspace",
"IaaS",
"Office 365",
"SaaS"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 21:51:44.851000+00:00\", \"old_value\": \"2023-04-11 03:17:32.211000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.4\", \"old_value\": \"2.3\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][11]\": \"Cloud Service: Cloud Service Modification\"}}",
"previous_version": "2.3",
"version_change": "2.3 \u2192 2.4",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1025: Privileged Process Integrity",
"M1026: Privileged Account Management",
"M1027: Password Policies",
"M1028: Operating System Configuration",
"M1032: Multi-factor Authentication",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0002: User Account (User Account Authentication)",
"DS0002: User Account (User Account Modification)",
"DS0009: Process (OS API Execution)",
"DS0009: Process (Process Access)",
"DS0011: Module (Module Load)",
"DS0015: Application Log (Application Log Content)",
"DS0022: File (File Creation)",
"DS0022: File (File Modification)",
"DS0024: Windows Registry (Windows Registry Key Creation)",
"DS0024: Windows Registry (Windows Registry Key Modification)",
"DS0026: Active Directory (Active Directory Object Modification)",
"DS0028: Logon Session (Logon Session Creation)"
],
"new": [
"DS0025: Cloud Service (Cloud Service Modification)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b4409cd8-0da9-46e1-a401-a241afd4d1cc",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-05-31 19:31:38.431000+00:00",
"modified": "2024-04-16 00:20:21.488000+00:00",
"name": "Multi-Factor Authentication",
"description": "Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.\n\nOnce adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions)\n\nFor example, modifying the Windows hosts file (`C:\\windows\\system32\\drivers\\etc\\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a \"fail open\" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. (Citation: Russians Exploit Default MFA Protocol - CISA March 2022) \n\nDepending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1556/006",
"external_id": "T1556.006"
},
{
"source_name": "Russians Exploit Default MFA Protocol - CISA March 2022",
"description": "Cyber Security Infrastructure Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and \u201cPrintNightmare\u201d Vulnerability. Retrieved May 31, 2022.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-074a"
},
{
"source_name": "Mandiant APT42",
"description": "Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromise. Retrieved September 16, 2022.",
"url": "https://www.mandiant.com/media/17826"
},
{
"source_name": "Azure AD Conditional Access Exclusions",
"description": "Microsoft. (2022, August 26). Use Azure AD access reviews to manage users excluded from Conditional Access policies. Retrieved August 30, 2022.",
"url": "https://docs.microsoft.com/en-us/azure/active-directory/governance/conditional-access-exclusion"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Liran Ravich, CardinalOps",
"Muhammad Moiz Arshad, @5T34L7H"
],
"x_mitre_data_sources": [
"Logon Session: Logon Session Creation",
"Application Log: Application Log Content",
"Active Directory: Active Directory Object Modification",
"User Account: User Account Authentication",
"User Account: User Account Modification"
],
"x_mitre_defense_bypassed": [
"Multi-Factor Authentication"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Azure AD",
"Office 365",
"SaaS",
"IaaS",
"Google Workspace",
"Linux",
"macOS"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 00:20:21.488000+00:00\", \"old_value\": \"2023-10-16 16:47:26.119000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['x_mitre_data_sources'][1]\": \"Application Log: Application Log Content\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1032: Multi-factor Authentication",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0002: User Account (User Account Authentication)",
"DS0002: User Account (User Account Modification)",
"DS0026: Active Directory (Active Directory Object Modification)",
"DS0028: Logon Session (Logon Session Creation)"
],
"new": [
"DS0015: Application Log (Application Log Content)"
],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--954a1639-f2d6-407d-aef3-4917622ca493",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-04-01 02:15:49.754000+00:00",
"modified": "2024-04-19 04:26:29.365000+00:00",
"name": "Multi-Factor Authentication Request Generation",
"description": "Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.\n\nAdversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023)\n\nIn some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to \u201cMFA fatigue.\u201d(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1621",
"external_id": "T1621"
},
{
"source_name": "Russian 2FA Push Annoyance - Cimpanu",
"description": "Catalin Cimpanu. (2021, December 9). Russian hackers bypass 2FA by annoying victims with repeated push notifications. Retrieved March 31, 2022.",
"url": "https://therecord.media/russian-hackers-bypass-2fa-by-annoying-victims-with-repeated-push-notifications/"
},
{
"source_name": "MFA Fatigue Attacks - PortSwigger",
"description": "Jessica Haworth. (2022, February 16). MFA fatigue attacks: Users tricked into allowing device access due to overload of push notifications. Retrieved March 31, 2022.",
"url": "https://portswigger.net/daily-swig/mfa-fatigue-attacks-users-tricked-into-allowing-device-access-due-to-overload-of-push-notifications"
},
{
"source_name": "Suspected Russian Activity Targeting Government and Business Entities Around the Globe",
"description": "Luke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock. (2021, December 6). Suspected Russian Activity Targeting Government and Business Entities Around the Globe. Retrieved April 15, 2022.",
"url": "https://www.mandiant.com/resources/russian-targeting-gov-business"
},
{
"source_name": "Obsidian SSPR Abuse 2023",
"description": "Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.",
"url": "https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Jon Sternstein, Stern Security",
"Pawel Partyka, Microsoft 365 Defender",
"Shanief Webb",
"Obsidian Security"
],
"x_mitre_data_sources": [
"User Account: User Account Authentication",
"Logon Session: Logon Session Metadata",
"Application Log: Application Log Content",
"Logon Session: Logon Session Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor user account logs as well as 2FA/MFA application logs for suspicious events: unusual login attempt source location, mismatch in location of login attempt and smart device receiving 2FA/MFA request prompts, and high volume of repeated login attempts, all of which may indicate user's primary credentials have been compromised minus 2FA/MFA mechanism. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Office 365",
"Linux",
"macOS",
"IaaS",
"SaaS",
"Azure AD",
"Google Workspace"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-19 04:26:29.365000+00:00\", \"old_value\": \"2023-04-04 03:06:34.448000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.\\n\\nAdversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023)\\n\\nIn some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to \\u201cMFA fatigue.\\u201d(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)\", \"old_value\": \"Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.\\n\\nAdversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account.\\n\\nIn some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to \\u201cMFA fatigue.\\u201d(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.\\n \\n-Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account.\\n+Adversaries in possession of credentials to [Valid Accounts](https://attack.mitre.org/techniques/T1078) may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control. To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account. If adversaries lack credentials to victim accounts, they may also abuse automatic push notification generation when this option is configured for self-service password reset (SSPR).(Citation: Obsidian SSPR Abuse 2023)\\n \\n In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to \\u201cMFA fatigue.\\u201d(Citation: Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger)(Citation: Suspected Russian Activity Targeting Government and Business Entities Around the Globe)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][4]\": {\"source_name\": \"Obsidian SSPR Abuse 2023\", \"description\": \"Noah Corradin and Shuyang Wang. (2023, August 1). Behind The Breach: Self-Service Password Reset (SSPR) Abuse in Azure AD. Retrieved March 28, 2024.\", \"url\": \"https://www.obsidiansecurity.com/blog/behind-the-breach-self-service-password-reset-azure-ad/\"}, \"root['x_mitre_contributors'][3]\": \"Obsidian Security\"}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to bypass multi-factor authenticatio | t | 1 | Adversaries may attempt to bypass multi-factor authenticatio |
| > | n (MFA) mechanisms and gain access to accounts by generating | > | n (MFA) mechanisms and gain access to accounts by generating | ||
| > | MFA requests sent to users. Adversaries in possession of c | > | MFA requests sent to users. Adversaries in possession of c | ||
| > | redentials to [Valid Accounts](https://attack.mitre.org/tech | > | redentials to [Valid Accounts](https://attack.mitre.org/tech | ||
| > | niques/T1078) may be unable to complete the login process if | > | niques/T1078) may be unable to complete the login process if | ||
| > | they lack access to the 2FA or MFA mechanisms required as a | > | they lack access to the 2FA or MFA mechanisms required as a | ||
| > | n additional credential and security control. To circumvent | > | n additional credential and security control. To circumvent | ||
| > | this, adversaries may abuse the automatic generation of push | > | this, adversaries may abuse the automatic generation of push | ||
| > | notifications to MFA services such as Duo Push, Microsoft A | > | notifications to MFA services such as Duo Push, Microsoft A | ||
| > | uthenticator, Okta, or similar services to have the user gra | > | uthenticator, Okta, or similar services to have the user gra | ||
| > | nt access to their account. In some cases, adversaries may | > | nt access to their account. If adversaries lack credentials | ||
| > | continuously repeat login attempts in order to bombard users | > | to victim accounts, they may also abuse automatic push notif | ||
| > | with MFA push notifications, SMS messages, and phone calls, | > | ication generation when this option is configured for self-s | ||
| > | potentially resulting in the user finally accepting the aut | > | ervice password reset (SSPR).(Citation: Obsidian SSPR Abuse | ||
| > | hentication request in response to \u201cMFA fatigue.\u201d(Citation: | > | 2023) In some cases, adversaries may continuously repeat lo | ||
| > | Russian 2FA Push Annoyance - Cimpanu)(Citation: MFA Fatigue | > | gin attempts in order to bombard users with MFA push notific | ||
| > | Attacks - PortSwigger)(Citation: Suspected Russian Activity | > | ations, SMS messages, and phone calls, potentially resulting | ||
| > | Targeting Government and Business Entities Around the Globe) | > | in the user finally accepting the authentication request in | ||
| > | response to \u201cMFA fatigue.\u201d(Citation: Russian 2FA Push Annoy | ||||
| > | ance - Cimpanu)(Citation: MFA Fatigue Attacks - PortSwigger) | ||||
| > | (Citation: Suspected Russian Activity Targeting Government a | ||||
| > | nd Business Entities Around the Globe) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may sniff network traffic to capture information | t | 1 | Adversaries may passively sniff network traffic to capture i |
| > | about an environment, including authentication material pas | > | nformation about an environment, including authentication ma | ||
| > | sed over the network. Network sniffing refers to using the n | > | terial passed over the network. Network sniffing refers to u | ||
| > | etwork interface on a system to monitor or capture informati | > | sing the network interface on a system to monitor or capture | ||
| > | on sent over a wired or wireless connection. An adversary ma | > | information sent over a wired or wireless connection. An ad | ||
| > | y place a network interface into promiscuous mode to passive | > | versary may place a network interface into promiscuous mode | ||
| > | ly access data in transit over the network, or use span port | > | to passively access data in transit over the network, or use | ||
| > | s to capture a larger amount of data. Data captured via thi | > | span ports to capture a larger amount of data. Data captur | ||
| > | s technique may include user credentials, especially those s | > | ed via this technique may include user credentials, especial | ||
| > | ent over an insecure, unencrypted protocol. Techniques for n | > | ly those sent over an insecure, unencrypted protocol. Techni | ||
| > | ame service resolution poisoning, such as [LLMNR/NBT-NS Pois | > | ques for name service resolution poisoning, such as [LLMNR/N | ||
| > | oning and SMB Relay](https://attack.mitre.org/techniques/T15 | > | BT-NS Poisoning and SMB Relay](https://attack.mitre.org/tech | ||
| > | 57/001), can also be used to capture credentials to websites | > | niques/T1557/001), can also be used to capture credentials t | ||
| > | , proxies, and internal systems by redirecting traffic to an | > | o websites, proxies, and internal systems by redirecting tra | ||
| > | adversary. Network sniffing may also reveal configuration | > | ffic to an adversary. Network sniffing may reveal configura | ||
| > | details, such as running services, version numbers, and othe | > | tion details, such as running services, version numbers, and | ||
| > | r network characteristics (e.g. IP addresses, hostnames, VLA | > | other network characteristics (e.g. IP addresses, hostnames | ||
| > | N IDs) necessary for subsequent Lateral Movement and/or Defe | > | , VLAN IDs) necessary for subsequent [Lateral Movement](http | ||
| > | nse Evasion activities. In cloud-based environments, advers | > | s://attack.mitre.org/tactics/TA0008) and/or [Defense Evasion | ||
| > | aries may still be able to use traffic mirroring services to | > | ](https://attack.mitre.org/tactics/TA0005) activities. Adver | ||
| > | sniff network traffic from virtual machines. For example, A | > | saries may likely also utilize network sniffing during [Adve | ||
| > | WS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap a | > | rsary-in-the-Middle](https://attack.mitre.org/techniques/T15 | ||
| > | llow users to define specified instances to collect traffic | > | 57) (AiTM) to passively gain additional knowledge about the | ||
| > | from and specified targets to send collected traffic to.(Cit | > | environment. In cloud-based environments, adversaries may s | ||
| > | ation: AWS Traffic Mirroring)(Citation: GCP Packet Mirroring | > | till be able to use traffic mirroring services to sniff netw | ||
| > | )(Citation: Azure Virtual Network TAP) Often, much of this t | > | ork traffic from virtual machines. For example, AWS Traffic | ||
| > | raffic will be in cleartext due to the use of TLS terminatio | > | Mirroring, GCP Packet Mirroring, and Azure vTap allow users | ||
| > | n at the load balancer level to reduce the strain of encrypt | > | to define specified instances to collect traffic from and sp | ||
| > | ing and decrypting traffic.(Citation: Rhino Security Labs AW | > | ecified targets to send collected traffic to.(Citation: AWS | ||
| > | S VPC Traffic Mirroring)(Citation: SpecterOps AWS Traffic Mi | > | Traffic Mirroring)(Citation: GCP Packet Mirroring)(Citation: | ||
| > | rroring) The adversary can then use exfiltration techniques | > | Azure Virtual Network TAP) Often, much of this traffic will | ||
| > | such as Transfer Data to Cloud Account in order to access th | > | be in cleartext due to the use of TLS termination at the lo | ||
| > | e sniffed traffic.(Citation: Rhino Security Labs AWS VPC Tra | > | ad balancer level to reduce the strain of encrypting and dec | ||
| > | ffic Mirroring) On network devices, adversaries may perform | > | rypting traffic.(Citation: Rhino Security Labs AWS VPC Traff | ||
| > | network captures using [Network Device CLI](https://attack. | > | ic Mirroring)(Citation: SpecterOps AWS Traffic Mirroring) Th | ||
| > | mitre.org/techniques/T1059/008) commands such as `monitor ca | > | e adversary can then use exfiltration techniques such as Tra | ||
| > | pture`.(Citation: US-CERT-TA18-106A)(Citation: capture_embed | > | nsfer Data to Cloud Account in order to access the sniffed t | ||
| > | ded_packet_on_software) | > | raffic.(Citation: Rhino Security Labs AWS VPC Traffic Mirror | ||
| > | ing) On network devices, adversaries may perform network ca | ||||
| > | ptures using [Network Device CLI](https://attack.mitre.org/t | ||||
| > | echniques/T1059/008) commands such as `monitor capture`.(Cit | ||||
| > | ation: US-CERT-TA18-106A)(Citation: capture_embedded_packet_ | ||||
| > | on_software) |
/proc//maps , where the /proc//maps , where the | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to dump credentials to obtain accoun | t | 1 | Adversaries may attempt to dump credentials to obtain accoun |
| > | t login and credential material, normally in the form of a h | > | t login and credential material, normally in the form of a h | ||
| > | ash or a clear text password, from the operating system and | > | ash or a clear text password. Credentials can be obtained fr | ||
| > | software. Credentials can then be used to perform [Lateral M | > | om OS caches, memory, or structures.(Citation: Brining MimiK | ||
| > | ovement](https://attack.mitre.org/tactics/TA0008) and access | > | atz to Unix) Credentials can then be used to perform [Latera | ||
| > | restricted information. Several of the tools mentioned in | > | l Movement](https://attack.mitre.org/tactics/TA0008) and acc | ||
| > | associated sub-techniques may be used by both adversaries an | > | ess restricted information. Several of the tools mentioned | ||
| > | d professional security testers. Additional custom tools lik | > | in associated sub-techniques may be used by both adversaries | ||
| > | ely exist as well. | > | and professional security testers. Additional custom tools | ||
| > | likely exist as well. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access cached domain credentials | t | 1 | Adversaries may attempt to access cached domain credentials |
| > | used to allow authentication to occur in the event a domain | > | used to allow authentication to occur in the event a domain | ||
| > | controller is unavailable.(Citation: Microsoft - Cached Cred | > | controller is unavailable.(Citation: Microsoft - Cached Cred | ||
| > | s) On Windows Vista and newer, the hash format is DCC2 (Dom | > | s) On Windows Vista and newer, the hash format is DCC2 (Dom | ||
| > | ain Cached Credentials version 2) hash, also known as MS-Cac | > | ain Cached Credentials version 2) hash, also known as MS-Cac | ||
| > | he v2 hash.(Citation: PassLib mscache) The number of default | > | he v2 hash.(Citation: PassLib mscache) The number of default | ||
| > | cached credentials varies and can be altered per system. Th | > | cached credentials varies and can be altered per system. Th | ||
| > | is hash does not allow pass-the-hash style attacks, and inst | > | is hash does not allow pass-the-hash style attacks, and inst | ||
| > | ead requires [Password Cracking](https://attack.mitre.org/te | > | ead requires [Password Cracking](https://attack.mitre.org/te | ||
| > | chniques/T1110/002) to recover the plaintext password.(Citat | > | chniques/T1110/002) to recover the plaintext password.(Citat | ||
| > | ion: ired mscache) With SYSTEM access, the tools/utilities | > | ion: ired mscache) On Linux systems, Active Directory crede | ||
| > | such as [Mimikatz](https://attack.mitre.org/software/S0002), | > | ntials can be accessed through caches maintained by software | ||
| > | [Reg](https://attack.mitre.org/software/S0075), and secrets | > | like System Security Services Daemon (SSSD) or Quest Authen | ||
| > | dump.py can be used to extract the cached credentials. Note | > | tication Services (formerly VAS). Cached credential hashes a | ||
| > | : Cached credentials for Windows Vista are derived using PBK | > | re typically located at `/var/lib/sss/db/cache.[domain].ldb` | ||
| > | DF2.(Citation: PassLib mscache) | > | for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for | ||
| > | Quest. Adversaries can use utilities, such as `tdbdump`, on | ||||
| > | these database files to dump the cached hashes and use [Pas | ||||
| > | sword Cracking](https://attack.mitre.org/techniques/T1110/00 | ||||
| > | 2) to obtain the plaintext password.(Citation: Brining MimiK | ||||
| > | atz to Unix) With SYSTEM or sudo access, the tools/utiliti | ||||
| > | es such as [Mimikatz](https://attack.mitre.org/software/S000 | ||||
| > | 2), [Reg](https://attack.mitre.org/software/S0075), and secr | ||||
| > | etsdump.py for Windows or Linikatz for Linux can be used to | ||||
| > | extract the cached credentials.(Citation: Brining MimiKatz t | ||||
| > | o Unix) Note: Cached credentials for Windows Vista are deri | ||||
| > | ved using PBKDF2.(Citation: PassLib mscache) |
procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be run using:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\nBuilt-in Windows tools such as `comsvcs.dll` can also be used:\n\n* rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)\n\nSimilar to [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012), the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS)\n\nWindows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\n\nThe following SSPs can be used to access credentials:\n\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1003/001",
"external_id": "T1003.001"
},
{
"source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
"description": "French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.",
"url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
},
{
"source_name": "Deep Instinct LSASS",
"description": "Gilboa, A. (2021, February 16). LSASS Memory Dumps are Stealthier than Ever Before - Part 2. Retrieved December 27, 2023.",
"url": "https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2"
},
{
"source_name": "Graeber 2014",
"description": "Graeber, M. (2014, October). Analysis of Malicious Security Support Provider DLLs. Retrieved March 1, 2017.",
"url": "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html"
},
{
"source_name": "Volexity Exchange Marauder March 2021",
"description": "Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.",
"url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
},
{
"source_name": "Powersploit",
"description": "PowerSploit. (n.d.). Retrieved December 4, 2014.",
"url": "https://github.com/mattifestation/PowerSploit"
},
{
"source_name": "Symantec Attacks Against Government Sector",
"description": "Symantec. (2021, June 10). Attacks Against the Government Sector. Retrieved September 28, 2021.",
"url": "https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf"
},
{
"source_name": "TechNet Blogs Credential Protection",
"description": "Wilson, B. (2016, April 18). The Importance of KB2871997 and KB2928120 for Credential Protection. Retrieved April 11, 2018.",
"url": "https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Edward Millington",
"Ed Williams, Trustwave, SpiderLabs",
"Olaf Hartong, Falcon Force"
],
"x_mitre_data_sources": [
"Process: Process Access",
"Windows Registry: Windows Registry Key Modification",
"Process: Process Creation",
"Process: OS API Execution",
"Logon Session: Logon Session Creation",
"Command: Command Execution",
"File: File Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for unexpected processes interacting with LSASS.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective [Process Injection](https://attack.mitre.org/techniques/T1055) to reduce potential indicators of malicious activity.\n\nOn Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.\n\nMonitor processes and command-line arguments for program execution that may be indicative of credential dumping. Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,(Citation: Powersploit) which may require additional logging features to be configured in the operating system to collect necessary information for analysis.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-12-27 17:57:20.003000+00:00\", \"old_value\": \"2023-07-24 18:52:29.338000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).\\n\\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\\n\\nFor example, on the target host use procdump:\\n\\n* procdump -ma lsass.exe lsass_dump\\n\\nLocally, mimikatz can be run using:\\n\\n* sekurlsa::Minidump lsassdump.dmp\\n* sekurlsa::logonPasswords\\n\\nBuilt-in Windows tools such as `comsvcs.dll` can also be used:\\n\\n* rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)\\n\\nSimilar to [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012), the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS)\\n\\nWindows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Security Packages and HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\\n\\nThe following SSPs can be used to access credentials:\\n\\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\\n\", \"old_value\": \"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).\\n\\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\\n\\nFor example, on the target host use procdump:\\n\\n* procdump -ma lsass.exe lsass_dump\\n\\nLocally, mimikatz can be run using:\\n\\n* sekurlsa::Minidump lsassdump.dmp\\n* sekurlsa::logonPasswords\\n\\nBuilt-in Windows tools such as comsvcs.dll can also be used:\\n\\n* rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)\\n\\n\\nWindows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Security Packages and HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\\n\\nThe following SSPs can be used to access credentials:\\n\\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\\n\", \"diff\": \"--- \\n+++ \\n@@ -11,10 +11,11 @@\\n * sekurlsa::Minidump lsassdump.dmp\\n * sekurlsa::logonPasswords\\n \\n-Built-in Windows tools such as comsvcs.dll can also be used:\\n+Built-in Windows tools such as `comsvcs.dll` can also be used:\\n \\n * rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)\\n \\n+Similar to [Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012), the silent process exit mechanism can be abused to create a memory dump of `lsass.exe` through Windows Error Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS)\\n \\n Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Security Packages and HKLM\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\\n \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Deep Instinct LSASS\", \"description\": \"Gilboa, A. (2021, February 16). LSASS Memory Dumps are Stealthier than Ever Before - Part 2. Retrieved December 27, 2023.\", \"url\": \"https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2\"}, \"root['x_mitre_data_sources'][6]\": \"File: File Creation\"}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to access credential material stored | t | 1 | Adversaries may attempt to access credential material stored |
| > | in the process memory of the Local Security Authority Subsy | > | in the process memory of the Local Security Authority Subsy | ||
| > | stem Service (LSASS). After a user logs on, the system gener | > | stem Service (LSASS). After a user logs on, the system gener | ||
| > | ates and stores a variety of credential materials in LSASS p | > | ates and stores a variety of credential materials in LSASS p | ||
| > | rocess memory. These credential materials can be harvested b | > | rocess memory. These credential materials can be harvested b | ||
| > | y an administrative user or SYSTEM and used to conduct [Late | > | y an administrative user or SYSTEM and used to conduct [Late | ||
| > | ral Movement](https://attack.mitre.org/tactics/TA0008) using | > | ral Movement](https://attack.mitre.org/tactics/TA0008) using | ||
| > | [Use Alternate Authentication Material](https://attack.mitr | > | [Use Alternate Authentication Material](https://attack.mitr | ||
| > | e.org/techniques/T1550). As well as in-memory techniques, t | > | e.org/techniques/T1550). As well as in-memory techniques, t | ||
| > | he LSASS process memory can be dumped from the target host a | > | he LSASS process memory can be dumped from the target host a | ||
| > | nd analyzed on a local system. For example, on the target h | > | nd analyzed on a local system. For example, on the target h | ||
| > | ost use procdump: * <code>procdump -ma lsass.exe lsass_dump | > | ost use procdump: * <code>procdump -ma lsass.exe lsass_dump | ||
| > | </code> Locally, mimikatz can be run using: * <code>sekurl | > | </code> Locally, mimikatz can be run using: * <code>sekurl | ||
| > | sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas | > | sa::Minidump lsassdump.dmp</code> * <code>sekurlsa::logonPas | ||
| > | swords</code> Built-in Windows tools such as comsvcs.dll ca | > | swords</code> Built-in Windows tools such as `comsvcs.dll` | ||
| > | n also be used: * <code>rundll32.exe C:\\Windows\\System32\\co | > | can also be used: * <code>rundll32.exe C:\\Windows\\System32\\ | ||
| > | msvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vole | > | comsvcs.dll MiniDump PID lsass.dmp full</code>(Citation: Vo | ||
| > | xity Exchange Marauder March 2021)(Citation: Symantec Attack | > | lexity Exchange Marauder March 2021)(Citation: Symantec Atta | ||
| > | s Against Government Sector) Windows Security Support Prov | > | cks Against Government Sector) Similar to [Image File Execu | ||
| > | ider (SSP) DLLs are loaded into LSASS process at system star | > | tion Options Injection](https://attack.mitre.org/techniques/ | ||
| > | t. Once loaded into the LSA, SSP DLLs have access to encrypt | > | T1546/012), the silent process exit mechanism can be abused | ||
| > | ed and plaintext passwords that are stored in Windows, such | > | to create a memory dump of `lsass.exe` through Windows Error | ||
| > | as any logged-on user's Domain password or smart card PINs. | > | Reporting (`WerFault.exe`).(Citation: Deep Instinct LSASS) | ||
| > | The SSP configuration is stored in two Registry keys: <code> | > | Windows Security Support Provider (SSP) DLLs are loaded int | ||
| > | HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages< | > | o LSASS process at system start. Once loaded into the LSA, S | ||
| > | /code> and <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\O | > | SP DLLs have access to encrypted and plaintext passwords tha | ||
| > | SConfig\\Security Packages</code>. An adversary may modify th | > | t are stored in Windows, such as any logged-on user's Domain | ||
| > | ese Registry keys to add new SSPs, which will be loaded the | > | password or smart card PINs. The SSP configuration is store | ||
| > | next time the system boots, or when the AddSecurityPackage W | > | d in two Registry keys: <code>HKLM\\SYSTEM\\CurrentControlSet\\ | ||
| > | indows API function is called.(Citation: Graeber 2014) The | > | Control\\Lsa\\Security Packages</code> and <code>HKLM\\SYSTEM\\C | ||
| > | following SSPs can be used to access credentials: * Msv: In | > | urrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages</cod | ||
| > | teractive logons, batch logons, and service logons are done | > | e>. An adversary may modify these Registry keys to add new S | ||
| > | through the MSV authentication package. * Wdigest: The Diges | > | SPs, which will be loaded the next time the system boots, or | ||
| > | t Authentication protocol is designed for use with Hypertext | > | when the AddSecurityPackage Windows API function is called. | ||
| > | Transfer Protocol (HTTP) and Simple Authentication Security | > | (Citation: Graeber 2014) The following SSPs can be used to | ||
| > | Layer (SASL) exchanges.(Citation: TechNet Blogs Credential | > | access credentials: * Msv: Interactive logons, batch logons | ||
| > | Protection) * Kerberos: Preferred for mutual client-server d | > | , and service logons are done through the MSV authentication | ||
| > | omain authentication in Windows 2000 and later. * CredSSP: | > | package. * Wdigest: The Digest Authentication protocol is d | ||
| > | Provides SSO and Network Level Authentication for Remote Des | > | esigned for use with Hypertext Transfer Protocol (HTTP) and | ||
| > | ktop Services.(Citation: TechNet Blogs Credential Protection | > | Simple Authentication Security Layer (SASL) exchanges.(Citat | ||
| > | ) | > | ion: TechNet Blogs Credential Protection) * Kerberos: Prefer | ||
| > | red for mutual client-server domain authentication in Window | ||||
| > | s 2000 and later. * CredSSP: Provides SSO and Network Level | ||||
| > | Authentication for Remote Desktop Services.(Citation: TechN | ||||
| > | et Blogs Credential Protection) |
grep -E \"^[0-9a-f-]* r\" /proc/\"$pid\"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.(Citation: atomic-red proc file system) When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process\u2019s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc Gitbook)\n\nIf running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1003/007",
"external_id": "T1003.007"
},
{
"source_name": "atomic-red proc file system",
"description": "Atomic Red Team. (2023, November). T1003.007 - OS Credential Dumping: Proc Filesystem. Retrieved March 28, 2024.",
"url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.007/T1003.007.md"
},
{
"source_name": "baeldung Linux proc map 2022",
"description": "baeldung. (2022, April 8). Understanding the Linux /proc/id/maps File. Retrieved March 31, 2023.",
"url": "https://www.baeldung.com/linux/proc-id-maps"
},
{
"source_name": "Polop Linux PrivEsc Gitbook",
"description": "Carlos Polop. (2023, March 5). Linux Privilege Escalation. Retrieved March 31, 2023.",
"url": "https://book.hacktricks.xyz/linux-hardening/privilege-escalation#proc-usdpid-maps-and-proc-usdpid-mem"
},
{
"source_name": "MimiPenguin GitHub May 2017",
"description": "Gregal, H. (2017, May 12). MimiPenguin. Retrieved December 5, 2017.",
"url": "https://github.com/huntergregal/mimipenguin"
},
{
"source_name": "Picus Labs Proc cump 2022",
"description": "Huseyin Can YUCEEL & Picus Labs. (2022, March 22). Retrieved March 31, 2023.",
"url": "https://www.picussecurity.com/resource/the-mitre-attck-t1003-os-credential-dumping-technique-and-its-adversary-use"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Tim (Wadhwa-)Brown"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"File: File Access"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc/PID/maps`, where the `PID` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-10 16:41:01.496000+00:00\", \"old_value\": \"2023-04-15 01:16:25.566000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/grep -E \\\"^[0-9a-f-]* r\\\" /proc/\\\"$pid\\\"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.(Citation: atomic-red proc file system) When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process\\u2019s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc Gitbook)\\n\\nIf running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.\", \"old_value\": \"Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/grep -E \\\"^[0-9a-f-]* r\\\" /proc/\\\"$pid\\\"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.(Citation: atomic-red proc file system) When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process\\u2019s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc Gitbook)\\n \\n If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_detection']\": {\"new_value\": \"To obtain the passwords and hashes stored in memory, processes must open a maps file in the `/proc` filesystem for the process being analyzed. This file is stored under the path `/proc/PID/maps`, where the `PID` directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.\", \"old_value\": \"To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed. This file is stored under the path /proc/\\\\*/maps, where the \\\\* directory is the unique pid of the program being interrogated for such authentication data. The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"atomic-red proc file system\", \"description\": \"Atomic Red Team. (2023, November). T1003.007 - OS Credential Dumping: Proc Filesystem. Retrieved March 28, 2024.\", \"url\": \"https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.007/T1003.007.md\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather credentials from the proc filesystem | t | 1 | Adversaries may gather credentials from the proc filesystem |
| > | or `/proc`. The proc filesystem is a pseudo-filesystem used | > | or `/proc`. The proc filesystem is a pseudo-filesystem used | ||
| > | as an interface to kernel data structures for Linux based sy | > | as an interface to kernel data structures for Linux based sy | ||
| > | stems managing virtual memory. For each process, the `/proc/ | > | stems managing virtual memory. For each process, the `/proc/ | ||
| > | <PID>/maps` file shows how memory is mapped within the proce | > | <PID>/maps` file shows how memory is mapped within the proce | ||
| > | ss\u2019s virtual address space. And `/proc/<PID>/mem`, exposed f | > | ss\u2019s virtual address space. And `/proc/<PID>/mem`, exposed f | ||
| > | or debugging purposes, provides access to the process\u2019s virt | > | or debugging purposes, provides access to the process\u2019s virt | ||
| > | ual address space.(Citation: Picus Labs Proc cump 2022)(Cita | > | ual address space.(Citation: Picus Labs Proc cump 2022)(Cita | ||
| > | tion: baeldung Linux proc map 2022) When executing with roo | > | tion: baeldung Linux proc map 2022) When executing with roo | ||
| > | t privileges, adversaries can search these memory locations | > | t privileges, adversaries can search these memory locations | ||
| > | for all processes on a system that contain patterns that are | > | for all processes on a system that contain patterns indicati | ||
| > | indicative of credentials, such as looking for fixed string | > | ve of credentials. Adversaries may use regex patterns, such | ||
| > | s in memory structures or cached hashes. When running withou | > | as <code>grep -E \"^[0-9a-f-]* r\" /proc/\"$pid\"/maps | cut -d' | ||
| > | t privileged access, processes can still view their own virt | > | ' -f 1</code>, to look for fixed strings in memory structur | ||
| > | ual memory locations. Some services or programs may save cre | > | es or cached hashes.(Citation: atomic-red proc file system) | ||
| > | dentials in clear text inside the process\u2019s memory.(Citation | > | When running without privileged access, processes can still | ||
| > | : MimiPenguin GitHub May 2017)(Citation: Polop Linux PrivEsc | > | view their own virtual memory locations. Some services or pr | ||
| > | Gitbook) If running as or with the permissions of a web br | > | ograms may save credentials in clear text inside the process | ||
| > | owser, a process can search the `/maps` & `/mem` locations f | > | \u2019s memory.(Citation: MimiPenguin GitHub May 2017)(Citation: | ||
| > | or common website credential patterns (that can also be used | > | Polop Linux PrivEsc Gitbook) If running as or with the perm | ||
| > | to find adjacent memory within the same structure) in which | > | issions of a web browser, a process can search the `/maps` & | ||
| > | hashes or cleartext credentials may be located. | > | `/mem` locations for common website credential patterns (th | ||
| > | at can also be used to find adjacent memory within the same | ||||
| > | structure) in which hashes or cleartext credentials may be l | ||||
| > | ocated. |
HKEY_CURRENT_USER\\Software\\Microsoft\\Office test\\Special\\Perf\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Office test\\Special\\Perf\n\nAdversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1137/002",
"external_id": "T1137.002"
},
{
"source_name": "Palo Alto Office Test Sofacy",
"description": "Falcone, R. (2016, July 20). Technical Walkthrough: Office Test Persistence Method Used In Recent Sofacy Attacks. Retrieved July 3, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2016/07/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/"
},
{
"source_name": "Hexacorn Office Test",
"description": "Hexacorn. (2014, April 16). Beyond good ol\u2019 Run key, Part 10. Retrieved July 3, 2017.",
"url": "http://www.hexacorn.com/blog/2014/04/16/beyond-good-ol-run-key-part-10/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Creation",
"Command: Command Execution",
"File: File Modification",
"Windows Registry: Windows Registry Key Modification",
"File: File Creation",
"Process: Process Creation",
"Module: Module Load"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for the creation of the Office Test Registry key. Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts. Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence. Since v13.52, Autoruns can detect tasks set up using the Office Test Registry key.(Citation: Palo Alto Office Test Sofacy)\n\nConsider monitoring Office processes for anomalous DLL loads.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Office 365"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false}, \"dictionary_item_removed\": {\"root['x_mitre_permissions_required']\": [\"Administrator\", \"User\"], \"root['x_mitre_system_requirements']\": [\"Office 2007, 2010, 2013, and 2016\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:41:55.175000+00:00\", \"old_value\": \"2021-08-16 21:35:17.618000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse the Microsoft Office \\\"Office Test\\\" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)\\n\\nThere exist user and global Registry keys for the Office Test feature, such as:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\\n\\nAdversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.\", \"old_value\": \"Adversaries may abuse the Microsoft Office \\\"Office Test\\\" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)\\n\\nThere exist user and global Registry keys for the Office Test feature:\\n\\n* HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\\n* HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\\n\\nAdversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.\", \"diff\": \"--- \\n+++ \\n@@ -1,6 +1,6 @@\\n Adversaries may abuse the Microsoft Office \\\"Office Test\\\" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)\\n \\n-There exist user and global Registry keys for the Office Test feature:\\n+There exist user and global Registry keys for the Office Test feature, such as:\\n \\n * HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\\n * HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse the Microsoft Office \"Office Test\" Reg | t | 1 | Adversaries may abuse the Microsoft Office \"Office Test\" Reg |
| > | istry key to obtain persistence on a compromised system. An | > | istry key to obtain persistence on a compromised system. An | ||
| > | Office Test Registry location exists that allows a user to s | > | Office Test Registry location exists that allows a user to s | ||
| > | pecify an arbitrary DLL that will be executed every time an | > | pecify an arbitrary DLL that will be executed every time an | ||
| > | Office application is started. This Registry key is thought | > | Office application is started. This Registry key is thought | ||
| > | to be used by Microsoft to load DLLs for testing and debuggi | > | to be used by Microsoft to load DLLs for testing and debuggi | ||
| > | ng purposes while developing Office applications. This Regis | > | ng purposes while developing Office applications. This Regis | ||
| > | try key is not created by default during an Office installat | > | try key is not created by default during an Office installat | ||
| > | ion.(Citation: Hexacorn Office Test)(Citation: Palo Alto Off | > | ion.(Citation: Hexacorn Office Test)(Citation: Palo Alto Off | ||
| > | ice Test Sofacy) There exist user and global Registry keys | > | ice Test Sofacy) There exist user and global Registry keys | ||
| > | for the Office Test feature: * <code>HKEY_CURRENT_USER\\Soft | > | for the Office Test feature, such as: * <code>HKEY_CURRENT_ | ||
| > | ware\\Microsoft\\Office test\\Special\\Perf</code> * <code>HKEY_ | > | USER\\Software\\Microsoft\\Office test\\Special\\Perf</code> * <c | ||
| > | LOCAL_MACHINE\\Software\\Microsoft\\Office test\\Special\\Perf</c | > | ode>HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Office test\\Specia | ||
| > | ode> Adversaries may add this Registry key and specify a ma | > | l\\Perf</code> Adversaries may add this Registry key and spe | ||
| > | licious DLL that will be executed whenever an Office applica | > | cify a malicious DLL that will be executed whenever an Offic | ||
| > | tion, such as Word or Excel, is started. | > | e application, such as Word or Excel, is started. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious l | t | 1 | Adversaries may send spearphishing emails with a malicious l |
| > | ink in an attempt to gain access to victim systems. Spearphi | > | ink in an attempt to gain access to victim systems. Spearphi | ||
| > | shing with a link is a specific variant of spearphishing. It | > | shing with a link is a specific variant of spearphishing. It | ||
| > | is different from other forms of spearphishing in that it e | > | is different from other forms of spearphishing in that it e | ||
| > | mploys the use of links to download malware contained in ema | > | mploys the use of links to download malware contained in ema | ||
| > | il, instead of attaching malicious files to the email itself | > | il, instead of attaching malicious files to the email itself | ||
| > | , to avoid defenses that may inspect email attachments. Spea | > | , to avoid defenses that may inspect email attachments. Spea | ||
| > | rphishing may also involve social engineering techniques, su | > | rphishing may also involve social engineering techniques, su | ||
| > | ch as posing as a trusted source. All forms of spearphishin | > | ch as posing as a trusted source. All forms of spearphishin | ||
| > | g are electronically delivered social engineering targeted a | > | g are electronically delivered social engineering targeted a | ||
| > | t a specific individual, company, or industry. In this case, | > | t a specific individual, company, or industry. In this case, | ||
| > | the malicious emails contain links. Generally, the links wi | > | the malicious emails contain links. Generally, the links wi | ||
| > | ll be accompanied by social engineering text and require the | > | ll be accompanied by social engineering text and require the | ||
| > | user to actively click or copy and paste a URL into a brows | > | user to actively click or copy and paste a URL into a brows | ||
| > | er, leveraging [User Execution](https://attack.mitre.org/tec | > | er, leveraging [User Execution](https://attack.mitre.org/tec | ||
| > | hniques/T1204). The visited website may compromise the web b | > | hniques/T1204). The visited website may compromise the web b | ||
| > | rowser using an exploit, or the user will be prompted to dow | > | rowser using an exploit, or the user will be prompted to dow | ||
| > | nload applications, documents, zip files, or even executable | > | nload applications, documents, zip files, or even executable | ||
| > | s depending on the pretext for the email in the first place. | > | s depending on the pretext for the email in the first place. | ||
| > | Adversaries may also include links that are intended to in | > | Adversaries may also include links that are intended to in | ||
| > | teract directly with an email reader, including embedded ima | > | teract directly with an email reader, including embedded ima | ||
| > | ges intended to exploit the end system directly. Additionall | > | ges intended to exploit the end system directly. Additionall | ||
| > | y, adversaries may use seemingly benign links that abuse spe | > | y, adversaries may use seemingly benign links that abuse spe | ||
| > | cial characters to mimic legitimate websites (known as an \"I | > | cial characters to mimic legitimate websites (known as an \"I | ||
| > | DN homograph attack\").(Citation: CISA IDN ST05-016) URLs may | > | DN homograph attack\").(Citation: CISA IDN ST05-016) URLs may | ||
| > | also be obfuscated by taking advantage of quirks in the URL | > | also be obfuscated by taking advantage of quirks in the URL | ||
| > | schema, such as the acceptance of integer- or hexadecimal-b | > | schema, such as the acceptance of integer- or hexadecimal-b | ||
| > | ased hostname formats and the automatic discarding of text b | > | ased hostname formats and the automatic discarding of text b | ||
| > | efore an \u201c@\u201d symbol: for example, `hxxp://google.com@1157586 | > | efore an \u201c@\u201d symbol: for example, `hxxp://google.com@1157586 | ||
| > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | > | 937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | ||
| > | may also utilize links to perform consent phishing, typicall | > | may also utilize links to perform consent phishing, typicall | ||
| > | y with OAuth 2.0 request URLs that when accepted by the user | > | y with OAuth 2.0 request URLs that when accepted by the user | ||
| > | provide permissions/access for malicious applications, allo | > | provide permissions/access for malicious applications, allo | ||
| > | wing adversaries to [Steal Application Access Token](https: | > | wing adversaries to [Steal Application Access Token](https: | ||
| > | //attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro | > | //attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro | ||
| > | Pawn Storm OAuth 2017) These stolen access tokens allow the | > | Pawn Storm OAuth 2017) These stolen access tokens allow the | ||
| > | adversary to perform various actions on behalf of the user | > | adversary to perform various actions on behalf of the user | ||
| > | via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishi | > | via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishi | ||
| > | ng 2021) | > | ng 2021) Adversaries may also utilize spearphishing links t | ||
| > | o [Steal Application Access Token](https://attack.mitre.org/ | ||||
| > | techniques/T1528)s that grant immediate access to the victim | ||||
| > | environment. For example, a user may be lured through \u201ccons | ||||
| > | ent phishing\u201d into granting adversaries permissions/access v | ||||
| > | ia a malicious OAuth 2.0 request URL .(Citation: Trend Micro | ||||
| > | Pawn Storm OAuth 2017)(Citation: Microsoft OAuth 2.0 Consen | ||||
| > | t Phishing 2021) Similarly, malicious links may also target | ||||
| > | device-based authorization, such as OAuth 2.0 device author | ||||
| > | ization grant flow which is typically used to authenticate d | ||||
| > | evices without UIs/browsers. Known as \u201cdevice code phishing, | ||||
| > | \u201d an adversary may send a link that directs the victim to a | ||||
| > | malicious authorization page where the user is tricked into | ||||
| > | entering a code/credentials that produces a device token.(Ci | ||||
| > | tation: SecureWorks Device Code Phishing 2021)(Citation: Net | ||||
| > | skope Device Code Phishing 2021)(Citation: Optiv Device Code | ||||
| > | Phishing 2021) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing messages with a malicious | t | 1 | Adversaries may send spearphishing messages with a malicious |
| > | link to elicit sensitive information that can be used durin | > | link to elicit sensitive information that can be used durin | ||
| > | g targeting. Spearphishing for information is an attempt to | > | g targeting. Spearphishing for information is an attempt to | ||
| > | trick targets into divulging information, frequently credent | > | trick targets into divulging information, frequently credent | ||
| > | ials or other actionable information. Spearphishing for info | > | ials or other actionable information. Spearphishing for info | ||
| > | rmation frequently involves social engineering techniques, s | > | rmation frequently involves social engineering techniques, s | ||
| > | uch as posing as a source with a reason to collect informati | > | uch as posing as a source with a reason to collect informati | ||
| > | on (ex: [Establish Accounts](https://attack.mitre.org/techni | > | on (ex: [Establish Accounts](https://attack.mitre.org/techni | ||
| > | ques/T1585) or [Compromise Accounts](https://attack.mitre.or | > | ques/T1585) or [Compromise Accounts](https://attack.mitre.or | ||
| > | g/techniques/T1586)) and/or sending multiple, seemingly urge | > | g/techniques/T1586)) and/or sending multiple, seemingly urge | ||
| > | nt messages. All forms of spearphishing are electronically | > | nt messages. All forms of spearphishing are electronically | ||
| > | delivered social engineering targeted at a specific individu | > | delivered social engineering targeted at a specific individu | ||
| > | al, company, or industry. In this scenario, the malicious em | > | al, company, or industry. In this scenario, the malicious em | ||
| > | ails contain links generally accompanied by social engineeri | > | ails contain links generally accompanied by social engineeri | ||
| > | ng text to coax the user to actively click or copy and paste | > | ng text to coax the user to actively click or copy and paste | ||
| > | a URL into a browser.(Citation: TrendMictro Phishing)(Citat | > | a URL into a browser.(Citation: TrendMictro Phishing)(Citat | ||
| > | ion: PCMag FakeLogin) The given website may be a clone of a | > | ion: PCMag FakeLogin) The given website may be a clone of a | ||
| > | legitimate site (such as an online or corporate login portal | > | legitimate site (such as an online or corporate login portal | ||
| > | ) or may closely resemble a legitimate site in appearance an | > | ) or may closely resemble a legitimate site in appearance an | ||
| > | d have a URL containing elements from the real site. URLs ma | > | d have a URL containing elements from the real site. URLs ma | ||
| > | y also be obfuscated by taking advantage of quirks in the UR | > | y also be obfuscated by taking advantage of quirks in the UR | ||
| > | L schema, such as the acceptance of integer- or hexadecimal- | > | L schema, such as the acceptance of integer- or hexadecimal- | ||
| > | based hostname formats and the automatic discarding of text | > | based hostname formats and the automatic discarding of text | ||
| > | before an \u201c@\u201d symbol: for example, `hxxp://google.com@115758 | > | before an \u201c@\u201d symbol: for example, `hxxp://google.com@115758 | ||
| > | 6937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | > | 6937`.(Citation: Mandiant URL Obfuscation 2023) Adversaries | ||
| > | may also link to \"web bugs\" or \"web beacons\" within phishin | > | may also embed \u201ctracking pixels\u201d, \"web bugs\", or \"web beaco | ||
| > | g messages to verify the receipt of an email, while also pot | > | ns\" within phishing messages to verify the receipt of an ema | ||
| > | entially profiling and tracking victim information such as I | > | il, while also potentially profiling and tracking victim inf | ||
| > | P address.(Citation: NIST Web Bug) Adversaries may also be | > | ormation such as IP address.(Citation: NIST Web Bug) (Citati | ||
| > | able to spoof a complete website using what is known as a \"b | > | on: Ryte Wiki) These mechanisms often appear as small images | ||
| > | rowser-in-the-browser\" (BitB) attack. By generating a fake b | > | (typically one pixel in size) or otherwise obfuscated objec | ||
| > | rowser popup window with an HTML-based address bar that appe | > | ts and are typically delivered as HTML code containing a lin | ||
| > | ars to contain a legitimate URL (such as an authentication p | > | k to a remote server. (Citation: Ryte Wiki)(Citation: IAPP) | ||
| > | ortal), they may be able to prompt users to enter their cred | > | Adversaries may also be able to spoof a complete website us | ||
| > | entials while bypassing typical URL verification methods.(Ci | > | ing what is known as a \"browser-in-the-browser\" (BitB) attac | ||
| > | tation: ZScaler BitB 2020)(Citation: Mr. D0x BitB 2022) Adv | > | k. By generating a fake browser popup window with an HTML-ba | ||
| > | ersaries can use phishing kits such as `EvilProxy` and `Evil | > | sed address bar that appears to contain a legitimate URL (su | ||
| > | ginx2` to proxy the connection between the victim and the le | > | ch as an authentication portal), they may be able to prompt | ||
| > | gitimate website. On a successful login, the victim is redir | > | users to enter their credentials while bypassing typical URL | ||
| > | ected to the legitimate website, while the adversary capture | > | verification methods.(Citation: ZScaler BitB 2020)(Citation | ||
| > | s their session cookie (i.e., [Steal Web Session Cookie](htt | > | : Mr. D0x BitB 2022) Adversaries can use phishing kits such | ||
| > | ps://attack.mitre.org/techniques/T1539)) in addition to thei | > | as `EvilProxy` and `Evilginx2` to perform adversary-in-the- | ||
| > | r username and password. This may enable the adversary to th | > | middle phishing by proxying the connection between the victi | ||
| > | en bypass MFA via [Web Session Cookie](https://attack.mitre. | > | m and the legitimate website. On a successful login, the vic | ||
| > | org/techniques/T1550/004).(Citation: Proofpoint Human Factor | > | tim is redirected to the legitimate website, while the adver | ||
| > | ) From the fake website, information is gathered in web for | > | sary captures their session cookie (i.e., [Steal Web Session | ||
| > | ms and sent to the adversary. Adversaries may also use infor | > | Cookie](https://attack.mitre.org/techniques/T1539)) in addi | ||
| > | mation from previous reconnaissance efforts (ex: [Search Ope | > | tion to their username and password. This may enable the adv | ||
| > | n Websites/Domains](https://attack.mitre.org/techniques/T159 | > | ersary to then bypass MFA via [Web Session Cookie](https://a | ||
| > | 3) or [Search Victim-Owned Websites](https://attack.mitre.or | > | ttack.mitre.org/techniques/T1550/004).(Citation: Proofpoint | ||
| > | g/techniques/T1594)) to craft persuasive and believable lure | > | Human Factor) Adversaries may also send a malicious link in | ||
| > | s. | > | the form of Quick Response (QR) Codes (also known as \u201cquish | ||
| > | ing\u201d). These links may direct a victim to a credential phish | ||||
| > | ing page.(Citation: QR-campaign-energy-firm) By using a QR c | ||||
| > | ode, the URL may not be exposed in the email and may thus go | ||||
| > | undetected by most automated email security scans.(Citation | ||||
| > | : qr-phish-agriculture) These QR codes may be scanned by or | ||||
| > | delivered directly to a user\u2019s mobile device (i.e., [Phishi | ||||
| > | ng](https://attack.mitre.org/techniques/T1660)), which may b | ||||
| > | e less secure in several relevant ways.(Citation: qr-phish-a | ||||
| > | griculture) For example, mobile users may not be able to not | ||||
| > | ice minor differences between genuine and credential harvest | ||||
| > | ing websites due to mobile\u2019s smaller form factor. From the | ||||
| > | fake website, information is gathered in web forms and sent | ||||
| > | to the adversary. Adversaries may also use information from | ||||
| > | previous reconnaissance efforts (ex: [Search Open Websites/D | ||||
| > | omains](https://attack.mitre.org/techniques/T1593) or [Searc | ||||
| > | h Victim-Owned Websites](https://attack.mitre.org/techniques | ||||
| > | /T1594)) to craft persuasive and believable lures. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may modify system firmware to persist on systems | t | 1 | Adversaries may modify system firmware to persist on systems |
| > | .The BIOS (Basic Input/Output System) and The Unified Extens | > | .The BIOS (Basic Input/Output System) and The Unified Extens | ||
| > | ible Firmware Interface (UEFI) or Extensible Firmware Interf | > | ible Firmware Interface (UEFI) or Extensible Firmware Interf | ||
| > | ace (EFI) are examples of system firmware that operate as th | > | ace (EFI) are examples of system firmware that operate as th | ||
| > | e software interface between the operating system and hardwa | > | e software interface between the operating system and hardwa | ||
| > | re of a computer. (Citation: Wikipedia BIOS) (Citation: Wiki | > | re of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipe | ||
| > | pedia UEFI) (Citation: About UEFI) System firmware like BIO | > | dia UEFI)(Citation: About UEFI) System firmware like BIOS a | ||
| > | S and (U)EFI underly the functionality of a computer and may | > | nd (U)EFI underly the functionality of a computer and may be | ||
| > | be modified by an adversary to perform or assist in malicio | > | modified by an adversary to perform or assist in malicious | ||
| > | us activity. Capabilities exist to overwrite the system firm | > | activity. Capabilities exist to overwrite the system firmwar | ||
| > | ware, which may give sophisticated adversaries a means to in | > | e, which may give sophisticated adversaries a means to insta | ||
| > | stall malicious firmware updates as a means of persistence o | > | ll malicious firmware updates as a means of persistence on a | ||
| > | n a system that may be difficult to detect. | > | system that may be difficult to detect. |
Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. \n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1057",
"external_id": "T1057"
},
{
"source_name": "show_processes_cisco_cmd",
"description": "Cisco. (2022, August 16). show processes - . Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_monitor_permit_list_through_show_process_memory.html#wp3599497760"
},
{
"source_name": "US-CERT-TA18-106A",
"description": "US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Process: Process Creation",
"Process: OS API Execution",
"Command: Command Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nNormal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nFor network infrastructure devices, collect AAA logging to monitor for `show` commands being run by non-standard users from non-standard locations.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows",
"Network"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"dictionary_item_removed\": {\"root['x_mitre_system_requirements']\": [\"Administrator, SYSTEM may provide better process ownership details\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:43:55.369000+00:00\", \"old_value\": \"2023-08-11 21:40:56.448000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nIn Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. \\n\\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)\", \"old_value\": \"Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nIn Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.\\n\\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n+Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n \\n-In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via /proc.\\n+In Windows environments, adversaries could obtain details on running processes using the [Tasklist](https://attack.mitre.org/software/S0057) utility via [cmd](https://attack.mitre.org/software/S0106) or Get-Process via [PowerShell](https://attack.mitre.org/techniques/T1059/001). Information about processes can also be extracted from the output of [Native API](https://attack.mitre.org/techniques/T1106) calls such as CreateToolhelp32Snapshot. In Mac and Linux, this is accomplished with the ps command. Adversaries may also opt to enumerate processes via `/proc`. \\n \\n On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show processes` can be used to display current running processes.(Citation: US-CERT-TA18-106A)(Citation: show_processes_cisco_cmd)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get information about running pro | t | 1 | Adversaries may attempt to get information about running pro |
| > | cesses on a system. Information obtained could be used to ga | > | cesses on a system. Information obtained could be used to ga | ||
| > | in an understanding of common software/applications running | > | in an understanding of common software/applications running | ||
| > | on systems within the network. Adversaries may use the infor | > | on systems within the network. Administrator or otherwise el | ||
| > | mation from [Process Discovery](https://attack.mitre.org/tec | > | evated access may provide better process details. Adversarie | ||
| > | hniques/T1057) during automated discovery to shape follow-on | > | s may use the information from [Process Discovery](https://a | ||
| > | behaviors, including whether or not the adversary fully inf | > | ttack.mitre.org/techniques/T1057) during automated discovery | ||
| > | ects the target and/or attempts specific actions. In Window | > | to shape follow-on behaviors, including whether or not the | ||
| > | s environments, adversaries could obtain details on running | > | adversary fully infects the target and/or attempts specific | ||
| > | processes using the [Tasklist](https://attack.mitre.org/soft | > | actions. In Windows environments, adversaries could obtain | ||
| > | ware/S0057) utility via [cmd](https://attack.mitre.org/softw | > | details on running processes using the [Tasklist](https://at | ||
| > | are/S0106) or <code>Get-Process</code> via [PowerShell](http | > | tack.mitre.org/software/S0057) utility via [cmd](https://att | ||
| > | s://attack.mitre.org/techniques/T1059/001). Information abou | > | ack.mitre.org/software/S0106) or <code>Get-Process</code> vi | ||
| > | t processes can also be extracted from the output of [Native | > | a [PowerShell](https://attack.mitre.org/techniques/T1059/001 | ||
| > | API](https://attack.mitre.org/techniques/T1106) calls such | > | ). Information about processes can also be extracted from th | ||
| > | as <code>CreateToolhelp32Snapshot</code>. In Mac and Linux, | > | e output of [Native API](https://attack.mitre.org/techniques | ||
| > | this is accomplished with the <code>ps</code> command. Adver | > | /T1106) calls such as <code>CreateToolhelp32Snapshot</code>. | ||
| > | saries may also opt to enumerate processes via /proc. On ne | > | In Mac and Linux, this is accomplished with the <code>ps</c | ||
| > | twork devices, [Network Device CLI](https://attack.mitre.org | > | ode> command. Adversaries may also opt to enumerate processe | ||
| > | /techniques/T1059/008) commands such as `show processes` can | > | s via `/proc`. On network devices, [Network Device CLI](ht | ||
| > | be used to display current running processes.(Citation: US- | > | tps://attack.mitre.org/techniques/T1059/008) commands such a | ||
| > | CERT-TA18-106A)(Citation: show_processes_cisco_cmd) | > | s `show processes` can be used to display current running pr | ||
| > | ocesses.(Citation: US-CERT-TA18-106A)(Citation: show_process | ||||
| > | es_cisco_cmd) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | To disguise the source of malicious traffic, adversaries may | t | 1 | Adversaries may chain together multiple proxies to disguise |
| > | chain together multiple proxies. Typically, a defender will | > | the source of malicious traffic. Typically, a defender will | ||
| > | be able to identify the last proxy traffic traversed before | > | be able to identify the last proxy traffic traversed before | ||
| > | it enters their network; the defender may or may not be abl | > | it enters their network; the defender may or may not be able | ||
| > | e to identify any previous proxies before the last-hop proxy | > | to identify any previous proxies before the last-hop proxy. | ||
| > | . This technique makes identifying the original source of th | > | This technique makes identifying the original source of the | ||
| > | e malicious traffic even more difficult by requiring the def | > | malicious traffic even more difficult by requiring the defe | ||
| > | ender to trace malicious traffic through several proxies to | > | nder to trace malicious traffic through several proxies to i | ||
| > | identify its source. A particular variant of this behavior i | > | dentify its source. For example, adversaries may construct | ||
| > | s to use onion routing networks, such as the publicly availa | > | or use onion routing networks \u2013 such as the publicly availab | ||
| > | ble TOR network. (Citation: Onion Routing) In the case of n | > | le [Tor](https://attack.mitre.org/software/S0183) network \u2013 | ||
| > | etwork infrastructure, particularly routers, it is possible | > | to transport encrypted C2 traffic through a compromised popu | ||
| > | for an adversary to leverage multiple compromised devices to | > | lation, allowing communication with any device within the ne | ||
| > | create a multi-hop proxy chain within the Wide-Area Network | > | twork.(Citation: Onion Routing) In the case of network infr | ||
| > | (WAN) of the enterprise. By leveraging [Patch System Image | > | astructure, it is possible for an adversary to leverage mult | ||
| > | ](https://attack.mitre.org/techniques/T1601/001), adversarie | > | iple compromised devices to create a multi-hop proxy chain ( | ||
| > | s can add custom code to the affected network devices that w | > | i.e., [Network Devices](https://attack.mitre.org/techniques/ | ||
| > | ill implement onion routing between those nodes. This custo | > | T1584/008)). By leveraging [Patch System Image](https://atta | ||
| > | m onion routing network will transport the encrypted C2 traf | > | ck.mitre.org/techniques/T1601/001) on routers, adversaries c | ||
| > | fic through the compromised population, allowing adversaries | > | an add custom code to the affected network devices that will | ||
| > | to communicate with any device within the onion routing net | > | implement onion routing between those nodes. This method is | ||
| > | work. This method is dependent upon the [Network Boundary B | > | dependent upon the [Network Boundary Bridging](https://atta | ||
| > | ridging](https://attack.mitre.org/techniques/T1599) method i | > | ck.mitre.org/techniques/T1599) method allowing the adversari | ||
| > | n order to allow the adversaries to cross the protected netw | > | es to cross the protected network boundary of the Internet p | ||
| > | ork boundary of the Internet perimeter and into the organiza | > | erimeter and into the organization\u2019s Wide-Area Network (WAN) | ||
| > | tion\u2019s WAN. Protocols such as ICMP may be used as a transpor | > | . Protocols such as ICMP may be used as a transport. Simil | ||
| > | t. | > | arly, adversaries may abuse peer-to-peer (P2P) and blockchai | ||
| > | n-oriented infrastructure to implement routing between a dec | ||||
| > | entralized network of peers.(Citation: NGLite Trojan) |
Assembly.Load() and [Native API](https://attack.mitre.org/techniques/T1106) functions such as CreateThread(), memfd_create(), execve(), and/or execveat().(Citation: 00sec Droppers)(Citation: S1 Old Rat New Tricks)\n\nMonitor for artifacts of abnormal process execution. For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe). Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.(Citation: MDSec Detecting DOTNET)(Citation: Introducing Donut)\n\nAnalyze process behavior to determine if a process is performing actions it usually does not, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Linux",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-09 18:49:08.428000+00:00\", \"old_value\": \"2023-09-29 21:09:49.267000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).\\n\\nReflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)\\n\\nReflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the \\u201cinjection\\u201d loads code into the processes\\u2019 own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)\", \"old_value\": \"Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)\\n\\nReflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the \\u201cinjection\\u201d loads code into the processes\\u2019 own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,5 @@\\n-Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)\\n+Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).\\n+\\n+Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) For example, the `Assembly.Load()` method executed by [PowerShell](https://attack.mitre.org/techniques/T1059/001) may be abused to load raw code into the running process.(Citation: Microsoft AssemblyLoad)\\n \\n Reflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the \\u201cinjection\\u201d loads code into the processes\\u2019 own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}, \"iterable_item_added\": {\"root['external_references'][6]\": {\"source_name\": \"Microsoft AssemblyLoad\", \"description\": \"Microsoft. (n.d.). Assembly.Load Method. Retrieved February 9, 2024.\", \"url\": \"https://learn.microsoft.com/dotnet/api/system.reflection.assembly.load\"}, \"root['x_mitre_contributors'][5]\": \"Jiraput Thamsongkrah\"}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may reflectively load code into a process in ord | t | 1 | Adversaries may reflectively load code into a process in ord |
| > | er to conceal the execution of malicious payloads. Reflectiv | > | er to conceal the execution of malicious payloads. Reflectiv | ||
| > | e loading involves allocating then executing payloads direct | > | e loading involves allocating then executing payloads direct | ||
| > | ly within the memory of the process, vice creating a thread | > | ly within the memory of the process, vice creating a thread | ||
| > | or process backed by a file path on disk. Reflectively loade | > | or process backed by a file path on disk (e.g., [Shared Modu | ||
| > | d payloads may be compiled binaries, anonymous files (only p | > | les](https://attack.mitre.org/techniques/T1129)). Reflectiv | ||
| > | resent in RAM), or just snubs of fileless executable code (e | > | ely loaded payloads may be compiled binaries, anonymous file | ||
| > | x: position-independent shellcode).(Citation: Introducing Do | > | s (only present in RAM), or just snubs of fileless executabl | ||
| > | nut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart EL | > | e code (ex: position-independent shellcode).(Citation: Intro | ||
| > | F Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL) | > | ducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: | ||
| > | Reflective code injection is very similar to [Process Inje | > | Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandi | ||
| > | ction](https://attack.mitre.org/techniques/T1055) except tha | > | ant BYOL) For example, the `Assembly.Load()` method executed | ||
| > | t the \u201cinjection\u201d loads code into the processes\u2019 own memory | > | by [PowerShell](https://attack.mitre.org/techniques/T1059/0 | ||
| > | instead of that of a separate process. Reflective loading ma | > | 01) may be abused to load raw code into the running process. | ||
| > | y evade process-based detections since the execution of the | > | (Citation: Microsoft AssemblyLoad) Reflective code injectio | ||
| > | arbitrary code may be masked within a legitimate or otherwis | > | n is very similar to [Process Injection](https://attack.mitr | ||
| > | e benign process. Reflectively loading payloads directly int | > | e.org/techniques/T1055) except that the \u201cinjection\u201d loads co | ||
| > | o memory may also avoid creating files or other artifacts on | > | de into the processes\u2019 own memory instead of that of a separ | ||
| > | disk, while also enabling malware to keep these payloads en | > | ate process. Reflective loading may evade process-based dete | ||
| > | crypted (or otherwise obfuscated) until execution.(Citation: | > | ctions since the execution of the arbitrary code may be mask | ||
| > | Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Inte | > | ed within a legitimate or otherwise benign process. Reflecti | ||
| > | zer ACBackdoor)(Citation: S1 Old Rat New Tricks) | > | vely loading payloads directly into memory may also avoid cr | ||
| > | eating files or other artifacts on disk, while also enabling | ||||
| > | malware to keep these payloads encrypted (or otherwise obfu | ||||
| > | scated) until execution.(Citation: Stuart ELF Memory)(Citati | ||||
| > | on: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: | ||||
| > | S1 Old Rat New Tricks) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may use legitimate desktop support and remote a | t | 1 | An adversary may use legitimate desktop support and remote a |
| > | ccess software to establish an interactive command and contr | > | ccess software to establish an interactive command and contr | ||
| > | ol channel to target systems within networks. These services | > | ol channel to target systems within networks. These services | ||
| > | , such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, | > | , such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, | ||
| > | `LogMein`, `AmmyyAdmin`, and other remote monitoring and man | > | `LogMein`, `AmmyyAdmin`, and other remote monitoring and man | ||
| > | agement (RMM) tools, are commonly used as legitimate technic | > | agement (RMM) tools, are commonly used as legitimate technic | ||
| > | al support software and may be allowed by application contro | > | al support software and may be allowed by application contro | ||
| > | l within a target environment.(Citation: Symantec Living off | > | l within a target environment.(Citation: Symantec Living off | ||
| > | the Land)(Citation: CrowdStrike 2015 Global Threat Report)( | > | the Land)(Citation: CrowdStrike 2015 Global Threat Report)( | ||
| > | Citation: CrySyS Blog TeamSpy) Remote access software may b | > | Citation: CrySyS Blog TeamSpy) Remote access software may b | ||
| > | e installed and used post-compromise as an alternate communi | > | e installed and used post-compromise as an alternate communi | ||
| > | cations channel for redundant access or as a way to establis | > | cations channel for redundant access or as a way to establis | ||
| > | h an interactive remote desktop session with the target syst | > | h an interactive remote desktop session with the target syst | ||
| > | em. They may also be used as a component of malware to estab | > | em. They may also be used as a component of malware to estab | ||
| > | lish a reverse connection or back-connect to a service or ad | > | lish a reverse connection or back-connect to a service or ad | ||
| > | versary controlled system. Adversaries may similarly abuse | > | versary-controlled system. Adversaries may similarly abuse | ||
| > | response features included in EDR and other defensive tools | > | response features included in EDR and other defensive tools | ||
| > | that enable remote access. Installation of many remote acc | > | that enable remote access. Installation of many remote acc | ||
| > | ess software may also include persistence (e.g., the softwar | > | ess software may also include persistence (e.g., the softwar | ||
| > | e's installation routine creates a [Windows Service](https:/ | > | e's installation routine creates a [Windows Service](https:/ | ||
| > | /attack.mitre.org/techniques/T1543/003)). | > | /attack.mitre.org/techniques/T1543/003)). Remote access modu | ||
| > | les/features may also exist as part of otherwise existing so | ||||
| > | ftware (e.g., Google Chrome\u2019s Remote Desktop).(Citation: Goo | ||||
| > | gle Chrome Remote Desktop)(Citation: Chrome Remote Desktop) |
at.allow file. If the at.allow file does not exist, the at.deny file is checked. Every username not listed in at.deny is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the at.deny exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at)\n\nAdversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or to run a process under the context of a specified account (such as SYSTEM).\n\nIn Linux environments, adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1053/002",
"external_id": "T1053.002"
},
{
"source_name": "rowland linux at 2019",
"description": "Craig Rowland. (2019, July 25). Getting an Attacker IP Address from a Malicious Linux At Job. Retrieved October 15, 2021.",
"url": "https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/"
},
{
"source_name": "GTFObins at",
"description": "Emilio Pinna, Andrea Cardaci. (n.d.). gtfobins at. Retrieved September 28, 2021.",
"url": "https://gtfobins.github.io/gtfobins/at/"
},
{
"source_name": "Linux at",
"description": "IEEE/The Open Group. (2017). at(1p) \u2014 Linux manual page. Retrieved February 25, 2022.",
"url": "https://man7.org/linux/man-pages/man1/at.1p.html"
},
{
"source_name": "Twitter Leoloobeek Scheduled Task",
"description": "Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017.",
"url": "https://twitter.com/leoloobeek/status/939248813465853953"
},
{
"source_name": "Microsoft Scheduled Task Events Win10",
"description": "Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events"
},
{
"source_name": "TechNet Scheduled Task Events",
"description": "Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017.",
"url": "https://technet.microsoft.com/library/dd315590.aspx"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
},
{
"source_name": "TechNet Forum Scheduled Task Operational Setting",
"description": "Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017.",
"url": "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Command: Command Execution",
"Scheduled Job: Scheduled Job Creation",
"Network Traffic: Network Traffic Flow",
"Process: Process Creation",
"File: File Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\\System32\\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.\n\nConfigure event logging for scheduled task creation and changes by enabling the \"Microsoft-Windows-TaskScheduler/Operational\" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)\n\n* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered\n* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated\n* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted\n* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created\n* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled\n* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001), so additional logging may need to be configured to gather the appropriate data.\n\nIn Linux and macOS environments, monitor scheduled task creation using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc. \n\nReview all jobs using the atq command and ensure IP addresses stored in the SSH_CONNECTION and SSH_CLIENT variables, machines that created the jobs, are trusted hosts. All [at](https://attack.mitre.org/software/S0110) jobs are stored in /var/spool/cron/atjobs/.(Citation: rowland linux at 2019)\n\nSuspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for [Command and Control](https://attack.mitre.org/tactics/TA0011), learning details about the environment through [Discovery](https://attack.mitre.org/tactics/TA0007), and [Lateral Movement](https://attack.mitre.org/tactics/TA0008).",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_remote_support": true,
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-11-15 14:38:10.876000+00:00\", \"old_value\": \"2023-08-11 21:13:52.767000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.2\", \"old_value\": \"2.1\"}}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 2.2",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0003: Scheduled Job (Scheduled Job Creation)",
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Modification)",
"DS0029: Network Traffic (Network Traffic Flow)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-11-27 14:58:00.429000+00:00",
"modified": "2023-11-15 14:33:53.354000+00:00",
"name": "Scheduled Task",
"description": "Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.\n\nThe deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.\n\nAn adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)\n\nAdversaries may also create \"hidden\" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1053/005",
"external_id": "T1053.005"
},
{
"source_name": "ProofPoint Serpent",
"description": "Campbell, B. et al. (2022, March 21). Serpent, No Swiping! New Backdoor Targets French Entities with Unique Attack Chain. Retrieved April 11, 2022.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"
},
{
"source_name": "Defending Against Scheduled Task Attacks in Windows Environments",
"description": "Harshal Tupsamudre. (2022, June 20). Defending Against Scheduled Tasks. Retrieved July 5, 2022.",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments"
},
{
"source_name": "Twitter Leoloobeek Scheduled Task",
"description": "Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017.",
"url": "https://twitter.com/leoloobeek/status/939248813465853953"
},
{
"source_name": "Tarrask scheduled task",
"description": "Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.",
"url": "https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"
},
{
"source_name": "Microsoft Scheduled Task Events Win10",
"description": "Microsoft. (2017, May 28). Audit Other Object Access Events. Retrieved June 27, 2019.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events"
},
{
"source_name": "TechNet Scheduled Task Events",
"description": "Microsoft. (n.d.). General Task Registration. Retrieved December 12, 2017.",
"url": "https://technet.microsoft.com/library/dd315590.aspx"
},
{
"source_name": "TechNet Autoruns",
"description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
},
{
"source_name": "TechNet Forum Scheduled Task Operational Setting",
"description": "Satyajit321. (2015, November 3). Scheduled Tasks History Retention settings. Retrieved December 12, 2017.",
"url": "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen"
},
{
"source_name": "SigmaHQ",
"description": "Sittikorn S. (2022, April 15). Removal Of SD Value to Hide Schedule Task - Registry. Retrieved June 1, 2022.",
"url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Andrew Northern, @ex_raritas",
"Bryan Campbell, @bry_campbell",
"Zachary Abzug, @ZackDoesML",
"Selena Larson, @selenalarson",
"Sittikorn Sangrattanapitak"
],
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Creation",
"File: File Modification",
"File: File Creation",
"Process: Process Creation",
"Command: Command Execution",
"Network Traffic: Network Traffic Flow",
"Scheduled Job: Scheduled Job Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. (Citation: Twitter Leoloobeek Scheduled Task) If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete. Monitor Windows Task Scheduler stores in %systemroot%\\System32\\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles, etc.\n\nConfigure event logging for scheduled task creation and changes by enabling the \"Microsoft-Windows-TaskScheduler/Operational\" setting within the event logging service. (Citation: TechNet Forum Scheduled Task Operational Setting) Several events will then be logged on scheduled task activity, including: (Citation: TechNet Scheduled Task Events)(Citation: Microsoft Scheduled Task Events Win10)\n\n* Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered\n* Event ID 140 on Windows 7, Server 2008 R2 / 4702 on Windows 10, Server 2016 - Scheduled task updated\n* Event ID 141 on Windows 7, Server 2008 R2 / 4699 on Windows 10, Server 2016 - Scheduled task deleted\n* Event ID 4698 on Windows 10, Server 2016 - Scheduled task created\n* Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled\n* Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled\n\nTools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks. (Citation: TechNet Autoruns)\n\nRemote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities. Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_remote_support": true,
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-11-15 14:33:53.354000+00:00\", \"old_value\": \"2023-08-11 21:20:10.882000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1026: Privileged Account Management",
"M1028: Operating System Configuration",
"M1047: Audit"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0003: Scheduled Job (Scheduled Job Creation)",
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Creation)",
"DS0022: File (File Modification)",
"DS0024: Windows Registry (Windows Registry Key Creation)",
"DS0029: Network Traffic (Network Traffic Flow)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-12-13 16:46:18.927000+00:00",
"modified": "2024-04-16 12:45:06.434000+00:00",
"name": "Web Shell",
"description": "Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)\n\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1505/003",
"external_id": "T1505.003"
},
{
"source_name": "NSA Cyber Mitigating Web Shells",
"description": " NSA Cybersecurity Directorate. (n.d.). Mitigating Web Shells. Retrieved July 22, 2021.",
"url": "https://github.com/nsacyber/Mitigating-Web-Shells"
},
{
"source_name": "volexity_0day_sophos_FW",
"description": "Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.",
"url": "https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/"
},
{
"source_name": "Lee 2013",
"description": "Lee, T., Hanzlik, D., Ahl, I. (2013, August 7). Breaking Down the China Chopper Web Shell - Part I. Retrieved March 27, 2015.",
"url": "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html"
},
{
"source_name": "US-CERT Alert TA15-314A Web Shells",
"description": "US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.",
"url": "https://www.us-cert.gov/ncas/alerts/TA15-314A"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Arnim Rupp, Deutsche Lufthansa AG"
],
"x_mitre_data_sources": [
"Application Log: Application Log Content",
"Process: Process Creation",
"File: File Creation",
"Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow",
"File: File Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Web shells can be difficult to detect. Unlike other forms of persistent remote access, they do not initiate connections. The portion of the Web shell that is on the server may be small and innocuous looking. The PHP version of the China Chopper Web shell, for example, is the following short payload: (Citation: Lee 2013) \n\n<?php @eval($_POST['password']);>\n\nNevertheless, detection mechanisms exist. Process monitoring may be used to detect Web servers that perform suspicious actions such as spawning cmd.exe or accessing files that are not in the Web directory.(Citation: NSA Cyber Mitigating Web Shells)\n\nFile monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script.(Citation: NSA Cyber Mitigating Web Shells)\n\nLog authentication attempts to the server and any unusual traffic patterns to or from the server and internal network. (Citation: US-CERT Alert TA15-314A Web Shells)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS",
"Network"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"dictionary_item_removed\": {\"root['x_mitre_system_requirements']\": [\"Adversary access to Web server with vulnerability or account to upload and serve the Web shell file.\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:45:06.434000+00:00\", \"old_value\": \"2023-03-30 21:01:53.223000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)\\n\\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)\", \"old_value\": \"Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)\\n\\nIn addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)\\n+Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)\\n \\n In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (e.g. [China Chopper](https://attack.mitre.org/software/S0020) Web shell client).(Citation: Lee 2013)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may backdoor web servers with web shells to esta | t | 1 | Adversaries may backdoor web servers with web shells to esta |
| > | blish persistent access to systems. A Web shell is a Web scr | > | blish persistent access to systems. A Web shell is a Web scr | ||
| > | ipt that is placed on an openly accessible Web server to all | > | ipt that is placed on an openly accessible Web server to all | ||
| > | ow an adversary to use the Web server as a gateway into a ne | > | ow an adversary to access the Web server as a gateway into a | ||
| > | twork. A Web shell may provide a set of functions to execute | > | network. A Web shell may provide a set of functions to exec | ||
| > | or a command-line interface on the system that hosts the We | > | ute or a command-line interface on the system that hosts the | ||
| > | b server.(Citation: volexity_0day_sophos_FW) In addition to | > | Web server.(Citation: volexity_0day_sophos_FW) In addition | ||
| > | a server-side script, a Web shell may have a client interfa | > | to a server-side script, a Web shell may have a client inte | ||
| > | ce program that is used to talk to the Web server (e.g. [Chi | > | rface program that is used to talk to the Web server (e.g. [ | ||
| > | na Chopper](https://attack.mitre.org/software/S0020) Web she | > | China Chopper](https://attack.mitre.org/software/S0020) Web | ||
| > | ll client).(Citation: Lee 2013) | > | shell client).(Citation: Lee 2013) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of software and sof | t | 1 | Adversaries may attempt to get a listing of software and sof |
| > | tware versions that are installed on a system or in a cloud | > | tware versions that are installed on a system or in a cloud | ||
| > | environment. Adversaries may use the information from [Softw | > | environment. Adversaries may use the information from [Softw | ||
| > | are Discovery](https://attack.mitre.org/techniques/T1518) du | > | are Discovery](https://attack.mitre.org/techniques/T1518) du | ||
| > | ring automated discovery to shape follow-on behaviors, inclu | > | ring automated discovery to shape follow-on behaviors, inclu | ||
| > | ding whether or not the adversary fully infects the target a | > | ding whether or not the adversary fully infects the target a | ||
| > | nd/or attempts specific actions. Adversaries may attempt to | > | nd/or attempts specific actions. Such software may be deplo | ||
| > | enumerate software for a variety of reasons, such as figuri | > | yed widely across the environment for configuration manageme | ||
| > | ng out what security measures are present or if the compromi | > | nt or security reasons, such as [Software Deployment Tools]( | ||
| > | sed system has a version of software that is vulnerable to [ | > | https://attack.mitre.org/techniques/T1072), and may allow ad | ||
| > | Exploitation for Privilege Escalation](https://attack.mitre. | > | versaries broad access to infect devices or move laterally. | ||
| > | org/techniques/T1068). | > | Adversaries may attempt to enumerate software for a variety | ||
| > | of reasons, such as figuring out what security measures are | ||||
| > | present or if the compromised system has a version of softw | ||||
| > | are that is vulnerable to [Exploitation for Privilege Escala | ||||
| > | tion](https://attack.mitre.org/techniques/T1068). |
reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\n\nAdversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1518/001",
"external_id": "T1518.001"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Isif Ibrahima, Mandiant"
],
"x_mitre_data_sources": [
"Process: Process Creation",
"Firewall: Firewall Metadata",
"Command: Command Execution",
"Process: OS API Execution",
"Firewall: Firewall Enumeration"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nIn cloud environments, additionally monitor logs for the usage of APIs that may be used to gather information about security software configurations within the environment.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"IaaS",
"Linux",
"macOS"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 00:15:53.303000+00:00\", \"old_value\": \"2023-04-21 12:30:00.939000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nExample commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\\n\\nAdversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.\", \"old_value\": \"Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n\\nExample commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\\n\\nAdversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS) For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters. (Citation: DescribeSecurityGroups - Amazon Elastic Compute Cloud)\", \"diff\": \"--- \\n+++ \\n@@ -1,5 +1,5 @@\\n-Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n+Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\\n \\n Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), reg query with [Reg](https://attack.mitre.org/software/S0075), dir with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.\\n \\n-Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.(Citation: Expel IO Evil in AWS) For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters. (Citation: DescribeSecurityGroups - Amazon Elastic Compute Cloud)\\n+Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}, \"iterable_item_removed\": {\"root['external_references'][1]\": {\"source_name\": \"Expel IO Evil in AWS\", \"description\": \"A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020.\", \"url\": \"https://expel.io/blog/finding-evil-in-aws/\"}, \"root['external_references'][2]\": {\"source_name\": \"DescribeSecurityGroups - Amazon Elastic Compute Cloud\", \"description\": \"Amazon Web Services, Inc. . (2022). DescribeSecurityGroups. Retrieved January 28, 2022.\", \"url\": \"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html\"}, \"root['x_mitre_platforms'][1]\": \"Azure AD\", \"root['x_mitre_platforms'][2]\": \"Office 365\", \"root['x_mitre_platforms'][3]\": \"SaaS\", \"root['x_mitre_platforms'][7]\": \"Google Workspace\"}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of security softwar | t | 1 | Adversaries may attempt to get a listing of security softwar |
| > | e, configurations, defensive tools, and sensors that are ins | > | e, configurations, defensive tools, and sensors that are ins | ||
| > | talled on a system or in a cloud environment. This may inclu | > | talled on a system or in a cloud environment. This may inclu | ||
| > | de things such as firewall rules and anti-virus. Adversaries | > | de things such as cloud monitoring agents and anti-virus. Ad | ||
| > | may use the information from [Security Software Discovery]( | > | versaries may use the information from [Security Software Di | ||
| > | https://attack.mitre.org/techniques/T1518/001) during automa | > | scovery](https://attack.mitre.org/techniques/T1518/001) duri | ||
| > | ted discovery to shape follow-on behaviors, including whethe | > | ng automated discovery to shape follow-on behaviors, includi | ||
| > | r or not the adversary fully infects the target and/or attem | > | ng whether or not the adversary fully infects the target and | ||
| > | pts specific actions. Example commands that can be used to | > | /or attempts specific actions. Example commands that can be | ||
| > | obtain security software information are [netsh](https://att | > | used to obtain security software information are [netsh](ht | ||
| > | ack.mitre.org/software/S0108), <code>reg query</code> with [ | > | tps://attack.mitre.org/software/S0108), <code>reg query</cod | ||
| > | Reg](https://attack.mitre.org/software/S0075), <code>dir</co | > | e> with [Reg](https://attack.mitre.org/software/S0075), <cod | ||
| > | de> with [cmd](https://attack.mitre.org/software/S0106), and | > | e>dir</code> with [cmd](https://attack.mitre.org/software/S0 | ||
| > | [Tasklist](https://attack.mitre.org/software/S0057), but ot | > | 106), and [Tasklist](https://attack.mitre.org/software/S0057 | ||
| > | her indicators of discovery behavior may be more specific to | > | ), but other indicators of discovery behavior may be more sp | ||
| > | the type of software or security system the adversary is lo | > | ecific to the type of software or security system the advers | ||
| > | oking for. It is becoming more common to see macOS malware p | > | ary is looking for. It is becoming more common to see macOS | ||
| > | erform checks for LittleSnitch and KnockKnock software. Adv | > | malware perform checks for LittleSnitch and KnockKnock softw | ||
| > | ersaries may also utilize cloud APIs to discover the configu | > | are. Adversaries may also utilize the [Cloud API](https://a | ||
| > | rations of firewall rules within an environment.(Citation: E | > | ttack.mitre.org/techniques/T1059/009) to discover cloud-nati | ||
| > | xpel IO Evil in AWS) For example, the permitted IP ranges, p | > | ve security software installed on compute infrastructure, su | ||
| > | orts or user accounts for the inbound/outbound rules of secu | > | ch as the AWS CloudWatch agent, Azure VM Agent, and Google C | ||
| > | rity groups, virtual firewalls established within AWS for EC | > | loud Monitor agent. These agents may collect metrics and l | ||
| > | 2 and/or VPC instances, can be revealed by the <code>Describ | > | ogs from the VM, which may be centrally aggregated in a clou | ||
| > | eSecurityGroups</code> action with various request parameter | > | d-based monitoring platform. | ||
| > | s. (Citation: DescribeSecurityGroups - Amazon Elastic Comput | ||||
| > | e Cloud) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may put in place resources that are referenced b | t | 1 | Adversaries may put in place resources that are referenced b |
| > | y a link that can be used during targeting. An adversary may | > | y a link that can be used during targeting. An adversary may | ||
| > | rely upon a user clicking a malicious link in order to divu | > | rely upon a user clicking a malicious link in order to divu | ||
| > | lge information (including credentials) or to gain execution | > | lge information (including credentials) or to gain execution | ||
| > | , as in [Malicious Link](https://attack.mitre.org/techniques | > | , as in [Malicious Link](https://attack.mitre.org/techniques | ||
| > | /T1204/001). Links can be used for spearphishing, such as se | > | /T1204/001). Links can be used for spearphishing, such as se | ||
| > | nding an email accompanied by social engineering text to coa | > | nding an email accompanied by social engineering text to coa | ||
| > | x the user to actively click or copy and paste a URL into a | > | x the user to actively click or copy and paste a URL into a | ||
| > | browser. Prior to a phish for information (as in [Spearphish | > | browser. Prior to a phish for information (as in [Spearphish | ||
| > | ing Link](https://attack.mitre.org/techniques/T1598/003)) or | > | ing Link](https://attack.mitre.org/techniques/T1598/003)) or | ||
| > | a phish to gain initial access to a system (as in [Spearphi | > | a phish to gain initial access to a system (as in [Spearphi | ||
| > | shing Link](https://attack.mitre.org/techniques/T1566/002)), | > | shing Link](https://attack.mitre.org/techniques/T1566/002)), | ||
| > | an adversary must set up the resources for a link target fo | > | an adversary must set up the resources for a link target fo | ||
| > | r the spearphishing link. Typically, the resources for a l | > | r the spearphishing link. Typically, the resources for a l | ||
| > | ink target will be an HTML page that may include some client | > | ink target will be an HTML page that may include some client | ||
| > | -side script such as [JavaScript](https://attack.mitre.org/t | > | -side script such as [JavaScript](https://attack.mitre.org/t | ||
| > | echniques/T1059/007) to decide what content to serve to the | > | echniques/T1059/007) to decide what content to serve to the | ||
| > | user. Adversaries may clone legitimate sites to serve as the | > | user. Adversaries may clone legitimate sites to serve as the | ||
| > | link target, this can include cloning of login pages of leg | > | link target, this can include cloning of login pages of leg | ||
| > | itimate web services or organization login pages in an effor | > | itimate web services or organization login pages in an effor | ||
| > | t to harvest credentials during [Spearphishing Link](https:/ | > | t to harvest credentials during [Spearphishing Link](https:/ | ||
| > | /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby | > | /attack.mitre.org/techniques/T1598/003).(Citation: Malwareby | ||
| > | tes Silent Librarian October 2020)(Citation: Proofpoint TA40 | > | tes Silent Librarian October 2020)(Citation: Proofpoint TA40 | ||
| > | 7 September 2019) Adversaries may also [Upload Malware](http | > | 7 September 2019) Adversaries may also [Upload Malware](http | ||
| > | s://attack.mitre.org/techniques/T1608/001) and have the link | > | s://attack.mitre.org/techniques/T1608/001) and have the link | ||
| > | target point to malware for download/execution by the user. | > | target point to malware for download/execution by the user. | ||
| > | Adversaries may purchase domains similar to legitimate dom | > | Adversaries may purchase domains similar to legitimate dom | ||
| > | ains (ex: homoglyphs, typosquatting, different top-level dom | > | ains (ex: homoglyphs, typosquatting, different top-level dom | ||
| > | ain, etc.) during acquisition of infrastructure ([Domains](h | > | ain, etc.) during acquisition of infrastructure ([Domains](h | ||
| > | ttps://attack.mitre.org/techniques/T1583/001)) to help facil | > | ttps://attack.mitre.org/techniques/T1583/001)) to help facil | ||
| > | itate [Malicious Link](https://attack.mitre.org/techniques/T | > | itate [Malicious Link](https://attack.mitre.org/techniques/T | ||
| > | 1204/001). Link shortening services can also be employed. Ad | > | 1204/001). Links can be written by adversaries to mask the | ||
| > | versaries may also use free or paid accounts on Platform-as- | > | true destination in order to deceive victims by abusing the | ||
| > | a-Service providers to host link targets while taking advant | > | URL schema and increasing the effectiveness of phishing.(Cit | ||
| > | age of the widely trusted domains of those providers to avoi | > | ation: Kaspersky-masking)(Citation: mandiant-masking) Adver | ||
| > | d being blocked.(Citation: Netskope GCP Redirection)(Citatio | > | saries may also use free or paid accounts on link shortening | ||
| > | n: Netskope Cloud Phishing)(Citation: Intezer App Service Ph | > | services and Platform-as-a-Service providers to host link t | ||
| > | ishing) Finally, adversaries may take advantage of the decen | > | argets while taking advantage of the widely trusted domains | ||
| > | tralized nature of the InterPlanetary File System (IPFS) to | > | of those providers to avoid being blocked while redirecting | ||
| > | host link targets that are difficult to remove.(Citation: Ta | > | victims to malicious pages.(Citation: Netskope GCP Redirecti | ||
| > | los IPFS 2022) | > | on)(Citation: Netskope Cloud Phishing)(Citation: Intezer App | ||
| > | Service Phishing)(Citation: Cofense-redirect) In addition, | ||||
| > | adversaries may serve a variety of malicious links through u | ||||
| > | niquely generated URIs/URLs.(Citation: iOS URL Scheme)(Citat | ||||
| > | ion: URI)(Citation: URI Use)(Citation: URI Unique) Finally, | ||||
| > | adversaries may take advantage of the decentralized nature o | ||||
| > | f the InterPlanetary File System (IPFS) to host link targets | ||||
| > | that are difficult to remove.(Citation: Talos IPFS 2022) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries can steal application access tokens as a means o | t | 1 | Adversaries can steal application access tokens as a means o |
| > | f acquiring credentials to access remote systems and resourc | > | f acquiring credentials to access remote systems and resourc | ||
| > | es. Application access tokens are used to make authorized A | > | es. Application access tokens are used to make authorized A | ||
| > | PI requests on behalf of a user or service and are commonly | > | PI requests on behalf of a user or service and are commonly | ||
| > | used as a way to access resources in cloud and container-bas | > | used as a way to access resources in cloud and container-bas | ||
| > | ed applications and software-as-a-service (SaaS).(Citation: | > | ed applications and software-as-a-service (SaaS).(Citation: | ||
| > | Auth0 - Why You Should Always Use Access Tokens to Secure AP | > | Auth0 - Why You Should Always Use Access Tokens to Secure AP | ||
| > | Is Sept 2019) OAuth is one commonly implemented framework th | > | Is Sept 2019) Adversaries who steal account API tokens in c | ||
| > | at issues tokens to users for access to systems. Adversaries | > | loud and containerized environments may be able to access da | ||
| > | who steal account API tokens in cloud and containerized env | > | ta and perform actions with the permissions of these account | ||
| > | ironments may be able to access data and perform actions wit | > | s, which can lead to privilege escalation and further compro | ||
| > | h the permissions of these accounts, which can lead to privi | > | mise of the environment. For example, in Kubernetes environ | ||
| > | lege escalation and further compromise of the environment. | > | ments, processes running inside a container may communicate | ||
| > | In Kubernetes environments, processes running inside a conta | > | with the Kubernetes API server using service account tokens. | ||
| > | iner communicate with the Kubernetes API server using servic | > | If a container is compromised, an adversary may be able to | ||
| > | e account tokens. If a container is compromised, an attacker | > | steal the container\u2019s token and thereby gain access to Kuber | ||
| > | may be able to steal the container\u2019s token and thereby gain | > | netes API commands.(Citation: Kubernetes Service Accounts) | ||
| > | access to Kubernetes API commands.(Citation: Kubernetes Ser | > | Similarly, instances within continuous-development / continu | ||
| > | vice Accounts) Token theft can also occur through social en | > | ous-integration (CI/CD) pipelines will often use API tokens | ||
| > | gineering, in which case user action may be required to gran | > | to authenticate to other services for testing and deployment | ||
| > | t access. An application desiring access to cloud-based serv | > | .(Citation: Cider Security Top 10 CICD Security Risks) If th | ||
| > | ices or protected APIs can gain entry using OAuth 2.0 throug | > | ese pipelines are compromised, adversaries may be able to st | ||
| > | h a variety of authorization protocols. An example commonly- | > | eal these tokens and leverage their privileges. Token theft | ||
| > | used sequence is Microsoft's Authorization Code Grant flow.( | > | can also occur through social engineering, in which case us | ||
| > | Citation: Microsoft Identity Platform Protocols May 2019)(Ci | > | er action may be required to grant access. OAuth is one comm | ||
| > | tation: Microsoft - OAuth Code Authorization flow - June 201 | > | only implemented framework that issues tokens to users for a | ||
| > | 9) An OAuth access token enables a third-party application t | > | ccess to systems. An application desiring access to cloud-ba | ||
| > | o interact with resources containing user data in the ways r | > | sed services or protected APIs can gain entry using OAuth 2. | ||
| > | equested by the application without obtaining user credentia | > | 0 through a variety of authorization protocols. An example c | ||
| > | ls. Adversaries can leverage OAuth authorization by const | > | ommonly-used sequence is Microsoft's Authorization Code Gran | ||
| > | ructing a malicious application designed to be granted acces | > | t flow.(Citation: Microsoft Identity Platform Protocols May | ||
| > | s to resources with the target user's OAuth token.(Citation: | > | 2019)(Citation: Microsoft - OAuth Code Authorization flow - | ||
| > | Amnesty OAuth Phishing Attacks, August 2019)(Citation: Tren | > | June 2019) An OAuth access token enables a third-party appli | ||
| > | d Micro Pawn Storm OAuth 2017) The adversary will need to co | > | cation to interact with resources containing user data in th | ||
| > | mplete registration of their application with the authorizat | > | e ways requested by the application without obtaining user c | ||
| > | ion server, for example Microsoft Identity Platform using Az | > | redentials. Adversaries can leverage OAuth authorization | ||
| > | ure Portal, the Visual Studio IDE, the command-line interfac | > | by constructing a malicious application designed to be grant | ||
| > | e, PowerShell, or REST API calls.(Citation: Microsoft - Azur | > | ed access to resources with the target user's OAuth token.(C | ||
| > | e AD App Registration - May 2019) Then, they can send a [Spe | > | itation: Amnesty OAuth Phishing Attacks, August 2019)(Citati | ||
| > | arphishing Link](https://attack.mitre.org/techniques/T1566/0 | > | on: Trend Micro Pawn Storm OAuth 2017) The adversary will ne | ||
| > | 02) to the target user to entice them to grant access to the | > | ed to complete registration of their application with the au | ||
| > | application. Once the OAuth access token is granted, the ap | > | thorization server, for example Microsoft Identity Platform | ||
| > | plication can gain potentially long-term access to features | > | using Azure Portal, the Visual Studio IDE, the command-line | ||
| > | of the user account through [Application Access Token](https | > | interface, PowerShell, or REST API calls.(Citation: Microsof | ||
| > | ://attack.mitre.org/techniques/T1550/001).(Citation: Microso | > | t - Azure AD App Registration - May 2019) Then, they can sen | ||
| > | ft - Azure AD Identity Tokens - Aug 2019) Application acces | > | d a [Spearphishing Link](https://attack.mitre.org/techniques | ||
| > | s tokens may function within a limited lifetime, limiting ho | > | /T1566/002) to the target user to entice them to grant acces | ||
| > | w long an adversary can utilize the stolen token. However, i | > | s to the application. Once the OAuth access token is granted | ||
| > | n some cases, adversaries can also steal application refresh | > | , the application can gain potentially long-term access to f | ||
| > | tokens(Citation: Auth0 Understanding Refresh Tokens), allow | > | eatures of the user account through [Application Access Toke | ||
| > | ing them to obtain new access tokens without prompting the u | > | n](https://attack.mitre.org/techniques/T1550/001).(Citation: | ||
| > | ser. | > | Microsoft - Azure AD Identity Tokens - Aug 2019) Applicati | ||
| > | on access tokens may function within a limited lifetime, lim | ||||
| > | iting how long an adversary can utilize the stolen token. Ho | ||||
| > | wever, in some cases, adversaries can also steal application | ||||
| > | refresh tokens(Citation: Auth0 Understanding Refresh Tokens | ||||
| > | ), allowing them to obtain new access tokens without prompti | ||||
| > | ng the user. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may steal web application or service session co | t | 1 | An adversary may steal web application or service session co |
| > | okies and use them to gain access to web applications or Int | > | okies and use them to gain access to web applications or Int | ||
| > | ernet services as an authenticated user without needing cred | > | ernet services as an authenticated user without needing cred | ||
| > | entials. Web applications and services often use session coo | > | entials. Web applications and services often use session coo | ||
| > | kies as an authentication token after a user has authenticat | > | kies as an authentication token after a user has authenticat | ||
| > | ed to a website. Cookies are often valid for an extended pe | > | ed to a website. Cookies are often valid for an extended pe | ||
| > | riod of time, even if the web application is not actively us | > | riod of time, even if the web application is not actively us | ||
| > | ed. Cookies can be found on disk, in the process memory of t | > | ed. Cookies can be found on disk, in the process memory of t | ||
| > | he browser, and in network traffic to remote systems. Additi | > | he browser, and in network traffic to remote systems. Additi | ||
| > | onally, other applications on the targets machine might stor | > | onally, other applications on the targets machine might stor | ||
| > | e sensitive authentication cookies in memory (e.g. apps whic | > | e sensitive authentication cookies in memory (e.g. apps whic | ||
| > | h authenticate to cloud services). Session cookies can be us | > | h authenticate to cloud services). Session cookies can be us | ||
| > | ed to bypasses some multi-factor authentication protocols.(C | > | ed to bypasses some multi-factor authentication protocols.(C | ||
| > | itation: Pass The Cookie) There are several examples of mal | > | itation: Pass The Cookie) There are several examples of mal | ||
| > | ware targeting cookies from web browsers on the local system | > | ware targeting cookies from web browsers on the local system | ||
| > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | > | .(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 | ||
| > | Mac Crypto Cookies January 2019) There are also open source | > | Mac Crypto Cookies January 2019) Adversaries may also steal | ||
| > | frameworks such as `Evilginx2` and `Muraena` that can gathe | > | cookies by injecting malicious JavaScript content into webs | ||
| > | r session cookies through a malicious proxy (ex: [Adversary- | > | ites or relying on [User Execution](https://attack.mitre.org | ||
| > | in-the-Middle](https://attack.mitre.org/techniques/T1557)) t | > | /techniques/T1204) by tricking victims into running maliciou | ||
| > | hat can be set up by an adversary and used in phishing campa | > | s JavaScript in their browser.(Citation: Talos Roblox Scam 2 | ||
| > | igns.(Citation: Github evilginx2)(Citation: GitHub Mauraena) | > | 023)(Citation: Krebs Discord Bookmarks 2023) There are also | ||
| > | After an adversary acquires a valid cookie, they can then | > | open source frameworks such as `Evilginx2` and `Muraena` th | ||
| > | perform a [Web Session Cookie](https://attack.mitre.org/tech | > | at can gather session cookies through a malicious proxy (e.g | ||
| > | niques/T1550/004) technique to login to the corresponding we | > | ., [Adversary-in-the-Middle](https://attack.mitre.org/techni | ||
| > | b application. | > | ques/T1557)) that can be set up by an adversary and used in | ||
| > | phishing campaigns.(Citation: Github evilginx2)(Citation: Gi | ||||
| > | tHub Mauraena) After an adversary acquires a valid cookie, | ||||
| > | they can then perform a [Web Session Cookie](https://attack. | ||||
| > | mitre.org/techniques/T1550/004) technique to login to the co | ||||
| > | rresponding web application. |
klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)\n\nLinux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the \"ccache\". The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. Both files require root access to read. If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)\n\n\nKerberos tickets on macOS are stored in a standard ccache format, similar to Linux. By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)\n",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1558",
"external_id": "T1558"
},
{
"source_name": "CERT-EU Golden Ticket Protection",
"description": "Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.",
"url": "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf"
},
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"description": "Bani, M. (2018, February 23). Detecting Kerberoasting activity using Azure Security Center. Retrieved March 23, 2018.",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "Kekeo",
"description": "Benjamin Delpy. (n.d.). Kekeo. Retrieved October 4, 2021.",
"url": "https://github.com/gentilkiwi/kekeo"
},
{
"source_name": "SpectorOps Bifrost Kerberos macOS 2019",
"description": "Cody Thomas. (2019, November 14). When Kirbi walks the Bifrost. Retrieved October 6, 2021.",
"url": "https://posts.specterops.io/when-kirbi-walks-the-bifrost-4c727807744f"
},
{
"source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
"description": "French, D. (2018, October 2). Detecting Attempts to Steal Passwords from Memory. Retrieved October 11, 2019.",
"url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
},
{
"source_name": "Stealthbits Detect PtT 2019",
"description": "Jeff Warren. (2019, February 19). How to Detect Pass-the-Ticket Attacks. Retrieved February 27, 2020.",
"url": "https://blog.stealthbits.com/detect-pass-the-ticket-attacks"
},
{
"source_name": "macOS kerberos framework MIT",
"description": "Massachusetts Institute of Technology. (2007, October 27). Kerberos for Macintosh Preferences Documentation. Retrieved October 6, 2021.",
"url": "http://web.mit.edu/macdev/KfM/Common/Documentation/preferences.html"
},
{
"source_name": "MIT ccache",
"description": "Massachusetts Institute of Technology. (n.d.). MIT Kerberos Documentation: Credential Cache. Retrieved October 4, 2021.",
"url": "https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"description": "Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast \u2013 Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "ADSecurity Detecting Forged Tickets",
"description": "Metcalf, S. (2015, May 03). Detecting Forged Kerberos Ticket (Golden Ticket & Silver Ticket) Use in Active Directory. Retrieved December 23, 2015.",
"url": "https://adsecurity.org/?p=1515"
},
{
"source_name": "Microsoft Kerberos Golden Ticket",
"description": "Microsoft. (2015, March 24). Kerberos Golden Ticket Check (Updated). Retrieved February 27, 2020.",
"url": "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285"
},
{
"source_name": "Microsoft Klist",
"description": "Microsoft. (2021, March 3). klist. Retrieved October 14, 2021.",
"url": "https://docs.microsoft.com/windows-server/administration/windows-commands/klist"
},
{
"source_name": "ADSecurity Kerberos Ring Decoder",
"description": "Sean Metcalf. (2014, September 12). Kerberos, Active Directory\u2019s Secret Decoder Ring. Retrieved February 27, 2020.",
"url": "https://adsecurity.org/?p=227"
},
{
"source_name": "Brining MimiKatz to Unix",
"description": "Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.",
"url": "https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"
},
{
"source_name": "Linux Kerberos Tickets",
"description": "Trevor Haskell. (2020, April 1). Kerberos Tickets on Linux Red Teams. Retrieved October 4, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Tim (Wadhwa-)Brown",
"Cody Thomas, SpecterOps"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Logon Session: Logon Session Metadata",
"Active Directory: Active Directory Credential Request",
"File: File Access"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within ticket granting tickets (TGTs), and ticket granting service (TGS) requests without preceding TGT requests.(Citation: ADSecurity Detecting Forged Tickets)(Citation: Stealthbits Detect PtT 2019)(Citation: CERT-EU Golden Ticket Protection)\n\nMonitor the lifetime of TGT tickets for values that differ from the default domain duration.(Citation: Microsoft Kerberos Golden Ticket)\n\nMonitor for indications of [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) being used to move laterally. \n\nEnable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests. Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).(Citation: Microsoft Detecting Kerberoasting Feb 2018) (Citation: AdSecurity Cracking Kerberos Dec 2015)\n\nMonitor for unexpected processes interacting with lsass.exe.(Citation: Medium Detecting Attempts to Steal Passwords from Memory) Common credential dumpers such as [Mimikatz](https://attack.mitre.org/software/S0002) access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details, including Kerberos tickets, are stored.\n\nMonitor for unusual processes accessing\u00a0secrets.ldb and .secrets.mkey located in /var/lib/sss/secrets/.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_system_requirements": [
"Kerberos authentication enabled"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"dictionary_item_removed\": {\"root['x_mitre_permissions_required']\": [\"User\", \"root\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 16:58:02.395000+00:00\", \"old_value\": \"2023-03-30 21:01:50.214000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.5\", \"old_value\": \"1.4\"}}}",
"previous_version": "1.4",
"version_change": "1.4 \u2192 1.5",
"changelog_mitigations": {
"shared": [
"M1015: Active Directory Configuration",
"M1026: Privileged Account Management",
"M1027: Password Policies",
"M1041: Encrypt Sensitive Information"
],
"new": [
"M1047: Audit"
],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0017: Command (Command Execution)",
"DS0022: File (File Access)",
"DS0026: Active Directory (Active Directory Credential Request)",
"DS0028: Logon Session (Logon Session Metadata)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-05 14:54:07.588000+00:00",
"modified": "2024-03-01 17:17:37.292000+00:00",
"name": "Subvert Trust Controls",
"description": "Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.\n\nAdversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1553",
"external_id": "T1553"
},
{
"source_name": "SpectorOps Code Signing Dec 2017",
"description": "Graeber, M. (2017, December 22). Code Signing Certificate Cloning Attacks and Defenses. Retrieved April 3, 2018.",
"url": "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec"
},
{
"source_name": "SpectorOps Subverting Trust Sept 2017",
"description": "Graeber, M. (2017, September). Subverting Trust in Windows. Retrieved January 31, 2018.",
"url": "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf"
},
{
"source_name": "Securelist Digital Certificates",
"description": "Ladikov, A. (2015, January 29). Why You Shouldn\u2019t Completely Trust Files Signed with Digital Certificates. Retrieved March 31, 2016.",
"url": "https://securelist.com/why-you-shouldnt-completely-trust-files-signed-with-digital-certificates/68593/"
},
{
"source_name": "Symantec Digital Certificates",
"description": "Shinotsuka, H. (2013, February 22). How Attackers Steal Private Keys from Digital Certificates. Retrieved March 31, 2016.",
"url": "http://www.symantec.com/connect/blogs/how-attackers-steal-private-keys-digital-certificates"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Module: Module Load",
"Windows Registry: Windows Registry Key Creation",
"File: File Metadata",
"Command: Command Execution",
"Process: Process Creation",
"File: File Modification",
"Windows Registry: Windows Registry Key Modification"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Autoruns Analysis",
"Digital Certificate Validation",
"User Mode Signature Validation",
"Windows User Account Control",
"Application Control"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers. Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries. (Citation: SpectorOps Subverting Trust Sept 2017) A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.(Citation: SpectorOps Code Signing Dec 2017)\n\nAnalyze Autoruns data for oddities and anomalies, specifically malicious files attempting persistent execution by hiding within auto-starting locations. Autoruns will hide entries signed by Microsoft or Windows by default, so ensure \"Hide Microsoft Entries\" and \"Hide Windows Entries\" are both deselected.(Citation: SpectorOps Subverting Trust Sept 2017) \n\nMonitor and investigate attempts to modify extended file attributes with utilities such as xattr. Built-in system utilities may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 17:17:37.292000+00:00\", \"old_value\": \"2022-05-05 05:04:52.387000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1024: Restrict Registry Permissions",
"M1028: Operating System Configuration",
"M1038: Execution Prevention",
"M1054: Software Configuration"
],
"new": [
"M1026: Privileged Account Management"
],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0011: Module (Module Load)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Metadata)",
"DS0022: File (File Modification)",
"DS0024: Windows Registry (Windows Registry Key Creation)",
"DS0024: Windows Registry (Windows Registry Key Modification)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--3f18edba-28f4-4bb9-82c3-8aa60dcac5f7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2024-02-26 14:23:37.009000+00:00",
"name": "Supply Chain Compromise",
"description": "Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update/distribution mechanisms\n* Compromised/infected system images (multiple cases of removable media infected at the factory)(Citation: IBM Storwize)(Citation: Schneider Electric USB Malware) \n* Replacement of legitimate software with modified versions\n* Sales of modified/counterfeit products to legitimate distributors\n* Shipment interdiction\n\nWhile supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.(Citation: Avast CCleaner3 2018)(Citation: Microsoft Dofoil 2018)(Citation: Command Five SK 2011) Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Symantec Elderwood Sept 2012)(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1195",
"external_id": "T1195"
},
{
"source_name": "Avast CCleaner3 2018",
"description": "Avast Threat Intelligence Team. (2018, March 8). New investigations into the CCleaner incident point to a possible third stage that had keylogger capacities. Retrieved March 15, 2018.",
"url": "https://blog.avast.com/new-investigations-in-ccleaner-incident-point-to-a-possible-third-stage-that-had-keylogger-capacities"
},
{
"source_name": "Command Five SK 2011",
"description": "Command Five Pty Ltd. (2011, September). SK Hack by an Advanced Persistent Threat. Retrieved April 6, 2018.",
"url": "https://www.commandfive.com/papers/C5_APT_SKHack.pdf"
},
{
"source_name": "IBM Storwize",
"description": "IBM Support. (2017, April 26). Storwize USB Initialization Tool may contain malicious code. Retrieved May 28, 2019.",
"url": "https://www-01.ibm.com/support/docview.wss?uid=ssg1S1010146&myns=s028&mynp=OCSTHGUJ&mynp=OCSTLM5A&mynp=OCSTLM6B&mynp=OCHW206&mync=E&cm_sp=s028-_-OCSTHGUJ-OCSTLM5A-OCSTLM6B-OCHW206-_-E"
},
{
"source_name": "Symantec Elderwood Sept 2012",
"description": "O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.",
"url": "https://web.archive.org/web/20190717233006/http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
},
{
"source_name": "Schneider Electric USB Malware",
"description": "Schneider Electric. (2018, August 24). Security Notification \u2013 USB Removable Media Provided With Conext Combox and Conext Battery Monitor. Retrieved May 28, 2019.",
"url": "https://www.se.com/ww/en/download/document/SESN-2018-236-01/"
},
{
"source_name": "Trendmicro NPM Compromise",
"description": "Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019.",
"url": "https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets"
},
{
"source_name": "Microsoft Dofoil 2018",
"description": "Windows Defender Research. (2018, March 7). Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign. Retrieved March 20, 2018.",
"url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Veeral Patel"
],
"x_mitre_data_sources": [
"Sensor Health: Host Status",
"File: File Metadata"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. Perform physical inspection of hardware to look for potential tampering.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-26 14:23:37.009000+00:00\", \"old_value\": \"2023-03-30 21:01:42.446000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.6\", \"old_value\": \"1.5\"}}}",
"previous_version": "1.5",
"version_change": "1.5 \u2192 1.6",
"changelog_mitigations": {
"shared": [
"M1016: Vulnerability Scanning",
"M1051: Update Software"
],
"new": [
"M1013: Application Developer Guidance",
"M1033: Limit Software Installation",
"M1046: Boot Integrity"
],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0013: Sensor Health (Host Status)",
"DS0022: File (File Metadata)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-11 14:13:42.916000+00:00",
"modified": "2024-04-13 14:47:31.204000+00:00",
"name": "Compromise Software Dependencies and Development Tools",
"description": "Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise) \n\nTargeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1195/001",
"external_id": "T1195.001"
},
{
"source_name": "Trendmicro NPM Compromise",
"description": "Trendmicro. (2018, November 29). Hacker Infects Node.js Package to Steal from Bitcoin Wallets. Retrieved April 10, 2019.",
"url": "https://www.trendmicro.com/vinfo/dk/security/news/cybercrime-and-digital-threats/hacker-infects-node-js-package-to-steal-from-bitcoin-wallets"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"File: File Metadata"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-13 14:47:31.204000+00:00\", \"old_value\": \"2022-04-28 16:03:59.172000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2",
"changelog_mitigations": {
"shared": [
"M1016: Vulnerability Scanning",
"M1051: Update Software"
],
"new": [
"M1013: Application Developer Guidance",
"M1033: Limit Software Installation"
],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0022: File (File Metadata)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-04-18 17:59:24.739000+00:00",
"modified": "2024-03-01 16:25:43.150000+00:00",
"name": "System Binary Proxy Execution",
"description": "Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.(Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.\n\nSimilarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.(Citation: split man page)(Citation: GTFO split)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1218",
"external_id": "T1218"
},
{
"source_name": "GTFO split",
"description": "GTFOBins. (2020, November 13). split. Retrieved April 18, 2022.",
"url": "https://gtfobins.github.io/gtfobins/split/"
},
{
"source_name": "LOLBAS Project",
"description": "Oddvar Moe et al. (2022, February). Living Off The Land Binaries, Scripts and Libraries. Retrieved March 7, 2022.",
"url": "https://github.com/LOLBAS-Project/LOLBAS#criteria"
},
{
"source_name": "split man page",
"description": "Torbjorn Granlund, Richard M. Stallman. (2020, March null). split(1) \u2014 Linux manual page. Retrieved March 25, 2022.",
"url": "https://man7.org/linux/man-pages/man1/split.1.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Nishan Maharjan, @loki248",
"Hans Christoffer Gaardl\u00f8s",
"Praetorian",
"Wes Hurd"
],
"x_mitre_data_sources": [
"Network Traffic: Network Connection Creation",
"Windows Registry: Windows Registry Key Modification",
"Module: Module Load",
"File: File Creation",
"Process: OS API Execution",
"Process: Process Creation",
"Command: Command Execution"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Application control",
"Digital Certificate Validation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files. Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity. Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion. Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.\n\nMonitor for file activity (creations, downloads, modifications, etc.), especially for file types that are not typical within an environment and may be indicative of adversary activity.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-03-01 16:25:43.150000+00:00\", \"old_value\": \"2022-04-18 14:52:08.678000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.1\", \"old_value\": \"3.0\"}}}",
"previous_version": "3.0",
"version_change": "3.0 \u2192 3.1",
"changelog_mitigations": {
"shared": [
"M1026: Privileged Account Management",
"M1038: Execution Prevention",
"M1042: Disable or Remove Feature or Program",
"M1050: Exploit Protection"
],
"new": [
"M1021: Restrict Web-Based Content",
"M1037: Filter Network Traffic"
],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (OS API Execution)",
"DS0009: Process (Process Creation)",
"DS0011: Module (Module Load)",
"DS0017: Command (Command Execution)",
"DS0022: File (File Creation)",
"DS0024: Windows Registry (Windows Registry Key Modification)",
"DS0029: Network Traffic (Network Connection Creation)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:31:37.450000+00:00",
"modified": "2024-04-16 12:50:15.929000+00:00",
"name": "System Time Discovery",
"description": "An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)\n\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)\n\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)\n\nIn addition, system calls \u2013 such as time() \u2013 have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)\n\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1124",
"external_id": "T1124"
},
{
"source_name": "systemsetup mac time",
"description": "Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.",
"url": "https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac"
},
{
"source_name": "linux system time",
"description": "ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.",
"url": "https://wiki.archlinux.org/title/System_time"
},
{
"source_name": "MAGNET GOBLIN",
"description": "Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.",
"url": "https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/"
},
{
"source_name": "show_clock_detail_cisco_cmd",
"description": "Cisco. (2023, March 6). show clock detail - Cisco IOS Security Command Reference: Commands S to Z . Retrieved July 13, 2022.",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1896741674"
},
{
"source_name": "Mac Time Sync",
"description": "Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.",
"url": "https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/"
},
{
"source_name": "ESET DazzleSpy Jan 2022",
"description": "M.L\u00e9veill\u00e9, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.",
"url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
},
{
"source_name": "AnyRun TimeBomb",
"description": "Malicious History. (2020, September 17). Time Bombs: Malware With Delayed Execution. Retrieved April 22, 2021.",
"url": "https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/"
},
{
"source_name": "Technet Windows Time Service",
"description": "Mathers, B. (2016, September 30). Windows Time Service Tools and Settings. Retrieved November 25, 2016.",
"url": "https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings"
},
{
"source_name": "MSDN System Time",
"description": "Microsoft. (n.d.). System Time. Retrieved November 25, 2016.",
"url": "https://msdn.microsoft.com/ms724961.aspx"
},
{
"source_name": "RSA EU12 They're Inside",
"description": "Rivner, U., Schwartz, E. (2012). They\u2019re Inside\u2026 Now What?. Retrieved November 25, 2016.",
"url": "https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf"
},
{
"source_name": "System Information Discovery Technique",
"description": "YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). The System Information Discovery Technique Explained - MITRE ATT&CK T1082. Retrieved March 27, 2024.",
"url": "https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082"
},
{
"source_name": "Virtualization/Sandbox Evasion",
"description": "YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). Virtualization/Sandbox Evasion - How Attackers Avoid Malware Analysis. Retrieved December 26, 2023.",
"url": "https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"FIRST.ORG's Cyber Threat Intelligence SIG",
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Process: OS API Execution",
"Command: Command Execution",
"Process: Process Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone. Methods of detecting API use for gathering this information are likely less useful due to how often they may be used by legitimate software.\n\nFor network infrastructure devices, collect AAA logging to monitor `show` commands being run by non-standard users from non-standard locations.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Network",
"Linux",
"macOS"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-16 12:50:15.929000+00:00\", \"old_value\": \"2023-04-12 23:37:22.508000+00:00\"}, \"root['description']\": {\"new_value\": \"An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)\\n\\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\\\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)\\n\\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)\\n\\nIn addition, system calls \\u2013 such as time() \\u2013 have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)\\n\\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)\", \"old_value\": \"An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time)(Citation: Technet Windows Time Service)\\n\\nSystem time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\\\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service)\\n\\nOn network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)\\n\\nThis information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)\", \"diff\": \"--- \\n+++ \\n@@ -1,7 +1,9 @@\\n-An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. (Citation: MSDN System Time)(Citation: Technet Windows Time Service)\\n+An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)\\n \\n-System time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\\\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service)\\n+System time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing net time \\\\\\\\hostname to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as GetTickCount() to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion)\\n \\n On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd)\\n \\n+In addition, system calls \\u2013 such as time() \\u2013 have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as systemsetup -gettimezone or timeIntervalSinceNow to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022)\\n+\\n This information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)(Citation: RSA EU12 They're Inside), or to discover locality information based on time zone to assist in victim targeting (i.e. [System Location Discovery](https://attack.mitre.org/techniques/T1614)). Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.(Citation: AnyRun TimeBomb)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"systemsetup mac time\", \"description\": \"Apple Support. (n.d.). About systemsetup in Remote Desktop. Retrieved March 27, 2024.\", \"url\": \"https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac\"}, \"root['external_references'][2]\": {\"source_name\": \"linux system time\", \"description\": \"ArchLinux. (2024, February 1). System Time. Retrieved March 27, 2024.\", \"url\": \"https://wiki.archlinux.org/title/System_time\"}, \"root['external_references'][3]\": {\"source_name\": \"MAGNET GOBLIN\", \"description\": \"Check Point Research. (2024, March 8). MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES. Retrieved March 27, 2024.\", \"url\": \"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\"}, \"root['external_references'][5]\": {\"source_name\": \"Mac Time Sync\", \"description\": \"Cone, Matt. (2021, January 14). Synchronize your Mac's Clock with a Time Server. Retrieved March 27, 2024.\", \"url\": \"https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/\"}, \"root['external_references'][6]\": {\"source_name\": \"ESET DazzleSpy Jan 2022\", \"description\": \"M.L\\u00e9veill\\u00e9, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.\", \"url\": \"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/\"}, \"root['external_references'][11]\": {\"source_name\": \"System Information Discovery Technique\", \"description\": \"YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). The System Information Discovery Technique Explained - MITRE ATT&CK T1082. Retrieved March 27, 2024.\", \"url\": \"https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082\"}, \"root['external_references'][12]\": {\"source_name\": \"Virtualization/Sandbox Evasion\", \"description\": \"YUCEEL, Huseyin Can. Picus Labs. (2022, June 9). Virtualization/Sandbox Evasion - How Attackers Avoid Malware Analysis. Retrieved December 26, 2023.\", \"url\": \"https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis\"}, \"root['x_mitre_platforms'][2]\": \"Linux\", \"root['x_mitre_platforms'][3]\": \"macOS\"}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may gather the system time and/or time zone fro | t | 1 | An adversary may gather the system time and/or time zone set |
| > | m a local or remote system. The system time is set and store | > | tings from a local or remote system. The system time is set | ||
| > | d by the Windows Time Service within a domain to maintain ti | > | and stored by services, such as the Windows Time Service on | ||
| > | me synchronization between systems and services in an enterp | > | Windows or <code>systemsetup</code> on macOS.(Citation: MSDN | ||
| > | rise network. (Citation: MSDN System Time)(Citation: Technet | > | System Time)(Citation: Technet Windows Time Service)(Citati | ||
| > | Windows Time Service) System time information may be gathe | > | on: systemsetup mac time) These time settings may also be sy | ||
| > | red in a number of ways, such as with [Net](https://attack.m | > | nchronized between systems and services in an enterprise net | ||
| > | itre.org/software/S0039) on Windows by performing <code>net | > | work, typically accomplished with a network time server with | ||
| > | time \\\\hostname</code> to gather the system time on a remote | > | in a domain.(Citation: Mac Time Sync)(Citation: linux system | ||
| > | system. The victim's time zone may also be inferred from th | > | time) System time information may be gathered in a number | ||
| > | e current system time or gathered by using <code>w32tm /tz</ | > | of ways, such as with [Net](https://attack.mitre.org/softwar | ||
| > | code>.(Citation: Technet Windows Time Service) On network d | > | e/S0039) on Windows by performing <code>net time \\\\hostname< | ||
| > | evices, [Network Device CLI](https://attack.mitre.org/techni | > | /code> to gather the system time on a remote system. The vic | ||
| > | ques/T1059/008) commands such as `show clock detail` can be | > | tim's time zone may also be inferred from the current system | ||
| > | used to see the current time configuration.(Citation: show_c | > | time or gathered by using <code>w32tm /tz</code>.(Citation: | ||
| > | lock_detail_cisco_cmd) This information could be useful for | > | Technet Windows Time Service) In addition, adversaries can | ||
| > | performing other techniques, such as executing a file with | > | discover device uptime through functions such as <code>GetTi | ||
| > | a [Scheduled Task/Job](https://attack.mitre.org/techniques/T | > | ckCount()</code> to determine how long it has been since the | ||
| > | 1053)(Citation: RSA EU12 They're Inside), or to discover loc | > | system booted up.(Citation: Virtualization/Sandbox Evasion) | ||
| > | ality information based on time zone to assist in victim tar | > | On network devices, [Network Device CLI](https://attack.mi | ||
| > | geting (i.e. [System Location Discovery](https://attack.mitr | > | tre.org/techniques/T1059/008) commands such as `show clock d | ||
| > | e.org/techniques/T1614)). Adversaries may also use knowledge | > | etail` can be used to see the current time configuration.(Ci | ||
| > | of system time as part of a time bomb, or delaying executio | > | tation: show_clock_detail_cisco_cmd) In addition, system ca | ||
| > | n until a specified date/time.(Citation: AnyRun TimeBomb) | > | lls \u2013 such as <code>time()</code> \u2013 have been used to collec | ||
| > | t the current time on Linux devices.(Citation: MAGNET GOBLIN | ||||
| > | ) On macOS systems, adversaries may use commands such as <co | ||||
| > | de>systemsetup -gettimezone</code> or <code>timeIntervalSinc | ||||
| > | eNow</code> to gather current time zone information or curre | ||||
| > | nt date and time.(Citation: System Information Discovery Tec | ||||
| > | hnique)(Citation: ESET DazzleSpy Jan 2022) This information | ||||
| > | could be useful for performing other techniques, such as ex | ||||
| > | ecuting a file with a [Scheduled Task/Job](https://attack.mi | ||||
| > | tre.org/techniques/T1053)(Citation: RSA EU12 They're Inside) | ||||
| > | , or to discover locality information based on time zone to | ||||
| > | assist in victim targeting (i.e. [System Location Discovery] | ||||
| > | (https://attack.mitre.org/techniques/T1614)). Adversaries ma | ||||
| > | y also use knowledge of system time as part of a time bomb, | ||||
| > | or delaying execution until a specified date/time.(Citation: | ||||
| > | AnyRun TimeBomb) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data by transferring the data, in | t | 1 | Adversaries may exfiltrate data by transferring the data, in |
| > | cluding backups of cloud environments, to another cloud acco | > | cluding through sharing/syncing and creating backups of clou | ||
| > | unt they control on the same service to avoid typical file t | > | d environments, to another cloud account they control on the | ||
| > | ransfers/downloads and network-based exfiltration detection. | > | same service. A defender who is monitoring for large trans | ||
| > | A defender who is monitoring for large transfers to outsid | > | fers to outside the cloud environment through normal file tr | ||
| > | e the cloud environment through normal file transfers or ove | > | ansfers or over command and control channels may not be watc | ||
| > | r command and control channels may not be watching for data | > | hing for data transfers to another account within the same c | ||
| > | transfers to another account within the same cloud provider. | > | loud provider. Such transfers may utilize existing cloud pro | ||
| > | Such transfers may utilize existing cloud provider APIs and | > | vider APIs and the internal address space of the cloud provi | ||
| > | the internal address space of the cloud provider to blend i | > | der to blend into normal traffic or avoid data transfers ove | ||
| > | nto normal traffic or avoid data transfers over external net | > | r external network interfaces.(Citation: TLDRSec AWS Attacks | ||
| > | work interfaces. Incidents have been observed where adversa | > | ) Adversaries may also use cloud-native mechanisms to share | ||
| > | ries have created backups of cloud instances and transferred | > | victim data with adversary-controlled cloud accounts, such | ||
| > | them to separate accounts.(Citation: DOJ GRU Indictment Jul | > | as creating anonymous file sharing links or, in Azure, a sha | ||
| > | 2018) | > | red access signature (SAS) URI.(Citation: Microsoft Azure St | ||
| > | orage Shared Access Signature) Incidents have been observed | ||||
| > | where adversaries have created backups of cloud instances a | ||||
| > | nd transferred them to separate accounts.(Citation: DOJ GRU | ||||
| > | Indictment Jul 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may rely upon specific actions by a user in ord | t | 1 | An adversary may rely upon specific actions by a user in ord |
| > | er to gain execution. Users may be subjected to social engin | > | er to gain execution. Users may be subjected to social engin | ||
| > | eering to get them to execute malicious code by, for example | > | eering to get them to execute malicious code by, for example | ||
| > | , opening a malicious document file or link. These user acti | > | , opening a malicious document file or link. These user acti | ||
| > | ons will typically be observed as follow-on behavior from fo | > | ons will typically be observed as follow-on behavior from fo | ||
| > | rms of [Phishing](https://attack.mitre.org/techniques/T1566) | > | rms of [Phishing](https://attack.mitre.org/techniques/T1566) | ||
| > | . While [User Execution](https://attack.mitre.org/technique | > | . While [User Execution](https://attack.mitre.org/technique | ||
| > | s/T1204) frequently occurs shortly after Initial Access it m | > | s/T1204) frequently occurs shortly after Initial Access it m | ||
| > | ay occur at other phases of an intrusion, such as when an ad | > | ay occur at other phases of an intrusion, such as when an ad | ||
| > | versary places a file in a shared directory or on a user's d | > | versary places a file in a shared directory or on a user's d | ||
| > | esktop hoping that a user will click on it. This activity ma | > | esktop hoping that a user will click on it. This activity ma | ||
| > | y also be seen shortly after [Internal Spearphishing](https: | > | y also be seen shortly after [Internal Spearphishing](https: | ||
| > | //attack.mitre.org/techniques/T1534). Adversaries may also | > | //attack.mitre.org/techniques/T1534). Adversaries may also | ||
| > | deceive users into performing actions such as enabling [Remo | > | deceive users into performing actions such as enabling [Remo | ||
| > | te Access Software](https://attack.mitre.org/techniques/T121 | > | te Access Software](https://attack.mitre.org/techniques/T121 | ||
| > | 9), allowing direct control of the system to the adversary, | > | 9), allowing direct control of the system to the adversary; | ||
| > | or downloading and executing malware for [User Execution](ht | > | running malicious JavaScript in their browser, allowing adve | ||
| > | tps://attack.mitre.org/techniques/T1204). For example, tech | > | rsaries to [Steal Web Session Cookie](https://attack.mitre.o | ||
| > | support scams can be facilitated through [Phishing](https:// | > | rg/techniques/T1539)s; or downloading and executing malware | ||
| > | attack.mitre.org/techniques/T1566), vishing, or various form | > | for [User Execution](https://attack.mitre.org/techniques/T12 | ||
| > | s of user interaction. Adversaries can use a combination of | > | 04).(Citation: Talos Roblox Scam 2023)(Citation: Krebs Disco | ||
| > | these methods, such as spoofing and promoting toll-free numb | > | rd Bookmarks 2023) For example, tech support scams can be f | ||
| > | ers or call centers that are used to direct victims to malic | > | acilitated through [Phishing](https://attack.mitre.org/techn | ||
| > | ious websites, to deliver and execute payloads containing ma | > | iques/T1566), vishing, or various forms of user interaction. | ||
| > | lware or [Remote Access Software](https://attack.mitre.org/t | > | Adversaries can use a combination of these methods, such as | ||
| > | echniques/T1219).(Citation: Telephone Attack Delivery) | > | spoofing and promoting toll-free numbers or call centers th | ||
| > | at are used to direct victims to malicious websites, to deli | ||||
| > | ver and execute payloads containing malware or [Remote Acces | ||||
| > | s Software](https://attack.mitre.org/techniques/T1219).(Cita | ||||
| > | tion: Telephone Attack Delivery) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Valid accounts in cloud environments may allow adversaries t | t | 1 | Valid accounts in cloud environments may allow adversaries t |
| > | o perform actions to achieve Initial Access, Persistence, Pr | > | o perform actions to achieve Initial Access, Persistence, Pr | ||
| > | ivilege Escalation, or Defense Evasion. Cloud accounts are t | > | ivilege Escalation, or Defense Evasion. Cloud accounts are t | ||
| > | hose created and configured by an organization for use by us | > | hose created and configured by an organization for use by us | ||
| > | ers, remote support, services, or for administration of reso | > | ers, remote support, services, or for administration of reso | ||
| > | urces within a cloud service provider or SaaS application. C | > | urces within a cloud service provider or SaaS application. C | ||
| > | loud Accounts can exist solely in the cloud or be hybrid joi | > | loud Accounts can exist solely in the cloud; alternatively, | ||
| > | ned between on-premises systems and the cloud through federa | > | they may be hybrid-joined between on-premises systems and th | ||
| > | tion with other identity sources such as Windows Active Dire | > | e cloud through syncing or federation with other identity so | ||
| > | ctory. (Citation: AWS Identity Federation)(Citation: Google | > | urces such as Windows Active Directory. (Citation: AWS Ident | ||
| > | Federating GC)(Citation: Microsoft Deploying AD Federation) | > | ity Federation)(Citation: Google Federating GC)(Citation: Mi | ||
| > | Service or user accounts may be targeted by adversaries thr | > | crosoft Deploying AD Federation) Service or user accounts m | ||
| > | ough [Brute Force](https://attack.mitre.org/techniques/T1110 | > | ay be targeted by adversaries through [Brute Force](https:// | ||
| > | ), [Phishing](https://attack.mitre.org/techniques/T1566), or | > | attack.mitre.org/techniques/T1110), [Phishing](https://attac | ||
| > | various other means to gain access to the environment. Fede | > | k.mitre.org/techniques/T1566), or various other means to gai | ||
| > | rated accounts may be a pathway for the adversary to affect | > | n access to the environment. Federated or synced accounts ma | ||
| > | both on-premises systems and cloud environments. An adversa | > | y be a pathway for the adversary to affect both on-premises | ||
| > | ry may create long lasting [Additional Cloud Credentials](ht | > | systems and cloud environments - for example, by leveraging | ||
| > | tps://attack.mitre.org/techniques/T1098/001) on a compromise | > | shared credentials to log onto [Remote Services](https://att | ||
| > | d cloud account to maintain persistence in the environment. | > | ack.mitre.org/techniques/T1021). High privileged cloud accou | ||
| > | Such credentials may also be used to bypass security control | > | nts, whether federated, synced, or cloud-only, may also allo | ||
| > | s such as multi-factor authentication. Cloud accounts may | > | w pivoting to on-premises environments by leveraging SaaS-ba | ||
| > | also be able to assume [Temporary Elevated Cloud Access](htt | > | sed [Software Deployment Tools](https://attack.mitre.org/tec | ||
| > | ps://attack.mitre.org/techniques/T1548/005) or other privile | > | hniques/T1072) to run commands on hybrid-joined devices. An | ||
| > | ges through various means within the environment. Misconfigu | > | adversary may create long lasting [Additional Cloud Credent | ||
| > | rations in role assignments or role assumption policies may | > | ials](https://attack.mitre.org/techniques/T1098/001) on a co | ||
| > | allow an adversary to use these mechanisms to leverage permi | > | mpromised cloud account to maintain persistence in the envir | ||
| > | ssions outside the intended scope of the account. Such over | > | onment. Such credentials may also be used to bypass security | ||
| > | privileged accounts may be used to harvest sensitive data fr | > | controls such as multi-factor authentication. Cloud accou | ||
| > | om online storage accounts and databases through [Cloud API] | > | nts may also be able to assume [Temporary Elevated Cloud Acc | ||
| > | (https://attack.mitre.org/techniques/T1059/009) or other met | > | ess](https://attack.mitre.org/techniques/T1548/005) or other | ||
| > | hods. | > | privileges through various means within the environment. Mi | ||
| > | sconfigurations in role assignments or role assumption polic | ||||
| > | ies may allow an adversary to use these mechanisms to levera | ||||
| > | ge permissions outside the intended scope of the account. Su | ||||
| > | ch over privileged accounts may be used to harvest sensitive | ||||
| > | data from online storage accounts and databases through [Cl | ||||
| > | oud API](https://attack.mitre.org/techniques/T1059/009) or o | ||||
| > | ther methods. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may employ various system checks to detect and a | t | 1 | Adversaries may employ various system checks to detect and a |
| > | void virtualization and analysis environments. This may incl | > | void virtualization and analysis environments. This may incl | ||
| > | ude changing behaviors based on the results of checks for th | > | ude changing behaviors based on the results of checks for th | ||
| > | e presence of artifacts indicative of a virtual machine envi | > | e presence of artifacts indicative of a virtual machine envi | ||
| > | ronment (VME) or sandbox. If the adversary detects a VME, th | > | ronment (VME) or sandbox. If the adversary detects a VME, th | ||
| > | ey may alter their malware to disengage from the victim or c | > | ey may alter their malware to disengage from the victim or c | ||
| > | onceal the core functions of the implant. They may also sear | > | onceal the core functions of the implant. They may also sear | ||
| > | ch for VME artifacts before dropping secondary or additional | > | ch for VME artifacts before dropping secondary or additional | ||
| > | payloads. Adversaries may use the information learned from | > | payloads. Adversaries may use the information learned from | ||
| > | [Virtualization/Sandbox Evasion](https://attack.mitre.org/te | > | [Virtualization/Sandbox Evasion](https://attack.mitre.org/te | ||
| > | chniques/T1497) during automated discovery to shape follow-o | > | chniques/T1497) during automated discovery to shape follow-o | ||
| > | n behaviors.(Citation: Deloitte Environment Awareness) Spec | > | n behaviors.(Citation: Deloitte Environment Awareness) Spec | ||
| > | ific checks will vary based on the target and/or adversary, | > | ific checks will vary based on the target and/or adversary, | ||
| > | but may involve behaviors such as [Windows Management Instru | > | but may involve behaviors such as [Windows Management Instru | ||
| > | mentation](https://attack.mitre.org/techniques/T1047), [Powe | > | mentation](https://attack.mitre.org/techniques/T1047), [Powe | ||
| > | rShell](https://attack.mitre.org/techniques/T1059/001), [Sys | > | rShell](https://attack.mitre.org/techniques/T1059/001), [Sys | ||
| > | tem Information Discovery](https://attack.mitre.org/techniqu | > | tem Information Discovery](https://attack.mitre.org/techniqu | ||
| > | es/T1082), and [Query Registry](https://attack.mitre.org/tec | > | es/T1082), and [Query Registry](https://attack.mitre.org/tec | ||
| > | hniques/T1012) to obtain system information and search for V | > | hniques/T1012) to obtain system information and search for V | ||
| > | ME artifacts. Adversaries may search for VME artifacts in me | > | ME artifacts. Adversaries may search for VME artifacts in me | ||
| > | mory, processes, file system, hardware, and/or the Registry. | > | mory, processes, file system, hardware, and/or the Registry. | ||
| > | Adversaries may use scripting to automate these checks int | > | Adversaries may use scripting to automate these checks int | ||
| > | o one script and then have the program exit if it determines | > | o one script and then have the program exit if it determines | ||
| > | the system to be a virtual environment. Checks could incl | > | the system to be a virtual environment. Checks could incl | ||
| > | ude generic system properties such as host/domain name and s | > | ude generic system properties such as host/domain name and s | ||
| > | amples of network traffic. Adversaries may also check the ne | > | amples of network traffic. Adversaries may also check the ne | ||
| > | twork adapters addresses, CPU core count, and available memo | > | twork adapters addresses, CPU core count, and available memo | ||
| > | ry/drive size. Other common checks may enumerate services | > | ry/drive size. Once executed, malware may also use [File and | ||
| > | running that are unique to these applications, installed pro | > | Directory Discovery](https://attack.mitre.org/techniques/T1 | ||
| > | grams on the system, manufacturer/product fields for strings | > | 083) to check if it was saved in a folder or file with unexp | ||
| > | relating to virtual machine applications, and VME-specific | > | ected or even analysis-related naming artifacts such as `mal | ||
| > | hardware/processor instructions.(Citation: McAfee Virtual Ja | > | ware`, `sample`, or `hash`. Other common checks may enumera | ||
| > | n 2017) In applications like VMWare, adversaries can also us | > | te services running that are unique to these applications, i | ||
| > | e a special I/O port to send commands and receive output. | > | nstalled programs on the system, manufacturer/product fields | ||
| > | Hardware checks, such as the presence of the fan, temperatu | > | for strings relating to virtual machine applications, and V | ||
| > | re, and audio devices, could also be used to gather evidence | > | ME-specific hardware/processor instructions.(Citation: McAfe | ||
| > | that can be indicative a virtual environment. Adversaries m | > | e Virtual Jan 2017) In applications like VMWare, adversaries | ||
| > | ay also query for specific readings from these devices.(Cita | > | can also use a special I/O port to send commands and receiv | ||
| > | tion: Unit 42 OilRig Sept 2018) | > | e output. Hardware checks, such as the presence of the fa | ||
| > | n, temperature, and audio devices, could also be used to gat | ||||
| > | her evidence that can be indicative a virtual environment. A | ||||
| > | dversaries may also query for specific readings from these d | ||||
| > | evices.(Citation: Unit 42 OilRig Sept 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Windows Management Instrumentation (WM | t | 1 | Adversaries may abuse Windows Management Instrumentation (WM |
| > | I) to execute malicious commands and payloads. WMI is an adm | > | I) to execute malicious commands and payloads. WMI is design | ||
| > | inistration feature that provides a uniform environment to a | > | ed for programmers and is the infrastructure for management | ||
| > | ccess Windows system components. The WMI service enables bot | > | data and operations on Windows systems.(Citation: WMI 1-3) W | ||
| > | h local and remote access, though the latter is facilitated | > | MI is an administration feature that provides a uniform envi | ||
| > | by [Remote Services](https://attack.mitre.org/techniques/T10 | > | ronment to access Windows system components. The WMI servic | ||
| > | 21) such as [Distributed Component Object Model](https://att | > | e enables both local and remote access, though the latter is | ||
| > | ack.mitre.org/techniques/T1021/003) (DCOM) and [Windows Remo | > | facilitated by [Remote Services](https://attack.mitre.org/t | ||
| > | te Management](https://attack.mitre.org/techniques/T1021/006 | > | echniques/T1021) such as [Distributed Component Object Model | ||
| > | ) (WinRM).(Citation: MSDN WMI) Remote WMI over DCOM operates | > | ](https://attack.mitre.org/techniques/T1021/003) and [Window | ||
| > | using port 135, whereas WMI over WinRM operates over port 5 | > | s Remote Management](https://attack.mitre.org/techniques/T10 | ||
| > | 985 when using HTTP and 5986 for HTTPS.(Citation: MSDN WMI)( | > | 21/006).(Citation: WMI 1-3) Remote WMI over DCOM operates us | ||
| > | Citation: FireEye WMI 2015) An adversary can use WMI to int | > | ing port 135, whereas WMI over WinRM operates over port 5985 | ||
| > | eract with local and remote systems and use it as a means to | > | when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Cit | ||
| > | execute various behaviors, such as gathering information fo | > | ation: Mandiant WMI) An adversary can use WMI to interact w | ||
| > | r Discovery as well as remote Execution of files as part of | > | ith local and remote systems and use it as a means to execut | ||
| > | Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citatio | > | e various behaviors, such as gathering information for [Disc | ||
| > | n: FireEye WMI 2015) | > | overy](https://attack.mitre.org/tactics/TA0007) as well as [ | ||
| > | Execution](https://attack.mitre.org/tactics/TA0002) of comma | ||||
| > | nds and payloads.(Citation: Mandiant WMI) For example, `wmic | ||||
| > | .exe` can be abused by an adversary to delete shadow copies | ||||
| > | with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibi | ||||
| > | t System Recovery](https://attack.mitre.org/techniques/T1490 | ||||
| > | )).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as | ||||
| > | of January of 2024, with the WMIC feature being \u201cdisabled by | ||||
| > | default\u201d on Windows 11+. WMIC will be removed from subseque | ||||
| > | nt Windows releases and replaced by [PowerShell](https://att | ||||
| > | ack.mitre.org/techniques/T1059/001) as the primary WMI inter | ||||
| > | face.(Citation: WMI 7,8) In addition to PowerShell and tools | ||||
| > | like `wbemtool.exe`, COM APIs can also be used to programma | ||||
| > | tically interact with WMI via C++, .NET, VBScript, etc.(Cita | ||||
| > | tion: WMI 7,8) |
runas command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)\n\nIf an adversary is using a payload that calls the Windows token APIs directly, analysts can detect token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.\n\nAnalysts can also monitor for use of Windows APIs such as LogonUser and SetThreadToken and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_effective_permissions": [
"SYSTEM"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_permissions_required": [
"Administrator",
"User"
],
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-10 17:55:46.905000+00:00\", \"old_value\": \"2023-04-11 21:22:17.257000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.\\n\\nThis behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.\", \"old_value\": \"Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.\\n\\nThis behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function. The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.\\n+Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.\\n \\n This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"LogonUserW function\", \"description\": \"Microsoft. (2023, March 10). LogonUserW function (winbase.h). Retrieved January 8, 2024.\", \"url\": \"https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-logonuserw\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may make new tokens and impersonate users to esc | t | 1 | Adversaries may make new tokens and impersonate users to esc |
| > | alate privileges and bypass access controls. For example, if | > | alate privileges and bypass access controls. For example, if | ||
| > | an adversary has a username and password but the user is no | > | an adversary has a username and password but the user is no | ||
| > | t logged onto the system the adversary can then create a log | > | t logged onto the system the adversary can then create a log | ||
| > | on session for the user using the `LogonUser` function. The | > | on session for the user using the `LogonUser` function.(Cita | ||
| > | function will return a copy of the new session's access toke | > | tion: LogonUserW function) The function will return a copy o | ||
| > | n and the adversary can use `SetThreadToken` to assign the t | > | f the new session's access token and the adversary can use ` | ||
| > | oken to a thread. This behavior is distinct from [Token Imp | > | SetThreadToken` to assign the token to a thread. This behav | ||
| > | ersonation/Theft](https://attack.mitre.org/techniques/T1134/ | > | ior is distinct from [Token Impersonation/Theft](https://att | ||
| > | 001) in that this refers to creating a new user token instea | > | ack.mitre.org/techniques/T1134/001) in that this refers to c | ||
| > | d of stealing or duplicating an existing one. | > | reating a new user token instead of stealing or duplicating | ||
| > | an existing one. |
runas command. Detailed command-line logging is not enabled by default in Windows.(Citation: Microsoft Command-line Logging)\n\nAnalysts can also monitor for use of Windows APIs such as DuplicateToken(Ex), ImpersonateLoggedOnUser , and SetThreadToken and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-10 17:57:36.177000+00:00\", \"old_value\": \"2023-09-29 21:08:45.174000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.\\n\\nAn adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.\\n\\nWhen an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.\", \"old_value\": \"Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.\\n\\nAn adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.\\n\\nWhen an adversary would instead use a duplicated token to create a new process rather than attaching to an existing process, they can additionally [Create Process with Token](https://attack.mitre.org/techniques/T1134/002) using `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) is also distinct from [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) in that it refers to duplicating an existing token, rather than creating a new one.\", \"diff\": \"--- \\n+++ \\n@@ -1,4 +1,4 @@\\n-Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.\\n+Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.\\n \\n An adversary may perform [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) when they have a specific, existing process they want to assign the duplicated token to. For example, this may be useful for when the target user has a non-network logon session on the system.\\n \"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"DuplicateToken function\", \"description\": \"Microsoft. (2021, October 12). DuplicateToken function (securitybaseapi.h). Retrieved January 8, 2024.\", \"url\": \"https://learn.microsoft.com/en-us/windows/win32/api/securitybaseapi/nf-securitybaseapi-duplicatetoken\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may duplicate then impersonate another user's ex | t | 1 | Adversaries may duplicate then impersonate another user's ex |
| > | isting token to escalate privileges and bypass access contro | > | isting token to escalate privileges and bypass access contro | ||
| > | ls. For example, an adversary can duplicate an existing toke | > | ls. For example, an adversary can duplicate an existing toke | ||
| > | n using `DuplicateToken` or `DuplicateTokenEx`. The token ca | > | n using `DuplicateToken` or `DuplicateTokenEx`.(Citation: Du | ||
| > | n then be used with `ImpersonateLoggedOnUser` to allow the c | > | plicateToken function) The token can then be used with `Impe | ||
| > | alling thread to impersonate a logged on user's security con | > | rsonateLoggedOnUser` to allow the calling thread to imperson | ||
| > | text, or with `SetThreadToken` to assign the impersonated to | > | ate a logged on user's security context, or with `SetThreadT | ||
| > | ken to a thread. An adversary may perform [Token Impersonat | > | oken` to assign the impersonated token to a thread. An adve | ||
| > | ion/Theft](https://attack.mitre.org/techniques/T1134/001) wh | > | rsary may perform [Token Impersonation/Theft](https://attack | ||
| > | en they have a specific, existing process they want to assig | > | .mitre.org/techniques/T1134/001) when they have a specific, | ||
| > | n the duplicated token to. For example, this may be useful f | > | existing process they want to assign the duplicated token to | ||
| > | or when the target user has a non-network logon session on t | > | . For example, this may be useful for when the target user h | ||
| > | he system. When an adversary would instead use a duplicated | > | as a non-network logon session on the system. When an adver | ||
| > | token to create a new process rather than attaching to an e | > | sary would instead use a duplicated token to create a new pr | ||
| > | xisting process, they can additionally [Create Process with | > | ocess rather than attaching to an existing process, they can | ||
| > | Token](https://attack.mitre.org/techniques/T1134/002) using | > | additionally [Create Process with Token](https://attack.mit | ||
| > | `CreateProcessWithTokenW` or `CreateProcessAsUserW`. [Token | > | re.org/techniques/T1134/002) using `CreateProcessWithTokenW` | ||
| > | Impersonation/Theft](https://attack.mitre.org/techniques/T11 | > | or `CreateProcessAsUserW`. [Token Impersonation/Theft](http | ||
| > | 34/001) is also distinct from [Make and Impersonate Token](h | > | s://attack.mitre.org/techniques/T1134/001) is also distinct | ||
| > | ttps://attack.mitre.org/techniques/T1134/003) in that it ref | > | from [Make and Impersonate Token](https://attack.mitre.org/t | ||
| > | ers to duplicating an existing token, rather than creating a | > | echniques/T1134/003) in that it refers to duplicating an exi | ||
| > | new one. | > | sting token, rather than creating a new one. |
net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Azure AD",
"Office 365",
"SaaS",
"IaaS",
"Linux",
"macOS",
"Google Workspace"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-12 23:36:56.245000+00:00\", \"old_value\": \"2023-04-15 17:24:23.029000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\\n\\nAdversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.\\n\\nFor examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system\\u2019s files.\", \"old_value\": \"Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., [Valid Accounts](https://attack.mitre.org/techniques/T1078)).\\n\\nAdversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.\\n\\nFor examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system\\u2019s files.\", \"diff\": \"--- \\n+++ \\n@@ -2,4 +2,4 @@\\n \\n Adversaries may use several methods to enumerate accounts, including abuse of existing tools, built-in commands, and potential misconfigurations that leak account names and roles or permissions in the targeted environment.\\n \\n-For examples, cloud environments typically provide easily accessible interfaces to obtain user lists. On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system\\u2019s files.\\n+For examples, cloud environments typically provide easily accessible interfaces to obtain user lists.(Citation: AWS List Users)(Citation: Google Cloud - IAM Servie Accounts List API) On hosts, adversaries can use default [PowerShell](https://attack.mitre.org/techniques/T1059/001) and other command line functionality to identify accounts. Information about email addresses and accounts may also be extracted by searching an infected system\\u2019s files.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"AWS List Users\", \"description\": \"Amazon. (n.d.). List Users. Retrieved August 11, 2020.\", \"url\": \"https://docs.aws.amazon.com/cli/latest/reference/iam/list-users.html\"}, \"root['external_references'][2]\": {\"source_name\": \"Google Cloud - IAM Servie Accounts List API\", \"description\": \"Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020.\", \"url\": \"https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list\"}}}",
"previous_version": "2.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of valid accounts, | t | 1 | Adversaries may attempt to get a listing of valid accounts, |
| > | usernames, or email addresses on a system or within a compro | > | usernames, or email addresses on a system or within a compro | ||
| > | mised environment. This information can help adversaries det | > | mised environment. This information can help adversaries det | ||
| > | ermine which accounts exist, which can aid in follow-on beha | > | ermine which accounts exist, which can aid in follow-on beha | ||
| > | vior such as brute-forcing, spear-phishing attacks, or accou | > | vior such as brute-forcing, spear-phishing attacks, or accou | ||
| > | nt takeovers (e.g., [Valid Accounts](https://attack.mitre.or | > | nt takeovers (e.g., [Valid Accounts](https://attack.mitre.or | ||
| > | g/techniques/T1078)). Adversaries may use several methods t | > | g/techniques/T1078)). Adversaries may use several methods t | ||
| > | o enumerate accounts, including abuse of existing tools, bui | > | o enumerate accounts, including abuse of existing tools, bui | ||
| > | lt-in commands, and potential misconfigurations that leak ac | > | lt-in commands, and potential misconfigurations that leak ac | ||
| > | count names and roles or permissions in the targeted environ | > | count names and roles or permissions in the targeted environ | ||
| > | ment. For examples, cloud environments typically provide ea | > | ment. For examples, cloud environments typically provide ea | ||
| > | sily accessible interfaces to obtain user lists. On hosts, a | > | sily accessible interfaces to obtain user lists.(Citation: A | ||
| > | dversaries can use default [PowerShell](https://attack.mitre | > | WS List Users)(Citation: Google Cloud - IAM Servie Accounts | ||
| > | .org/techniques/T1059/001) and other command line functional | > | List API) On hosts, adversaries can use default [PowerShell] | ||
| > | ity to identify accounts. Information about email addresses | > | (https://attack.mitre.org/techniques/T1059/001) and other co | ||
| > | and accounts may also be extracted by searching an infected | > | mmand line functionality to identify accounts. Information a | ||
| > | system\u2019s files. | > | bout email addresses and accounts may also be extracted by s | ||
| > | earching an infected system\u2019s files. |
net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022) ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1087/002",
"external_id": "T1087.002"
},
{
"source_name": "CrowdStrike StellarParticle January 2022",
"description": "CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.",
"url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"ExtraHop",
"Miriam Wiesner, @miriamxyra, Microsoft Security"
],
"x_mitre_data_sources": [
"Process: Process Creation",
"Command: Command Execution",
"Process: OS API Execution",
"Network Traffic: Network Traffic Content",
"Group: Group Enumeration"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-15 21:33:57.732000+00:00\", \"old_value\": \"2023-04-15 16:37:59.115000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.\\n\\nCommands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022) \", \"old_value\": \"Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.\\n\\nCommands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups. \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.\\n \\n-Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups. \\n+Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022) \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"CrowdStrike StellarParticle January 2022\", \"description\": \"CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.\", \"url\": \"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/\"}}}",
"previous_version": "1.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of domain accounts. | t | 1 | Adversaries may attempt to get a listing of domain accounts. |
| > | This information can help adversaries determine which domai | > | This information can help adversaries determine which domai | ||
| > | n accounts exist to aid in follow-on behavior such as target | > | n accounts exist to aid in follow-on behavior such as target | ||
| > | ing specific accounts which possess particular privileges. | > | ing specific accounts which possess particular privileges. | ||
| > | Commands such as <code>net user /domain</code> and <code>net | > | Commands such as <code>net user /domain</code> and <code>net | ||
| > | group /domain</code> of the [Net](https://attack.mitre.org/ | > | group /domain</code> of the [Net](https://attack.mitre.org/ | ||
| > | software/S0039) utility, <code>dscacheutil -q group</code>on | > | software/S0039) utility, <code>dscacheutil -q group</code>on | ||
| > | macOS, and <code>ldapsearch</code> on Linux can list domain | > | macOS, and <code>ldapsearch</code> on Linux can list domain | ||
| > | users and groups. [PowerShell](https://attack.mitre.org/tec | > | users and groups. [PowerShell](https://attack.mitre.org/tec | ||
| > | hniques/T1059/001) cmdlets including <code>Get-ADUser</code> | > | hniques/T1059/001) cmdlets including <code>Get-ADUser</code> | ||
| > | and <code>Get-ADGroupMember</code> may enumerate members of | > | and <code>Get-ADGroupMember</code> may enumerate members of | ||
| > | Active Directory groups. | > | Active Directory groups.(Citation: CrowdStrike StellarParti | ||
| > | cle January 2022) |
net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groups on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1087/001",
"external_id": "T1087.001"
},
{
"source_name": "id man page",
"description": "MacKenzie, D. and Robbins, A. (n.d.). id(1) - Linux man page. Retrieved January 11, 2024.",
"url": "https://linux.die.net/man/1/id"
},
{
"source_name": "groups man page",
"description": "MacKenzie, D. and Youngman, J. (n.d.). groups(1) - Linux man page. Retrieved January 11, 2024.",
"url": "https://linux.die.net/man/1/groups"
},
{
"source_name": "Mandiant APT1",
"description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
},
{
"source_name": "Elastic - Koadiac Detection with EQL",
"description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.",
"url": "https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Daniel Stepanic, Elastic",
"Miriam Wiesner, @miriamxyra, Microsoft Security"
],
"x_mitre_data_sources": [
"Process: OS API Execution",
"Group: Group Enumeration",
"Process: Process Creation",
"Command: Command Execution",
"File: File Access"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.\n\nMonitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nMonitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-11 23:47:44.655000+00:00\", \"old_value\": \"2023-04-13 17:20:22.867000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\\n\\nCommands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groups on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.\", \"old_value\": \"Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\\n\\nCommands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\\n \\n-Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.\\n+Commands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groups on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"id man page\", \"description\": \"MacKenzie, D. and Robbins, A. (n.d.). id(1) - Linux man page. Retrieved January 11, 2024.\", \"url\": \"https://linux.die.net/man/1/id\"}, \"root['external_references'][2]\": {\"source_name\": \"groups man page\", \"description\": \"MacKenzie, D. and Youngman, J. (n.d.). groups(1) - Linux man page. Retrieved January 11, 2024.\", \"url\": \"https://linux.die.net/man/1/groups\"}, \"root['external_references'][3]\": {\"source_name\": \"Mandiant APT1\", \"description\": \"Mandiant. (n.d.). APT1 Exposing One of China\\u2019s Cyber Espionage Units. Retrieved July 18, 2016.\", \"url\": \"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf\"}}}",
"previous_version": "1.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to get a listing of local system acc | t | 1 | Adversaries may attempt to get a listing of local system acc |
| > | ounts. This information can help adversaries determine which | > | ounts. This information can help adversaries determine which | ||
| > | local accounts exist on a system to aid in follow-on behavi | > | local accounts exist on a system to aid in follow-on behavi | ||
| > | or. Commands such as <code>net user</code> and <code>net lo | > | or. Commands such as <code>net user</code> and <code>net lo | ||
| > | calgroup</code> of the [Net](https://attack.mitre.org/softwa | > | calgroup</code> of the [Net](https://attack.mitre.org/softwa | ||
| > | re/S0039) utility and <code>id</code> and <code>groups</code | > | re/S0039) utility and <code>id</code> and <code>groups</code | ||
| > | >on macOS and Linux can list local users and groups. On Linu | > | > on macOS and Linux can list local users and groups.(Citati | ||
| > | x, local users can also be enumerated through the use of the | > | on: Mandiant APT1)(Citation: id man page)(Citation: groups m | ||
| > | <code>/etc/passwd</code> file. On macOS the <code>dscl . li | > | an page) On Linux, local users can also be enumerated throug | ||
| > | st /Users</code> command can be used to enumerate local acco | > | h the use of the <code>/etc/passwd</code> file. On macOS the | ||
| > | unts. | > | <code>dscl . list /Users</code> command can be used to enum | ||
| > | erate local accounts. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may manipulate accounts to maintain and/or eleva | t | 1 | Adversaries may manipulate accounts to maintain and/or eleva |
| > | te access to victim systems. Account manipulation may consis | > | te access to victim systems. Account manipulation may consis | ||
| > | t of any action that preserves or modifies adversary access | > | t of any action that preserves or modifies adversary access | ||
| > | to a compromised account, such as modifying credentials or p | > | to a compromised account, such as modifying credentials or p | ||
| > | ermission groups. These actions could also include account a | > | ermission groups.(Citation: FireEye SMOKEDHAM June 2021) The | ||
| > | ctivity designed to subvert security policies, such as perfo | > | se actions could also include account activity designed to s | ||
| > | rming iterative password updates to bypass password duration | > | ubvert security policies, such as performing iterative passw | ||
| > | policies and preserve the life of compromised credentials. | > | ord updates to bypass password duration policies and preserv | ||
| > | In order to create or manipulate accounts, the adversary m | > | e the life of compromised credentials. In order to create | ||
| > | ust already have sufficient permissions on systems or the do | > | or manipulate accounts, the adversary must already have suff | ||
| > | main. However, account manipulation may also lead to privile | > | icient permissions on systems or the domain. However, accoun | ||
| > | ge escalation where modifications grant access to additional | > | t manipulation may also lead to privilege escalation where m | ||
| > | roles, permissions, or higher-privileged [Valid Accounts](h | > | odifications grant access to additional roles, permissions, | ||
| > | ttps://attack.mitre.org/techniques/T1078). | > | or higher-privileged [Valid Accounts](https://attack.mitre.o | ||
| > | rg/techniques/T1078). |
Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) \n\nAdversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user\u2019s mail folders.(Citation: Mandiant Defend UNC2452 White Paper)\n\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
},
{
"kill_chain_name": "mitre-attack",
"phase_name": "privilege-escalation"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1098/002",
"external_id": "T1098.002"
},
{
"source_name": "Bienstock, D. - Defending O365 - 2019",
"description": "Bienstock, D.. (2019). BECS and Beyond: Investigating and Defending O365. Retrieved September 13, 2019.",
"url": "https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365"
},
{
"source_name": "Crowdstrike Hiding in Plain Sight 2018",
"description": "Crowdstrike. (2018, July 18). Hiding in Plain Sight: Using the Office 365 Activities API to Investigate Business Email Compromises. Retrieved January 19, 2020.",
"url": "https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/"
},
{
"source_name": "Google Ensuring Your Information is Safe",
"description": "Google. (2011, June 1). Ensuring your information is safe online. Retrieved April 1, 2022.",
"url": "https://googleblog.blogspot.com/2011/06/ensuring-your-information-is-safe.html"
},
{
"source_name": "Gmail Delegation",
"description": "Google. (n.d.). Turn Gmail delegation on or off. Retrieved April 1, 2022.",
"url": "https://support.google.com/a/answer/7223765?hl=en"
},
{
"source_name": "FireEye APT35 2018",
"description": "Mandiant. (2018). Mandiant M-Trends 2018. Retrieved July 9, 2018.",
"url": "https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf"
},
{
"source_name": "Mandiant Defend UNC2452 White Paper",
"description": "Mandiant. (2021, January 19). Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. Retrieved January 22, 2021.",
"url": "https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452"
},
{
"source_name": "Microsoft - Add-MailboxPermission",
"description": "Microsoft. (n.d.). Add-Mailbox Permission. Retrieved September 13, 2019.",
"url": "https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Microsoft Detection and Response Team (DART)",
"Mike Burns, Mandiant",
"Naveen Vijayaraghavan, Nilesh Dherange (Gurucul)",
"Jannie Li, Microsoft Threat Intelligence\u202fCenter\u202f(MSTIC)",
"Arad Inbar, Fidelis Security"
],
"x_mitre_data_sources": [
"Group: Group Modification",
"Application Log: Application Log Content",
"User Account: User Account Modification"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts.\n\nEnable the UpdateFolderPermissions action for all logon types. The mailbox audit log will forward folder permission modification events to the Unified Audit Log. Create rules to alert on ModifyFolderPermissions operations where the Anonymous or Default user is assigned permissions other than None. \n\nA larger than normal volume of emails sent from an account and similar phishing emails sent from \u202freal accounts within a network may be a sign that an account was compromised and attempts to leverage access with modified email permissions is occurring.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Office 365",
"Google Workspace"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-03 15:46:06.706000+00:00\", \"old_value\": \"2023-10-03 17:38:00.554000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. \\n\\nFor example, the Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) \\n\\nAdversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user\\u2019s mail folders.(Citation: Mandiant Defend UNC2452 White Paper)\\n\\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)\", \"old_value\": \"Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. \\n\\nFor example, the Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) \\n\\nAdversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user\\u2019s mail folders.(Citation: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452)\\n\\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)\", \"diff\": \"--- \\n+++ \\n@@ -2,6 +2,6 @@\\n \\n For example, the Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.(Citation: Gmail Delegation)(Citation: Google Ensuring Your Information is Safe) \\n \\n-Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user\\u2019s mail folders.(Citation: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452)\\n+Adversaries may also assign mailbox folder permissions through individual folder permissions or roles. In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user\\u2019s mail folders.(Citation: Mandiant Defend UNC2452 White Paper)\\n \\n This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)\"}, \"root['external_references'][7]['source_name']\": {\"new_value\": \"Mandiant Defend UNC2452 White Paper\", \"old_value\": \"Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452\"}, \"root['external_references'][7]['description']\": {\"new_value\": \"Mandiant. (2021, January 19). Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. Retrieved January 22, 2021.\", \"old_value\": \"Mike Burns, Matthew McWhirt, Douglas Bienstock, Nick Bennett. (2021, January 19). Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452. Retrieved September 25, 2021.\"}, \"root['external_references'][7]['url']\": {\"new_value\": \"https://www.mandiant.com/resources/blog/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452\", \"old_value\": \"https://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html\"}}}",
"previous_version": "2.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may grant additional permission levels to mainta | t | 1 | Adversaries may grant additional permission levels to mainta |
| > | in persistent access to an adversary-controlled email accoun | > | in persistent access to an adversary-controlled email accoun | ||
| > | t. For example, the <code>Add-MailboxPermission</code> [Po | > | t. For example, the <code>Add-MailboxPermission</code> [Po | ||
| > | werShell](https://attack.mitre.org/techniques/T1059/001) cmd | > | werShell](https://attack.mitre.org/techniques/T1059/001) cmd | ||
| > | let, available in on-premises Exchange and in the cloud-base | > | let, available in on-premises Exchange and in the cloud-base | ||
| > | d service Office 365, adds permissions to a mailbox.(Citatio | > | d service Office 365, adds permissions to a mailbox.(Citatio | ||
| > | n: Microsoft - Add-MailboxPermission)(Citation: FireEye APT3 | > | n: Microsoft - Add-MailboxPermission)(Citation: FireEye APT3 | ||
| > | 5 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In | > | 5 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018) In | ||
| > | Google Workspace, delegation can be enabled via the Google | > | Google Workspace, delegation can be enabled via the Google | ||
| > | Admin console and users can delegate accounts via their Gmai | > | Admin console and users can delegate accounts via their Gmai | ||
| > | l settings.(Citation: Gmail Delegation)(Citation: Google Ens | > | l settings.(Citation: Gmail Delegation)(Citation: Google Ens | ||
| > | uring Your Information is Safe) Adversaries may also assig | > | uring Your Information is Safe) Adversaries may also assig | ||
| > | n mailbox folder permissions through individual folder permi | > | n mailbox folder permissions through individual folder permi | ||
| > | ssions or roles. In Office 365 environments, adversaries may | > | ssions or roles. In Office 365 environments, adversaries may | ||
| > | assign the Default or Anonymous user permissions or roles t | > | assign the Default or Anonymous user permissions or roles t | ||
| > | o the Top of Information Store (root), Inbox, or other mailb | > | o the Top of Information Store (root), Inbox, or other mailb | ||
| > | ox folders. By assigning one or both user permissions to a f | > | ox folders. By assigning one or both user permissions to a f | ||
| > | older, the adversary can utilize any other account in the te | > | older, the adversary can utilize any other account in the te | ||
| > | nant to maintain persistence to the target user\u2019s mail folde | > | nant to maintain persistence to the target user\u2019s mail folde | ||
| > | rs.(Citation: Remediation and Hardening Strategies for Micro | > | rs.(Citation: Mandiant Defend UNC2452 White Paper) This may | ||
| > | soft 365 to Defend Against UNC2452) This may be used in per | > | be used in persistent threat incidents as well as BEC (Busi | ||
| > | sistent threat incidents as well as BEC (Business Email Comp | > | ness Email Compromise) incidents where an adversary can add | ||
| > | romise) incidents where an adversary can add [Additional Clo | > | [Additional Cloud Roles](https://attack.mitre.org/techniques | ||
| > | ud Roles](https://attack.mitre.org/techniques/T1098/003) to | > | /T1098/003) to the accounts they wish to compromise. This ma | ||
| > | the accounts they wish to compromise. This may further enabl | > | y further enable use of additional techniques for gaining ac | ||
| > | e use of additional techniques for gaining access to systems | > | cess to systems. For example, compromised business accounts | ||
| > | . For example, compromised business accounts are often used | > | are often used to send messages to other accounts in the net | ||
| > | to send messages to other accounts in the network of the tar | > | work of the target business while creating inbox rules (ex: | ||
| > | get business while creating inbox rules (ex: [Internal Spear | > | [Internal Spearphishing](https://attack.mitre.org/techniques | ||
| > | phishing](https://attack.mitre.org/techniques/T1534)), so th | > | /T1534)), so the messages evade spam/phishing detection mech | ||
| > | e messages evade spam/phishing detection mechanisms.(Citatio | > | anisms.(Citation: Bienstock, D. - Defending O365 - 2019) | ||
| > | n: Bienstock, D. - Defending O365 - 2019) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may register for web services\u00a0that can be used d | t | 1 | Adversaries may register for web services\u00a0that can be used d |
| > | uring targeting. A variety of popular websites exist for adv | > | uring targeting. A variety of popular websites exist for adv | ||
| > | ersaries to register for a web-based service that can be abu | > | ersaries to register for a web-based service that can be abu | ||
| > | sed during later stages of the adversary lifecycle, such as | > | sed during later stages of the adversary lifecycle, such as | ||
| > | during Command and Control ([Web Service](https://attack.mit | > | during Command and Control ([Web Service](https://attack.mit | ||
| > | re.org/techniques/T1102)), [Exfiltration Over Web Service](h | > | re.org/techniques/T1102)), [Exfiltration Over Web Service](h | ||
| > | ttps://attack.mitre.org/techniques/T1567), or [Phishing](htt | > | ttps://attack.mitre.org/techniques/T1567), or [Phishing](htt | ||
| > | ps://attack.mitre.org/techniques/T1566). Using common servic | > | ps://attack.mitre.org/techniques/T1566). Using common servic | ||
| > | es, such as those offered by Google or Twitter, makes it eas | > | es, such as those offered by Google or Twitter, makes it eas | ||
| > | ier for adversaries to hide in expected noise. By utilizing | > | ier for adversaries to hide in expected noise.(Citation: Fir | ||
| > | a web service, adversaries can make it difficult to physical | > | eEye APT29) By utilizing a web service, adversaries can make | ||
| > | ly tie back operations to them. | > | it difficult to physically tie back operations to them. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary may compress and/or encrypt data that is collec | t | 1 | An adversary may compress and/or encrypt data that is collec |
| > | ted prior to exfiltration. Compressing the data can help to | > | ted prior to exfiltration. Compressing the data can help to | ||
| > | obfuscate the collected data and minimize the amount of data | > | obfuscate the collected data and minimize the amount of data | ||
| > | sent over the network. Encryption can be used to hide infor | > | sent over the network.(Citation: DOJ GRU Indictment Jul 201 | ||
| > | mation that is being exfiltrated from detection or make exfi | > | 8) Encryption can be used to hide information that is being | ||
| > | ltration less conspicuous upon inspection by a defender. Bo | > | exfiltrated from detection or make exfiltration less conspic | ||
| > | th compression and encryption are done prior to exfiltration | > | uous upon inspection by a defender. Both compression and en | ||
| > | , and can be performed using a utility, 3rd party library, o | > | cryption are done prior to exfiltration, and can be performe | ||
| > | r custom method. | > | d using a utility, 3rd party library, or custom method. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | An adversary can leverage a computer's peripheral devices (e | t | 1 | An adversary can leverage a computer's peripheral devices (e |
| > | .g., microphones and webcams) or applications (e.g., voice a | > | .g., microphones and webcams) or applications (e.g., voice a | ||
| > | nd video call services) to capture audio recordings for the | > | nd video call services) to capture audio recordings for the | ||
| > | purpose of listening into sensitive conversations to gather | > | purpose of listening into sensitive conversations to gather | ||
| > | information. Malware or scripts may be used to interact wit | > | information.(Citation: ESET Attor Oct 2019) Malware or scri | ||
| > | h the devices through an available API provided by the opera | > | pts may be used to interact with the devices through an avai | ||
| > | ting system or an application to capture audio. Audio files | > | lable API provided by the operating system or an application | ||
| > | may be written to disk and exfiltrated later. | > | to capture audio. Audio files may be written to disk and ex | ||
| > | filtrated later. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may exfiltrate data, such as sensitive documents | t | 1 | Adversaries may exfiltrate data, such as sensitive documents |
| > | , through the use of automated processing after being gather | > | , through the use of automated processing after being gather | ||
| > | ed during Collection. When automated exfiltration is used, | > | ed during Collection.(Citation: ESET Gamaredon June 2020) | ||
| > | other exfiltration techniques likely apply as well to trans | > | When automated exfiltration is used, other exfiltration tech | ||
| > | fer the information out of the network, such as [Exfiltratio | > | niques likely apply as well to transfer the information out | ||
| > | n Over C2 Channel](https://attack.mitre.org/techniques/T1041 | > | of the network, such as [Exfiltration Over C2 Channel](https | ||
| > | ) and [Exfiltration Over Alternative Protocol](https://attac | > | ://attack.mitre.org/techniques/T1041) and [Exfiltration Over | ||
| > | k.mitre.org/techniques/T1048). | > | Alternative Protocol](https://attack.mitre.org/techniques/T | ||
| > | 1048). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may use brute force techniques to gain access to | t | 1 | Adversaries may use brute force techniques to gain access to |
| > | accounts when passwords are unknown or when password hashes | > | accounts when passwords are unknown or when password hashes | ||
| > | are obtained. Without knowledge of the password for an acco | > | are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Wit | ||
| > | unt or set of accounts, an adversary may systematically gues | > | hout knowledge of the password for an account or set of acco | ||
| > | s the password using a repetitive or iterative mechanism. Br | > | unts, an adversary may systematically guess the password usi | ||
| > | ute forcing passwords can take place via interaction with a | > | ng a repetitive or iterative mechanism.(Citation: Dragos Cra | ||
| > | service that will check the validity of those credentials or | > | shoverride 2018) Brute forcing passwords can take place via | ||
| > | offline against previously acquired credential data, such a | > | interaction with a service that will check the validity of t | ||
| > | s password hashes. Brute forcing credentials may take place | > | hose credentials or offline against previously acquired cred | ||
| > | at various points during a breach. For example, adversaries | > | ential data, such as password hashes. Brute forcing credent | ||
| > | may attempt to brute force access to [Valid Accounts](https | > | ials may take place at various points during a breach. For e | ||
| > | ://attack.mitre.org/techniques/T1078) within a victim enviro | > | xample, adversaries may attempt to brute force access to [Va | ||
| > | nment leveraging knowledge gathered from other post-compromi | > | lid Accounts](https://attack.mitre.org/techniques/T1078) wit | ||
| > | se behaviors such as [OS Credential Dumping](https://attack. | > | hin a victim environment leveraging knowledge gathered from | ||
| > | mitre.org/techniques/T1003), [Account Discovery](https://att | > | other post-compromise behaviors such as [OS Credential Dumpi | ||
| > | ack.mitre.org/techniques/T1087), or [Password Policy Discove | > | ng](https://attack.mitre.org/techniques/T1003), [Account Dis | ||
| > | ry](https://attack.mitre.org/techniques/T1201). Adversaries | > | covery](https://attack.mitre.org/techniques/T1087), or [Pass | ||
| > | may also combine brute forcing activity with behaviors such | > | word Policy Discovery](https://attack.mitre.org/techniques/T | ||
| > | as [External Remote Services](https://attack.mitre.org/techn | > | 1201). Adversaries may also combine brute forcing activity w | ||
| > | iques/T1133) as part of Initial Access. | > | ith behaviors such as [External Remote Services](https://att | ||
| > | ack.mitre.org/techniques/T1133) as part of Initial Access. |
python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)\n\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "execution"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1059/006",
"external_id": "T1059.006"
},
{
"source_name": "Zscaler APT31 Covid-19 October 2020",
"description": "Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.",
"url": "https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Process: Process Creation",
"Command: Command Execution"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_remote_support": false,
"x_mitre_system_requirements": [
"Python is installed."
],
"x_mitre_version": "1.0",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_attack_spec_version']\": \"3.2.0\", \"root['x_mitre_deprecated']\": false, \"root['x_mitre_remote_support']\": false}, \"dictionary_item_removed\": {\"root['x_mitre_permissions_required']\": [\"Administrator\", \"SYSTEM\", \"root\"]}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-30 18:35:58.021000+00:00\", \"old_value\": \"2021-07-26 22:49:23.094000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)\\n\\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.\", \"old_value\": \"Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.\\n\\nPython comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.\\n+Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)\\n \\n Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Zscaler APT31 Covid-19 October 2020\", \"description\": \"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.\", \"url\": \"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online\"}}}",
"previous_version": "1.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may abuse Python commands and scripts for execut | t | 1 | Adversaries may abuse Python commands and scripts for execut |
| > | ion. Python is a very popular scripting/programming language | > | ion. Python is a very popular scripting/programming language | ||
| > | , with capabilities to perform many functions. Python can be | > | , with capabilities to perform many functions. Python can be | ||
| > | executed interactively from the command-line (via the <code | > | executed interactively from the command-line (via the <code | ||
| > | >python.exe</code> interpreter) or via scripts (.py) that ca | > | >python.exe</code> interpreter) or via scripts (.py) that ca | ||
| > | n be written and distributed to different systems. Python co | > | n be written and distributed to different systems. Python co | ||
| > | de can also be compiled into binary executables. Python com | > | de can also be compiled into binary executables.(Citation: Z | ||
| > | es with many built-in packages to interact with the underlyi | > | scaler APT31 Covid-19 October 2020) Python comes with many | ||
| > | ng system, such as file operations and device I/O. Adversari | > | built-in packages to interact with the underlying system, su | ||
| > | es can use these libraries to download and execute commands | > | ch as file operations and device I/O. Adversaries can use th | ||
| > | or other scripts as well as perform various malicious behavi | > | ese libraries to download and execute commands or other scri | ||
| > | ors. | > | pts as well as perform various malicious behaviors. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries can perform command and control between compromi | t | 1 | Adversaries can perform command and control between compromi |
| > | sed hosts on potentially disconnected networks using removab | > | sed hosts on potentially disconnected networks using removab | ||
| > | le media to transfer commands from system to system. Both sy | > | le media to transfer commands from system to system.(Citatio | ||
| > | stems would need to be compromised, with the likelihood that | > | n: ESET Sednit USBStealer 2014) Both systems would need to b | ||
| > | an Internet-connected system was compromised first and the | > | e compromised, with the likelihood that an Internet-connecte | ||
| > | second through lateral movement by [Replication Through Remo | > | d system was compromised first and the second through latera | ||
| > | vable Media](https://attack.mitre.org/techniques/T1091). Com | > | l movement by [Replication Through Removable Media](https:// | ||
| > | mands and files would be relayed from the disconnected syste | > | attack.mitre.org/techniques/T1091). Commands and files would | ||
| > | m to the Internet-connected system to which the adversary ha | > | be relayed from the disconnected system to the Internet-con | ||
| > | s direct access. | > | nected system to which the adversary has direct access. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may compromise third-party servers that can be u | t | 1 | Adversaries may compromise third-party servers that can be u |
| > | sed during targeting. Use of servers allows an adversary to | > | sed during targeting. Use of servers allows an adversary to | ||
| > | stage, launch, and execute an operation. During post-comprom | > | stage, launch, and execute an operation. During post-comprom | ||
| > | ise activity, adversaries may utilize servers for various ta | > | ise activity, adversaries may utilize servers for various ta | ||
| > | sks, including for Command and Control. Instead of purchasin | > | sks, including for Command and Control.(Citation: TrendMicro | ||
| > | g a [Server](https://attack.mitre.org/techniques/T1583/004) | > | EarthLusca 2022) Instead of purchasing a [Server](https://a | ||
| > | or [Virtual Private Server](https://attack.mitre.org/techniq | > | ttack.mitre.org/techniques/T1583/004) or [Virtual Private Se | ||
| > | ues/T1583/003), adversaries may compromise third-party serve | > | rver](https://attack.mitre.org/techniques/T1583/003), advers | ||
| > | rs in support of operations. Adversaries may also compromis | > | aries may compromise third-party servers in support of opera | ||
| > | e web servers to support watering hole operations, as in [Dr | > | tions. Adversaries may also compromise web servers to suppo | ||
| > | ive-by Compromise](https://attack.mitre.org/techniques/T1189 | > | rt watering hole operations, as in [Drive-by Compromise](htt | ||
| > | ), or email servers to support [Phishing](https://attack.mit | > | ps://attack.mitre.org/techniques/T1189), or email servers to | ||
| > | re.org/techniques/T1566) operations. | > | support [Phishing](https://attack.mitre.org/techniques/T156 | ||
| > | 6) operations. |
net user or useradd. Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows system and domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain and local system accounts to detect suspicious accounts that may have been created by an adversary.\n\nCollect usage logs from cloud administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts. Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Azure AD",
"Office 365",
"IaaS",
"Linux",
"macOS",
"Google Workspace",
"Network",
"Containers",
"SaaS"
],
"x_mitre_version": "2.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-31 20:46:43.215000+00:00\", \"old_value\": \"2023-10-16 17:42:28.207000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n\\nAccounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.\", \"old_value\": \"Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n\\nAccounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n+Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\\n \\n Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Symantec WastedLocker June 2020\", \"description\": \"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.\", \"url\": \"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us\"}}}",
"previous_version": "2.4",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create an account to maintain access to vict | t | 1 | Adversaries may create an account to maintain access to vict |
| > | im systems. With a sufficient level of access, creating such | > | im systems.(Citation: Symantec WastedLocker June 2020) With | ||
| > | accounts may be used to establish secondary credentialed ac | > | a sufficient level of access, creating such accounts may be | ||
| > | cess that do not require persistent remote access tools to b | > | used to establish secondary credentialed access that do not | ||
| > | e deployed on the system. Accounts may be created on the lo | > | require persistent remote access tools to be deployed on the | ||
| > | cal system or within a domain or cloud tenant. In cloud envi | > | system. Accounts may be created on the local system or wit | ||
| > | ronments, adversaries may create accounts that only have acc | > | hin a domain or cloud tenant. In cloud environments, adversa | ||
| > | ess to specific services, which can reduce the chance of det | > | ries may create accounts that only have access to specific s | ||
| > | ection. | > | ervices, which can reduce the chance of detection. |
net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "persistence"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1136/002",
"external_id": "T1136.002"
},
{
"source_name": "Microsoft User Creation Event",
"description": "Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720"
},
{
"source_name": "Savill 1999",
"description": "Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.",
"url": "https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_data_sources": [
"Process: Process Creation",
"Command: Command Execution",
"User Account: User Account Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor for processes and command-line parameters associated with domain account creation, such as net user /add /domain. Collect data on account creation within a network. Event ID 4720 is generated when a user account is created on a Windows domain controller. (Citation: Microsoft User Creation Event) Perform regular audits of domain accounts to detect suspicious accounts that may have been created by an adversary.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-01 04:37:36.774000+00:00\", \"old_value\": \"2023-10-16 17:36:37.600000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\\n\\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\", \"old_value\": \"Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.\\n\\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.\\n+Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)\\n \\n Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Savill 1999\", \"description\": \"Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.\", \"url\": \"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may create a domain account to maintain access t | t | 1 | Adversaries may create a domain account to maintain access t |
| > | o victim systems. Domain accounts are those managed by Activ | > | o victim systems. Domain accounts are those managed by Activ | ||
| > | e Directory Domain Services where access and permissions are | > | e Directory Domain Services where access and permissions are | ||
| > | configured across systems and services that are part of tha | > | configured across systems and services that are part of tha | ||
| > | t domain. Domain accounts can cover user, administrator, and | > | t domain. Domain accounts can cover user, administrator, and | ||
| > | service accounts. With a sufficient level of access, the <c | > | service accounts. With a sufficient level of access, the <c | ||
| > | ode>net user /add /domain</code> command can be used to crea | > | ode>net user /add /domain</code> command can be used to crea | ||
| > | te a domain account. Such accounts may be used to establish | > | te a domain account.(Citation: Savill 1999) Such accounts m | ||
| > | secondary credentialed access that do not require persisten | > | ay be used to establish secondary credentialed access that d | ||
| > | t remote access tools to be deployed on the system. | > | o not require persistent remote access tools to be deployed | ||
| > | on the system. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may insert, delete, or manipulate data in order | t | 1 | Adversaries may insert, delete, or manipulate data in order |
| > | to influence external outcomes or hide activity, thus threat | > | to influence external outcomes or hide activity, thus threat | ||
| > | ening the integrity of the data. By manipulating data, adver | > | ening the integrity of the data.(Citation: Sygnia Elephant B | ||
| > | saries may attempt to affect a business process, organizatio | > | eetle Jan 2022) By manipulating data, adversaries may attemp | ||
| > | nal understanding, or decision making. The type of modifica | > | t to affect a business process, organizational understanding | ||
| > | tion and the impact it will have depends on the target appli | > | , or decision making. The type of modification and the impa | ||
| > | cation and process as well as the goals and objectives of th | > | ct it will have depends on the target application and proces | ||
| > | e adversary. For complex systems, an adversary would likely | > | s as well as the goals and objectives of the adversary. For | ||
| > | need special expertise and possibly access to specialized so | > | complex systems, an adversary would likely need special expe | ||
| > | ftware related to the system that would typically be gained | > | rtise and possibly access to specialized software related to | ||
| > | through a prolonged information gathering campaign in order | > | the system that would typically be gained through a prolong | ||
| > | to have the desired impact. | > | ed information gathering campaign in order to have the desir | ||
| > | ed impact. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may obfuscate command and control traffic to mak | t | 1 | Adversaries may obfuscate command and control traffic to mak |
| > | e it more difficult to detect. Command and control (C2) comm | > | e it more difficult to detect.(Citation: Bitdefender FunnyDr | ||
| > | unications are hidden (but not necessarily encrypted) in an | > | eam Campaign November 2020) Command and control (C2) communi | ||
| > | attempt to make the content more difficult to discover or de | > | cations are hidden (but not necessarily encrypted) in an att | ||
| > | cipher and to make the communication less conspicuous and hi | > | empt to make the content more difficult to discover or decip | ||
| > | de commands from being seen. This encompasses many methods, | > | her and to make the communication less conspicuous and hide | ||
| > | such as adding junk data to protocol traffic, using steganog | > | commands from being seen. This encompasses many methods, suc | ||
| > | raphy, or impersonating legitimate protocols. | > | h as adding junk data to protocol traffic, using steganograp | ||
| > | hy, or impersonating legitimate protocols. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may add junk data to protocols used for command | t | 1 | Adversaries may add junk data to protocols used for command |
| > | and control to make detection more difficult. By adding rand | > | and control to make detection more difficult.(Citation: Fire | ||
| > | om or meaningless data to the protocols used for command and | > | Eye SUNBURST Backdoor December 2020) By adding random or mea | ||
| > | control, adversaries can prevent trivial methods for decodi | > | ningless data to the protocols used for command and control, | ||
| > | ng, deciphering, or otherwise analyzing the traffic. Example | > | adversaries can prevent trivial methods for decoding, decip | ||
| > | s may include appending/prepending data with junk characters | > | hering, or otherwise analyzing the traffic. Examples may inc | ||
| > | or writing junk characters between significant characters. | > | lude appending/prepending data with junk characters or writi | ||
| > | ng junk characters between significant characters. |
gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "discovery"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1615",
"external_id": "T1615"
},
{
"source_name": "ADSecurity GPO Persistence 2016",
"description": "Metcalf, S. (2016, March 14). Sneaky Active Directory Persistence #17: Group Policy. Retrieved March 5, 2019.",
"url": "https://adsecurity.org/?p=2716"
},
{
"source_name": "Microsoft gpresult",
"description": "Microsoft. (2017, October 16). gpresult. Retrieved August 6, 2021.",
"url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult"
},
{
"source_name": "Github PowerShell Empire",
"description": "Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.",
"url": "https://github.com/PowerShellEmpire/Empire"
},
{
"source_name": "TechNet Group Policy Basics",
"description": "srachui. (2012, February 13). Group Policy Basics \u2013 Part 1: Understanding the Structure of a Group Policy Object. Retrieved March 5, 2019.",
"url": "https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.1.0",
"x_mitre_contributors": [
"Ted Samuels, Rapid7",
"Jonhnathan Ribeiro, 3CORESec, @_w0rk3r"
],
"x_mitre_data_sources": [
"Script: Script Execution",
"Active Directory: Active Directory Object Access",
"Process: Process Creation",
"Command: Command Execution",
"Network Traffic: Network Traffic Content"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.\n\nMonitor for suspicious use of gpresult. Monitor for the use of PowerShell functions such as Get-DomainGPO and Get-DomainGPOLocalGroup and processes spawning with command-line arguments containing GPOLocalGroup.\n\nMonitor for abnormal LDAP queries with filters for groupPolicyContainer and high volumes of LDAP traffic to domain controllers. Windows Event ID 4661 can also be used to detect when a directory service has been accessed.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['description']\": {\"new_value\": \"Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\\\gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.\", \"old_value\": \"Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\\\gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.\", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\\\\gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.\\n+Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.\"}}}",
"previous_version": "1.1",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may gather information on Group Policy settings | t | 1 | Adversaries may gather information on Group Policy settings |
| > | to identify paths for privilege escalation, security measure | > | to identify paths for privilege escalation, security measure | ||
| > | s applied within a domain, and to discover patterns in domai | > | s applied within a domain, and to discover patterns in domai | ||
| > | n objects that can be manipulated or used to blend in the en | > | n objects that can be manipulated or used to blend in the en | ||
| > | vironment. Group Policy allows for centralized management of | > | vironment. Group Policy allows for centralized management of | ||
| > | user and computer settings in Active Directory (AD). Group | > | user and computer settings in Active Directory (AD). Group | ||
| > | policy objects (GPOs) are containers for group policy settin | > | policy objects (GPOs) are containers for group policy settin | ||
| > | gs made up of files stored within a predictable network path | > | gs made up of files stored within a predictable network path | ||
| > | `\\<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\`.(Citation: TechNet Gr | > | `\\<DOMAIN>\\SYSVOL\\<DOMAIN>\\Policies\\`.(Citation: TechNet Gr | ||
| > | oup Policy Basics)(Citation: ADSecurity GPO Persistence 2016 | > | oup Policy Basics)(Citation: ADSecurity GPO Persistence 2016 | ||
| > | ) Adversaries may use commands such as <code>gpresult</code | > | ) Adversaries may use commands such as <code>gpresult</code | ||
| > | > or various publicly available PowerShell functions, such a | > | > or various publicly available PowerShell functions, such a | ||
| > | s <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGro | > | s <code>Get-DomainGPO</code> and <code>Get-DomainGPOLocalGro | ||
| > | up</code>, to gather information on Group Policy settings.(C | > | up</code>, to gather information on Group Policy settings.(C | ||
| > | itation: Microsoft gpresult)(Citation: Github PowerShell Emp | > | itation: Microsoft gpresult)(Citation: Github PowerShell Emp | ||
| > | ire) Adversaries may use this information to shape follow-on | > | ire) Adversaries may use this information to shape follow-on | ||
| > | behaviors, including determining potential attack paths wit | > | behaviors, including determining potential attack paths wit | ||
| > | hin the target network as well as opportunities to manipulat | > | hin the target network as well as opportunities to manipulat | ||
| > | e Group Policy settings (i.e. [Domain Policy Modification](h | > | e Group Policy settings (i.e. [Domain or Tenant Policy Modif | ||
| > | ttps://attack.mitre.org/techniques/T1484)) for their benefit | > | ication](https://attack.mitre.org/techniques/T1484)) for the | ||
| > | . | > | ir benefit. |
StopLogging and DeleteTrail.(Citation: Stopping CloudTrail from Sending Events to CloudWatch Logs) In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.(Citation: Configuring Data Access audit logs) In Azure, monitor for az monitor diagnostic-settings delete.(Citation: az monitor diagnostic-settings) Additionally, a sudden loss of a log source may indicate that it has been disabled. ",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"IaaS",
"SaaS",
"Google Workspace",
"Azure AD",
"Office 365"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-12 21:13:56.431000+00:00\", \"old_value\": \"2023-10-15 10:47:17.305000+00:00\"}}}",
"previous_version": "2.0",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0002: User Account (User Account Modification)",
"DS0025: Cloud Service (Cloud Service Disable)",
"DS0025: Cloud Service (Cloud Service Modification)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-21 20:32:20.810000+00:00",
"modified": "2024-04-12 21:13:46.640000+00:00",
"name": "Disable or Modify Tools",
"description": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) \n\nAdversaries may also focus on specific applications such as Sysmon. For example, the \u201cStart\u201d and \u201cEnable\u201d values in HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) \n\nOn network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369)\n\nIn cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.\n\nFurthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)\n\nAdditionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1562/001",
"external_id": "T1562.001"
},
{
"source_name": "Analysis of FG-IR-22-369",
"description": " Guillaume Lovet and Alex Kong. (2023, March 9). Analysis of FG-IR-22-369. Retrieved May 15, 2023.",
"url": "https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis"
},
{
"source_name": "Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation",
"description": "ALEXANDER MARVI, BRAD SLAYBAUGH, DAN EBREO, TUFAIL AHMED, MUHAMMAD UMAIR, TINA JOHNSON. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved May 15, 2023.",
"url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
},
{
"source_name": "OutFlank System Calls",
"description": "de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.",
"url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"
},
{
"source_name": "disable_win_evt_logging",
"description": "Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.",
"url": "https://ptylu.github.io/content/report/report.html?report=25"
},
{
"source_name": "chasing_avaddon_ransomware",
"description": "Hernandez, A. S. Tarter, P. Ocamp, E. J. (2022, January 19). One Source to Rule Them All: Chasing AVADDON Ransomware. Retrieved January 26, 2022.",
"url": "https://www.mandiant.com/resources/chasing-avaddon-ransomware"
},
{
"source_name": "doppelpaymer_crowdstrike",
"description": "Hurley, S. (2021, December 7). Critical Hit: How DoppelPaymer Hunts and Kills Windows Processes. Retrieved January 26, 2022.",
"url": "https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/"
},
{
"source_name": "avoslocker_ransomware",
"description": "Lakshmanan, R. (2022, May 2). AvosLocker Ransomware Variant Using New Trick to Disable Antivirus Protection. Retrieved May 17, 2022.",
"url": "https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html"
},
{
"source_name": "dharma_ransomware",
"description": "Loui, E. Scheuerman, K. et al. (2020, April 16). Targeted Dharma Ransomware Intrusions Exhibit Consistent Techniques. Retrieved January 26, 2022.",
"url": "https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/"
},
{
"source_name": "MDSec System Calls",
"description": "MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.",
"url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
},
{
"source_name": "SCADAfence_ransomware",
"description": "Shaked, O. (2020, January 20). Anatomy of a Targeted Ransomware Attack. Retrieved June 18, 2022.",
"url": "https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf"
},
{
"source_name": "demystifying_ryuk",
"description": "Tran, T. (2020, November 24). Demystifying Ransomware Attacks Against Microsoft Defender Solution. Retrieved January 26, 2022.",
"url": "https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/demystifying-ransomware-attacks-against-microsoft-defender/ba-p/1928947"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Gordon Long, Box, Inc., @ethicalhax",
"Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security",
"Nathaniel Quist, Palo Alto Networks",
"Gal Singer, @galsinger29, Team Nautilus Aqua Security",
"Daniel Feichter, @VirtualAllocEx, Infosec Tirol",
"Cian Heasley",
"Alex Soler, AttackIQ",
"Sarathkumar Rajendran, Microsoft Defender365",
"Lucas Heiligenstein"
],
"x_mitre_data_sources": [
"Sensor Health: Host Status",
"Process: Process Termination",
"Process: Process Creation",
"Service: Service Metadata",
"Windows Registry: Windows Registry Key Modification",
"Command: Command Execution",
"Windows Registry: Windows Registry Key Deletion",
"Driver: Driver Load"
],
"x_mitre_defense_bypassed": [
"Anti-virus",
"Log analysis",
"Signature-based detection",
"Host intrusion prevention systems",
"File monitoring"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Monitor processes and command-line arguments to see if security tools/services are killed or stop running. Monitor Registry edits for modifications to services and startup programs that correspond to security tools. Monitoring for changes to other known features used by deployed security tools may also expose malicious activity.\n\nLack of expected log events may be suspicious.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"macOS",
"Linux",
"Containers",
"IaaS",
"Network"
],
"x_mitre_version": "1.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-12 21:13:46.640000+00:00\", \"old_value\": \"2023-05-28 16:57:27.185000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}}",
"previous_version": "1.5",
"changelog_mitigations": {
"shared": [
"M1018: User Account Management",
"M1022: Restrict File and Directory Permissions",
"M1024: Restrict Registry Permissions",
"M1038: Execution Prevention"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0009: Process (Process Termination)",
"DS0013: Sensor Health (Host Status)",
"DS0017: Command (Command Execution)",
"DS0019: Service (Service Metadata)",
"DS0024: Windows Registry (Windows Registry Key Deletion)",
"DS0024: Windows Registry (Windows Registry Key Modification)",
"DS0027: Driver (Driver Load)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-03-02 19:05:18.137000+00:00",
"modified": "2024-01-31 14:09:27.066000+00:00",
"name": "Spearphishing Attachment",
"description": "Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "initial-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1566/001",
"external_id": "T1566.001"
},
{
"source_name": "ACSC Email Spoofing",
"description": "Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.",
"url": "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
},
{
"source_name": "Unit 42 DarkHydrus July 2018",
"description": "Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
},
{
"source_name": "Microsoft Anti Spoofing",
"description": "Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.",
"url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
},
{
"source_name": "Elastic - Koadiac Detection with EQL",
"description": "Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.",
"url": "https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Philip Winther"
],
"x_mitre_data_sources": [
"Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow",
"Application Log: Application Log Content",
"File: File Creation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "Network intrusion detection systems and email gateways can be used to detect spearphishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.\n\nFiltering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)\n\nAnti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the attachment is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning Powershell.exe) for techniques such as [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) or usage of malicious scripts.\n\nMonitor for suspicious descendant process spawning from Microsoft Office and other productivity software.(Citation: Elastic - Koadiac Detection with EQL)",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS",
"Windows",
"Linux"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-31 14:09:27.066000+00:00\", \"old_value\": \"2023-03-30 21:01:42.995000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\\n\\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. \", \"old_value\": \"Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\\n\\nThere are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. \", \"diff\": \"--- \\n+++ \\n@@ -1,3 +1,3 @@\\n-Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\\n+Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\\n \\n There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files. Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system. The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so. The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses. Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one. \"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][2]\": {\"source_name\": \"Unit 42 DarkHydrus July 2018\", \"description\": \"Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.\", \"url\": \"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/\"}}}",
"previous_version": "2.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing emails with a malicious a | t | 1 | Adversaries may send spearphishing emails with a malicious a |
| > | ttachment in an attempt to gain access to victim systems. Sp | > | ttachment in an attempt to gain access to victim systems. Sp | ||
| > | earphishing attachment is a specific variant of spearphishin | > | earphishing attachment is a specific variant of spearphishin | ||
| > | g. Spearphishing attachment is different from other forms of | > | g. Spearphishing attachment is different from other forms of | ||
| > | spearphishing in that it employs the use of malware attache | > | spearphishing in that it employs the use of malware attache | ||
| > | d to an email. All forms of spearphishing are electronically | > | d to an email. All forms of spearphishing are electronically | ||
| > | delivered social engineering targeted at a specific individ | > | delivered social engineering targeted at a specific individ | ||
| > | ual, company, or industry. In this scenario, adversaries att | > | ual, company, or industry. In this scenario, adversaries att | ||
| > | ach a file to the spearphishing email and usually rely upon | > | ach a file to the spearphishing email and usually rely upon | ||
| > | [User Execution](https://attack.mitre.org/techniques/T1204) | > | [User Execution](https://attack.mitre.org/techniques/T1204) | ||
| > | to gain execution. Spearphishing may also involve social eng | > | to gain execution.(Citation: Unit 42 DarkHydrus July 2018) S | ||
| > | ineering techniques, such as posing as a trusted source. Th | > | pearphishing may also involve social engineering techniques, | ||
| > | ere are many options for the attachment such as Microsoft Of | > | such as posing as a trusted source. There are many options | ||
| > | fice documents, executables, PDFs, or archived files. Upon o | > | for the attachment such as Microsoft Office documents, exec | ||
| > | pening the attachment (and potentially clicking past protect | > | utables, PDFs, or archived files. Upon opening the attachmen | ||
| > | ions), the adversary's payload exploits a vulnerability or d | > | t (and potentially clicking past protections), the adversary | ||
| > | irectly executes on the user's system. The text of the spear | > | 's payload exploits a vulnerability or directly executes on | ||
| > | phishing email usually tries to give a plausible reason why | > | the user's system. The text of the spearphishing email usual | ||
| > | the file should be opened, and may explain how to bypass sys | > | ly tries to give a plausible reason why the file should be o | ||
| > | tem protections in order to do so. The email may also contai | > | pened, and may explain how to bypass system protections in o | ||
| > | n instructions on how to decrypt an attachment, such as a zi | > | rder to do so. The email may also contain instructions on ho | ||
| > | p file password, in order to evade email boundary defenses. | > | w to decrypt an attachment, such as a zip file password, in | ||
| > | Adversaries frequently manipulate file extensions and icons | > | order to evade email boundary defenses. Adversaries frequent | ||
| > | in order to make attached executables appear to be document | > | ly manipulate file extensions and icons in order to make att | ||
| > | files, or files exploiting one application appear to be a fi | > | ached executables appear to be document files, or files expl | ||
| > | le for a different one. | > | oiting one application appear to be a file for a different o | ||
| > | ne. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may send spearphishing messages via third-party | t | 1 | Adversaries may send spearphishing messages via third-party |
| > | services in an attempt to gain access to victim systems. Spe | > | services in an attempt to gain access to victim systems. Spe | ||
| > | arphishing via service is a specific variant of spearphishin | > | arphishing via service is a specific variant of spearphishin | ||
| > | g. It is different from other forms of spearphishing in that | > | g. It is different from other forms of spearphishing in that | ||
| > | it employs the use of third party services rather than dire | > | it employs the use of third party services rather than dire | ||
| > | ctly via enterprise email channels. All forms of spearphis | > | ctly via enterprise email channels. All forms of spearphis | ||
| > | hing are electronically delivered social engineering targete | > | hing are electronically delivered social engineering targete | ||
| > | d at a specific individual, company, or industry. In this sc | > | d at a specific individual, company, or industry. In this sc | ||
| > | enario, adversaries send messages through various social med | > | enario, adversaries send messages through various social med | ||
| > | ia services, personal webmail, and other non-enterprise cont | > | ia services, personal webmail, and other non-enterprise cont | ||
| > | rolled services. These services are more likely to have a le | > | rolled services.(Citation: Lookout Dark Caracal Jan 2018) Th | ||
| > | ss-strict security policy than an enterprise. As with most k | > | ese services are more likely to have a less-strict security | ||
| > | inds of spearphishing, the goal is to generate rapport with | > | policy than an enterprise. As with most kinds of spearphishi | ||
| > | the target or get the target's interest in some way. Adversa | > | ng, the goal is to generate rapport with the target or get t | ||
| > | ries will create fake social media accounts and message empl | > | he target's interest in some way. Adversaries will create fa | ||
| > | oyees for potential job opportunities. Doing so allows a pla | > | ke social media accounts and message employees for potential | ||
| > | usible reason for asking about services, policies, and softw | > | job opportunities. Doing so allows a plausible reason for a | ||
| > | are that's running in an environment. The adversary can then | > | sking about services, policies, and software that's running | ||
| > | send malicious links or attachments through these services. | > | in an environment. The adversary can then send malicious lin | ||
| > | A common example is to build rapport with a target via soc | > | ks or attachments through these services. A common example | ||
| > | ial media, then send content to a personal webmail service t | > | is to build rapport with a target via social media, then sen | ||
| > | hat the target uses on their work computer. This allows an a | > | d content to a personal webmail service that the target uses | ||
| > | dversary to bypass some email restrictions on the work accou | > | on their work computer. This allows an adversary to bypass | ||
| > | nt, and the target is more likely to open the file since it' | > | some email restrictions on the work account, and the target | ||
| > | s something they were expecting. If the payload doesn't work | > | is more likely to open the file since it's something they we | ||
| > | as expected, the adversary can continue normal communicatio | > | re expecting. If the payload doesn't work as expected, the a | ||
| > | ns and troubleshoot with the target on how to get it working | > | dversary can continue normal communications and troubleshoot | ||
| > | . | > | with the target on how to get it working. |
/usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.(Citation: objective-see ay mami 2018)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "defense-evasion"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1553/004",
"external_id": "T1553.004"
},
{
"source_name": "Operation Emmental",
"description": "botconf eu. (2014, December 31). David Sancho - Finding Holes in Banking 2FA: Operation Emmental. Retrieved January 4, 2024.",
"url": "https://www.youtube.com/watch?v=gchKFumYHWc"
},
{
"source_name": "SpectorOps Code Signing Dec 2017",
"description": "Graeber, M. (2017, December 22). Code Signing Certificate Cloning Attacks and Defenses. Retrieved April 3, 2018.",
"url": "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec"
},
{
"source_name": "Kaspersky Superfish",
"description": "Onuma. (2015, February 24). Superfish: Adware Preinstalled on Lenovo Laptops. Retrieved February 20, 2017.",
"url": "https://www.kaspersky.com/blog/lenovo-pc-with-adware-superfish-preinstalled/7712/"
},
{
"source_name": "objective-see ay mami 2018",
"description": "Patrick Wardle. (2018, January 11). Ay MaMi. Retrieved March 19, 2018.",
"url": "https://objective-see.com/blog/blog_0x26.html"
},
{
"source_name": "Microsoft Sigcheck May 2017",
"description": "Russinovich, M. et al.. (2017, May 22). Sigcheck. Retrieved April 3, 2018.",
"url": "https://docs.microsoft.com/sysinternals/downloads/sigcheck"
},
{
"source_name": "Tripwire AppUNBlocker",
"description": "Smith, T. (2016, October 27). AppUNBlocker: Bypassing AppLocker. Retrieved December 19, 2017.",
"url": "https://www.tripwire.com/state-of-security/off-topic/appunblocker-bypassing-applocker/"
},
{
"source_name": "Wikipedia Root Certificate",
"description": "Wikipedia. (2016, December 6). Root certificate. Retrieved February 20, 2017.",
"url": "https://en.wikipedia.org/wiki/Root_certificate"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Matt Graeber, @mattifestation, SpecterOps",
"Red Canary",
"Travis Smith, Tripwire",
"Itzik Kotler, SafeBreach"
],
"x_mitre_data_sources": [
"Command: Command Execution",
"Process: Process Creation",
"Windows Registry: Windows Registry Key Modification",
"Windows Registry: Windows Registry Key Creation"
],
"x_mitre_defense_bypassed": [
"Digital Certificate Validation"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "A system's root certificates are unlikely to change frequently. Monitor new certificates installed on a system that could be due to malicious activity.(Citation: SpectorOps Code Signing Dec 2017) Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present. Microsoft provides a list of trustworthy root certificates online and through authroot.stl.(Citation: SpectorOps Code Signing Dec 2017) The Sysinternals Sigcheck utility can also be used (sigcheck[64].exe -tuv) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List.(Citation: Microsoft Sigcheck May 2017)\n\nInstalled root certificates are located in the Registry under HKLM\\SOFTWARE\\Microsoft\\EnterpriseCertificates\\Root\\Certificates\\ and [HKLM or HKCU]\\Software[\\Policies\\]\\Microsoft\\SystemCertificates\\Root\\Certificates\\. There are a subset of root certificates that are consistent across Windows systems and can be used for comparison:(Citation: Tripwire AppUNBlocker)\n\n* 18F7C1FCC3090203FD5BAA2F861A754976C8DD25\n* 245C97DF7514E7CF2DF8BE72AE957B9E04741E85\n* 3B1EFD3A66EA28B16697394703A72CA340A05BD5\n* 7F88CD7223F3C813818C994614A89C99FA3B5247\n* 8F43288AD272F3103B6FB1428485EA3014C0BCFE\n* A43489159A520F0D93D032CCAF37E7FE20A8B419\n* BE36A4562FB2EE05DBB3D32323ADF445084ED656\n* CDD4EEAE6000AC7F40C3802C171E30148030C072",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": true,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-01-04 20:01:27.662000+00:00\", \"old_value\": \"2023-09-15 17:26:02.203000+00:00\"}, \"root['external_references'][5]['description']\": {\"new_value\": \"botconf eu. (2014, December 31). David Sancho - Finding Holes in Banking 2FA: Operation Emmental. Retrieved January 4, 2024.\", \"old_value\": \"Sancho, D., Hacquebord, F., Link, R. (2014, July 22). Finding Holes Operation Emmental. Retrieved February 9, 2016.\"}, \"root['external_references'][5]['url']\": {\"new_value\": \"https://www.youtube.com/watch?v=gchKFumYHWc\", \"old_value\": \"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-finding-holes-operation-emmental.pdf\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}}",
"previous_version": "1.2",
"changelog_mitigations": {
"shared": [
"M1028: Operating System Configuration",
"M1054: Software Configuration"
],
"new": [],
"dropped": []
},
"changelog_detections": {
"shared": [
"DS0009: Process (Process Creation)",
"DS0017: Command (Command Execution)",
"DS0024: Windows Registry (Windows Registry Key Creation)",
"DS0024: Windows Registry (Windows Registry Key Modification)"
],
"new": [],
"dropped": []
}
},
{
"type": "attack-pattern",
"id": "attack-pattern--435dfb86-2697-4867-85b5-2fef496c0517",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-02-04 12:47:23.631000+00:00",
"modified": "2024-04-15 21:33:12.892000+00:00",
"name": "Unsecured Credentials",
"description": "Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "credential-access"
}
],
"revoked": false,
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/techniques/T1552",
"external_id": "T1552"
},
{
"source_name": "Brining MimiKatz to Unix",
"description": "Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.",
"url": "https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Austin Clark, @c2defense"
],
"x_mitre_data_sources": [
"Windows Registry: Windows Registry Key Access",
"Application Log: Application Log Content",
"Command: Command Execution",
"Process: Process Creation",
"File: File Access",
"User Account: User Account Authentication"
],
"x_mitre_deprecated": false,
"x_mitre_detection": "While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information.\n\nMonitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments indicative of searching for credential material (ex: regex patterns). These may be indicators of automated/scripted credential access behavior.\n\nMonitoring when the user's .bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like \"history\" instead of commands like cat ~/.bash_history.\n\nAdditionally, monitor processes for applications that can be used to query the Registry, such as [Reg](https://attack.mitre.org/software/S0075), and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.",
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_is_subtechnique": false,
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows",
"Azure AD",
"Office 365",
"SaaS",
"IaaS",
"Linux",
"macOS",
"Google Workspace",
"Containers",
"Network"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-15 21:33:12.892000+00:00\", \"old_value\": \"2023-04-13 00:29:53.605000+00:00\"}, \"root['description']\": {\"new_value\": \"Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)\", \"old_value\": \"Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Bash History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}}, \"iterable_item_added\": {\"root['external_references'][1]\": {\"source_name\": \"Brining MimiKatz to Unix\", \"description\": \"Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.\", \"url\": \"https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf\"}}}",
"previous_version": "1.3",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search compromised systems to find and obtai | t | 1 | Adversaries may search compromised systems to find and obtai |
| > | n insecurely stored credentials. These credentials can be st | > | n insecurely stored credentials. These credentials can be st | ||
| > | ored and/or misplaced in many locations on a system, includi | > | ored and/or misplaced in many locations on a system, includi | ||
| > | ng plaintext files (e.g. [Bash History](https://attack.mitre | > | ng plaintext files (e.g. [Bash History](https://attack.mitre | ||
| > | .org/techniques/T1552/003)), operating system or application | > | .org/techniques/T1552/003)), operating system or application | ||
| > | -specific repositories (e.g. [Credentials in Registry](https | > | -specific repositories (e.g. [Credentials in Registry](https | ||
| > | ://attack.mitre.org/techniques/T1552/002)), or other special | > | ://attack.mitre.org/techniques/T1552/002)), or other specia | ||
| > | ized files/artifacts (e.g. [Private Keys](https://attack.mit | > | lized files/artifacts (e.g. [Private Keys](https://attack.mi | ||
| > | re.org/techniques/T1552/004)). | > | tre.org/techniques/T1552/004)).(Citation: Brining MimiKatz t | ||
| > | o Unix) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may search local file systems and remote file sh | t | 1 | Adversaries may search local file systems and remote file sh |
| > | ares for files containing insecurely stored credentials. The | > | ares for files containing insecurely stored credentials. The | ||
| > | se can be files created by users to store their own credenti | > | se can be files created by users to store their own credenti | ||
| > | als, shared credential stores for a group of individuals, co | > | als, shared credential stores for a group of individuals, co | ||
| > | nfiguration files containing passwords for a system or servi | > | nfiguration files containing passwords for a system or servi | ||
| > | ce, or source code/binary files containing embedded password | > | ce, or source code/binary files containing embedded password | ||
| > | s. It is possible to extract passwords from backups or save | > | s. It is possible to extract passwords from backups or save | ||
| > | d virtual machines through [OS Credential Dumping](https://a | > | d virtual machines through [OS Credential Dumping](https://a | ||
| > | ttack.mitre.org/techniques/T1003). (Citation: CG 2014) Passw | > | ttack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwo | ||
| > | ords may also be obtained from Group Policy Preferences stor | > | rds may also be obtained from Group Policy Preferences store | ||
| > | ed on the Windows Domain Controller. (Citation: SRD GPP) In | > | d on the Windows Domain Controller.(Citation: SRD GPP) In c | ||
| > | cloud and/or containerized environments, authenticated user | > | loud and/or containerized environments, authenticated user a | ||
| > | and service account credentials are often stored in local c | > | nd service account credentials are often stored in local con | ||
| > | onfiguration and credential files.(Citation: Unit 42 Hildega | > | figuration and credential files.(Citation: Unit 42 Hildegard | ||
| > | rd Malware) They may also be found as parameters to deployme | > | Malware) They may also be found as parameters to deployment | ||
| > | nt commands in container logs.(Citation: Unit 42 Unsecured D | > | commands in container logs.(Citation: Unit 42 Unsecured Doc | ||
| > | ocker Daemons) In some cases, these files can be copied and | > | ker Daemons) In some cases, these files can be copied and re | ||
| > | reused on another machine or the contents can be read and th | > | used on another machine or the contents can be read and then | ||
| > | en used to authenticate without needing to copy any files.(C | > | used to authenticate without needing to copy any files.(Cit | ||
| > | itation: Specter Ops - Cloud Credential Storage) | > | ation: Specter Ops - Cloud Credential Storage) |
\u201cShe took his coat and hung it up\u201d.(Citation: NCSC-NL COATHANGER Feb 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1105",
"external_id": "S1105"
},
{
"source_name": "NCSC-NL COATHANGER Feb 2024",
"description": "Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.",
"url": "https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"COATHANGER"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--5d3fa1db-5041-4560-b87b-8f61cc225c52",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-12-18 20:24:33.641000+00:00",
"modified": "2024-04-15 23:22:28.176000+00:00",
"name": "Cheerscrypt",
"description": "[Cheerscrypt](https://attack.mitre.org/software/S1096) is a ransomware that was developed by [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) and has been used in attacks against ESXi and Windows environments since at least 2022. [Cheerscrypt](https://attack.mitre.org/software/S1096) was derived from the leaked [Babuk](https://attack.mitre.org/software/S0638) source code and has infrastructure overlaps with deployments of Night Sky ransomware, which was also derived from [Babuk](https://attack.mitre.org/software/S0638).(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: Trend Micro Cheerscrypt May 2022)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1096",
"external_id": "S1096"
},
{
"source_name": "Sygnia Emperor Dragonfly October 2022",
"description": "Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.",
"url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
},
{
"source_name": "Trend Micro Cheerscrypt May 2022",
"description": "Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.",
"url": "https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Cheerscrypt"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--6f6f67c9-556d-4459-95c2-78d272190e52",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-09 19:52:30.428000+00:00",
"modified": "2024-04-01 21:19:06.580000+00:00",
"name": "DarkGate",
"description": "[DarkGate](https://attack.mitre.org/software/S1111) first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named \"DarkGate\" by its author, [DarkGate](https://attack.mitre.org/software/S1111) is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.(Citation: Ensilo Darkgate 2018) DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.(Citation: Trellix Darkgate 2023)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1111",
"external_id": "S1111"
},
{
"source_name": "Ensilo Darkgate 2018",
"description": "Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.",
"url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
},
{
"source_name": "Trellix Darkgate 2023",
"description": "Ernesto Fern\u00e1ndez Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.",
"url": "https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"DarkGate"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Serhii Melnyk, Trustwave SpiderLabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--bcaae558-9697-47a2-9ec7-c75000ddf58c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-08 20:20:05.588000+00:00",
"modified": "2024-03-08 20:21:24.195000+00:00",
"name": "FRAMESTING",
"description": "[FRAMESTING](https://attack.mitre.org/software/S1120) is a Python web shell that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to embed into an Ivanti Connect Secure Python package for command execution.(Citation: Mandiant Cutting Edge Part 2 January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1120",
"external_id": "S1120"
},
{
"source_name": "Mandiant Cutting Edge Part 2 January 2024",
"description": "Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"FRAMESTING"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--554e010d-726b-439d-9a1a-f60fff0cc109",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-06 19:14:43.437000+00:00",
"modified": "2024-03-06 19:15:21.887000+00:00",
"name": "GLASSTOKEN",
"description": "[GLASSTOKEN](https://attack.mitre.org/software/S1117) is a custom web shell used by threat actors during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to execute commands on compromised Ivanti Secure Connect VPNs.(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1117",
"external_id": "S1117"
},
{
"source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
"description": "Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024.",
"url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"GLASSTOKEN"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--54089fba-8662-4f37-9a44-6ad25a5f630a",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2023-12-22 20:03:48.505000+00:00",
"modified": "2024-01-02 20:44:36.518000+00:00",
"name": "HUI Loader",
"description": "[HUI Loader](https://attack.mitre.org/software/S1097) is a custom DLL loader that has been used since at least 2015 by China-based threat groups including [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) and [menuPass](https://attack.mitre.org/groups/G0045) to deploy malware on compromised hosts. [HUI Loader](https://attack.mitre.org/software/S1097) has been observed in campaigns loading [SodaMaster](https://attack.mitre.org/software/S0627), [PlugX](https://attack.mitre.org/software/S0013), [Cobalt Strike](https://attack.mitre.org/software/S0154), [Komplex](https://attack.mitre.org/software/S0162), and several strains of ransomware.(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1097",
"external_id": "S1097"
},
{
"source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
"description": "Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.",
"url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"HUI Loader"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--5dc9e8ec-9917-4de7-b8ab-16007899dd80",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-07 20:52:41.463000+00:00",
"modified": "2024-03-28 19:18:39.684000+00:00",
"name": "LIGHTWIRE",
"description": "[LIGHTWIRE](https://attack.mitre.org/software/S1119) is a web shell written in Perl that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to maintain access and enable command execution by imbedding into the legitimate compcheckresult.cgi component of Ivanti Secure Connect VPNs.(Citation: Mandiant Cutting Edge Part 2 January 2024)(Citation: Mandiant Cutting Edge January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1119",
"external_id": "S1119"
},
{
"source_name": "Mandiant Cutting Edge Part 2 January 2024",
"description": "Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"description": "McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"LIGHTWIRE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--19256855-65e9-48f2-8b74-9f3d0a994428",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-13 18:41:57.589000+00:00",
"modified": "2024-04-17 20:47:19.566000+00:00",
"name": "LITTLELAMB.WOOLTEA",
"description": "[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) is a backdoor that was used by UNC5325 during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to deploy malware on targeted Ivanti Connect Secure VPNs and to establish persistence across system upgrades and patches.(Citation: Mandiant Cutting Edge Part 3 February 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1121",
"external_id": "S1121"
},
{
"source_name": "Mandiant Cutting Edge Part 3 February 2024",
"description": "Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"LITTLELAMB.WOOLTEA"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--452da2d9-706c-4185-ad6f-f5edaf4b9f48",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-01-19 21:08:29.427000+00:00",
"modified": "2024-01-19 21:09:35.017000+00:00",
"name": "LoFiSe",
"description": "[LoFiSe](https://attack.mitre.org/software/S1101) has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to identify and collect files of interest on targeted systems.(Citation: Kaspersky ToddyCat Check Logs October 2023)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1101",
"external_id": "S1101"
},
{
"source_name": "Kaspersky ToddyCat Check Logs October 2023",
"description": "Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"LoFiSe"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--4e6464d2-69df-4e56-8d4c-1973f84d7b80",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-13 20:59:22.655000+00:00",
"modified": "2024-04-18 14:15:33.229000+00:00",
"name": "Mispadu",
"description": "[Mispadu](https://attack.mitre.org/software/S1122) is a banking trojan written in Delphi that was first observed in 2019 and uses a Malware-as-a-Service (MaaS) business model.(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: SCILabs Malteiro 2021) This malware is operated, managed, and sold by the [Malteiro](https://attack.mitre.org/groups/G1026) cybercriminal group.(Citation: SCILabs Malteiro 2021) [Mispadu](https://attack.mitre.org/software/S1122) has mainly been used to target victims in Brazil and Mexico, and has also had confirmed operations throughout Latin America and Europe.(Citation: SCILabs Malteiro 2021)(Citation: SCILabs URSA/Mispadu Evolution 2023)(Citation: Seguran\u00e7a Inform\u00e1tica URSA Sophisticated Loader 2020) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1122",
"external_id": "S1122"
},
{
"source_name": "ESET Security Mispadu Facebook Ads 2019",
"description": "ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.",
"url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"
},
{
"source_name": "Seguran\u00e7a Inform\u00e1tica URSA Sophisticated Loader 2020",
"description": "Pedro Tavares (Seguran\u00e7a Inform\u00e1tica). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.",
"url": "https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/"
},
{
"source_name": "SCILabs Malteiro 2021",
"description": "SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.",
"url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
},
{
"source_name": "SCILabs URSA/Mispadu Evolution 2023",
"description": "SCILabs. (2023, May 23). Evolution of banking trojan URSA/Mispadu. Retrieved March 13, 2024.",
"url": "https://blog.scilabs.mx/en/evolution-of-banking-trojan-ursa-mispadu/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Mispadu"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"SCILabs"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--72b5f07f-5448-4e00-9ff2-08bc193a7b77",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-08 15:23:05.910000+00:00",
"modified": "2024-04-19 13:24:36.873000+00:00",
"name": "NGLite",
"description": "[NGLite](https://attack.mitre.org/software/S1106) is a backdoor Trojan that is only capable of running commands received through its C2 channel. While the capabilities are standard for a backdoor, NGLite uses a novel C2 channel that leverages a decentralized network based on the legitimate NKN to communicate between the backdoor and the actors.(Citation: NGLite Trojan)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1106",
"external_id": "S1106"
},
{
"source_name": "NGLite Trojan",
"description": "Robert Falcone, Jeff White, and Peter Renals. (2021, November 7). Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer. Retrieved February 8, 2024.",
"url": "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"NGLite"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--bd2ebee8-7c38-408a-871d-221012104222",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-08 15:41:33.284000+00:00",
"modified": "2024-04-13 14:10:23.936000+00:00",
"name": "NKAbuse",
"description": "[NKAbuse](https://attack.mitre.org/software/S1107) is a Go-based, multi-platform malware abusing NKN (New Kind of Network) technology for data exchange between peers, functioning as a potent implant, and equipped with both flooder and backdoor capabilities.(Citation: NKAbuse BC)(Citation: NKAbuse SL)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1107",
"external_id": "S1107"
},
{
"source_name": "NKAbuse BC",
"description": "Bill Toulas. (2023, December 14). New NKAbuse malware abuses NKN blockchain for stealthy comms. Retrieved February 8, 2024.",
"url": "https://www.bleepingcomputer.com/news/security/new-nkabuse-malware-abuses-nkn-blockchain-for-stealthy-comms/#google_vignette"
},
{
"source_name": "NKAbuse SL",
"description": "KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.",
"url": "https://securelist.com/unveiling-nkabuse/111512/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"NKAbuse"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--023254de-caaf-4a05-b2c7-e4e2f283f7a5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-01-11 18:40:51.497000+00:00",
"modified": "2024-04-17 22:02:37.451000+00:00",
"name": "Ninja",
"description": "[Ninja](https://attack.mitre.org/software/S1100) is a malware developed in C++ that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) to penetrate networks and control remote systems since at least 2020. [Ninja](https://attack.mitre.org/software/S1100) is possibly part of a post exploitation toolkit exclusively used by [ToddyCat](https://attack.mitre.org/groups/G1022) and allows multiple operators to work simultaneously on the same machine. [Ninja](https://attack.mitre.org/software/S1100) has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by [Samurai](https://attack.mitre.org/software/S1099).(Citation: Kaspersky ToddyCat June 2022)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1100",
"external_id": "S1100"
},
{
"source_name": "Kaspersky ToddyCat June 2022",
"description": "Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat/106799/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Ninja"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--647215dd-29a6-4528-b354-ca8b5e08fca1",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-08 19:38:27.401000+00:00",
"modified": "2024-04-10 21:08:49.143000+00:00",
"name": "PACEMAKER",
"description": "[PACEMAKER](https://attack.mitre.org/software/S1109) is a credential stealer that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including activity against US Defense Industrial Base (DIB) companies.(Citation: Mandiant Pulse Secure Zero-Day April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1109",
"external_id": "S1109"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PACEMAKER"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network",
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--d79b1800-3b5d-4a4f-8863-8251eca793e2",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-13 21:04:20.890000+00:00",
"modified": "2024-04-17 23:08:23.989000+00:00",
"name": "PITSTOP",
"description": "[PITSTOP](https://attack.mitre.org/software/S1123) is a backdoor that was deployed on compromised Ivanti Connect Secure VPNs during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to enable command execution and file read/write.(Citation: Mandiant Cutting Edge Part 3 February 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1123",
"external_id": "S1123"
},
{
"source_name": "Mandiant Cutting Edge Part 3 February 2024",
"description": "Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PITSTOP"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--9a097d18-d15f-4635-a4f1-189df7efdc40",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-08 18:30:54.263000+00:00",
"modified": "2024-04-10 21:06:18.500000+00:00",
"name": "PULSECHECK",
"description": "[PULSECHECK](https://attack.mitre.org/software/S1108) is a web shell written in Perl that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) companies.(Citation: Mandiant Pulse Secure Zero-Day April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1108",
"external_id": "S1108"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PULSECHECK"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network",
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--e4feffc2-53d1-45c9-904e-adb9faca0d15",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-01-22 19:21:29.473000+00:00",
"modified": "2024-01-22 19:21:48.480000+00:00",
"name": "Pcexter",
"description": "[Pcexter](https://attack.mitre.org/software/S1102) is an uploader that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2023 to exfiltrate stolen files.(Citation: Kaspersky ToddyCat Check Logs October 2023)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1102",
"external_id": "S1102"
},
{
"source_name": "Kaspersky ToddyCat Check Logs October 2023",
"description": "Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Pcexter"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--880f7b3e-ad27-4158-8b03-d44c9357950b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-13 17:50:25.350000+00:00",
"modified": "2024-04-05 18:28:57.216000+00:00",
"name": "RAPIDPULSE",
"description": "[RAPIDPULSE](https://attack.mitre.org/software/S1113) is a web shell that exists as a modification to a legitimate Pulse Secure file that has been used by [APT5](https://attack.mitre.org/groups/G1023) since at least 2021.(Citation: Mandiant Pulse Secure Update May 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1113",
"external_id": "S1113"
},
{
"source_name": "Mandiant Pulse Secure Update May 2021",
"description": "Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"RAPIDPULSE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network",
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--d1008b78-960c-4b36-bdc4-39a734e1e4e3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-09 19:21:04.773000+00:00",
"modified": "2024-04-10 21:08:18.197000+00:00",
"name": "SLIGHTPULSE",
"description": "[SLIGHTPULSE](https://attack.mitre.org/software/S1110) is a web shell that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including against Pulse Secure VPNs at US Defense Industrial Base (DIB) entities.(Citation: Mandiant Pulse Secure Zero-Day April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1110",
"external_id": "S1110"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SLIGHTPULSE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network",
"Linux"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--f8fc98ac-ad6d-44db-b6e2-f0c6eb4eace4",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-06 21:07:39.125000+00:00",
"modified": "2024-02-08 19:58:16.715000+00:00",
"name": "SLOWPULSE",
"description": "[SLOWPULSE](https://attack.mitre.org/software/S1104) is a malware that was used by [APT5](https://attack.mitre.org/groups/G1023) as early as 2020 including against U.S. Defense Industrial Base (DIB) companies. [SLOWPULSE](https://attack.mitre.org/software/S1104) has several variants and can modify legitimate Pulse Secure VPN files in order to log credentials and bypass single and two-factor authentication flows.(Citation: Mandiant Pulse Secure Zero-Day April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1104",
"external_id": "S1104"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SLOWPULSE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--ca0fead6-5277-427a-825b-42ff1fbe476e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-02-09 20:19:34.719000+00:00",
"modified": "2024-02-09 20:26:27.831000+00:00",
"name": "STEADYPULSE",
"description": "[STEADYPULSE](https://attack.mitre.org/software/S1112) is a web shell that infects targeted Pulse Secure VPN servers through modification of a legitimate Perl script that was used as early as 2020 including in activity against US Defense Industrial Base (DIB) entities.(Citation: Mandiant Pulse Secure Zero-Day April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1112",
"external_id": "S1112"
},
{
"source_name": "Mandiant Pulse Secure Zero-Day April 2021",
"description": "Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"STEADYPULSE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--ae91fb8f-5031-4f57-9839-e3be3ed503f0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-01-04 20:01:26.144000+00:00",
"modified": "2024-01-04 20:02:49.672000+00:00",
"name": "Samurai",
"description": "[Samurai](https://attack.mitre.org/software/S1099) is a passive backdoor that has been used by [ToddyCat](https://attack.mitre.org/groups/G1022) since at least 2020. [Samurai](https://attack.mitre.org/software/S1099) allows arbitrary C# code execution and is used with multiple modules for remote administration and lateral movement.(Citation: Kaspersky ToddyCat June 2022)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1099",
"external_id": "S1099"
},
{
"source_name": "Kaspersky ToddyCat June 2022",
"description": "Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.",
"url": "https://securelist.com/toddycat/106799/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Samurai"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--5911d2ca-64f6-49b3-b94f-29b5d185085c",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-22 19:21:30.424000+00:00",
"modified": "2024-04-06 00:08:07.956000+00:00",
"name": "SocGholish",
"description": "[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by [Mustard Tempest](https://attack.mitre.org/groups/G1020) and its access has been sold to groups including [Indrik Spider](https://attack.mitre.org/groups/G0119) for downloading secondary RAT and ransomware payloads.(Citation: SentinelOne SocGholish Infrastructure November 2022)(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile) ",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1124",
"external_id": "S1124"
},
{
"source_name": "FakeUpdates",
"description": "(Citation: Red Canary SocGholish March 2024)"
},
{
"source_name": "SocGholish-update",
"description": "Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.",
"url": "https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"
},
{
"source_name": "SentinelOne SocGholish Infrastructure November 2022",
"description": "Milenkoski, A. (2022, November 7). SocGholish Diversifies and Expands Its Malware Staging Infrastructure to Counter Defenders. Retrieved March 22, 2024.",
"url": "https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"
},
{
"source_name": "Red Canary SocGholish March 2024",
"description": "Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024.",
"url": "https://redcanary.com/threat-detection-report/threats/socgholish/"
},
{
"source_name": "Secureworks Gold Prelude Profile",
"description": "Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.",
"url": "https://www.secureworks.com/research/threat-profiles/gold-prelude"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SocGholish",
"FakeUpdates"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--a5818d36-e9b0-46da-842d-b727a5e36ea6",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-05 19:32:16.643000+00:00",
"modified": "2024-03-29 14:53:25.984000+00:00",
"name": "WARPWIRE",
"description": "[WARPWIRE](https://attack.mitre.org/software/S1116) is a Javascript credential stealer that targets plaintext passwords and usernames for exfiltration that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) to target Ivanti Connect Secure VPNs.(Citation: Mandiant Cutting Edge January 2024)(Citation: Mandiant Cutting Edge Part 2 January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1116",
"external_id": "S1116"
},
{
"source_name": "Mandiant Cutting Edge Part 2 January 2024",
"description": "Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"description": "McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"WARPWIRE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--c93e3079-43fb-4d8d-9e99-db63d07eadc9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-04 21:40:28.083000+00:00",
"modified": "2024-03-05 18:40:41.264000+00:00",
"name": "WIREFIRE",
"description": "[WIREFIRE](https://attack.mitre.org/software/S1115) is a web shell written in Python that exists as trojanized logic to the visits.py component of Ivanti Connect Secure VPN appliances. [WIREFIRE](https://attack.mitre.org/software/S1115) was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) for downloading files and command execution.(Citation: Mandiant Cutting Edge January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1115",
"external_id": "S1115"
},
{
"source_name": "GIFTEDVISITOR",
"description": "(Citation: Volexity Ivanti Zero-Day Exploitation January 2024)"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"description": "McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
},
{
"source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
"description": "Meltzer, M. et al. (2024, January 10). Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN. Retrieved February 27, 2024.",
"url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"WIREFIRE",
"GIFTEDVISITOR"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
},
{
"type": "malware",
"id": "malware--d9765cbd-4c88-4805-ba98-4c6ccb56b864",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2024-03-01 19:25:32.551000+00:00",
"modified": "2024-03-01 19:26:04.144000+00:00",
"name": "ZIPLINE",
"description": "[ZIPLINE](https://attack.mitre.org/software/S1114) is a passive backdoor that was used during [Cutting Edge](https://attack.mitre.org/campaigns/C0029) on compromised Secure Connect VPNs for reverse shell and proxy functionality.(Citation: Mandiant Cutting Edge January 2024)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1114",
"external_id": "S1114"
},
{
"source_name": "Mandiant Cutting Edge January 2024",
"description": "McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.",
"url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"ZIPLINE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Network"
],
"x_mitre_version": "1.0"
}
],
"major_version_changes": [
{
"type": "malware",
"id": "malware--99fdf3b4-96ef-4ab9-b191-fc683441cad0",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-11-18 19:07:48.008000+00:00",
"modified": "2023-12-04 19:42:13.073000+00:00",
"name": "Bazar",
"description": "[Bazar](https://attack.mitre.org/software/S0534) is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. [Bazar](https://attack.mitre.org/software/S0534) reportedly has ties to [TrickBot](https://attack.mitre.org/software/S0266) campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.(Citation: Cybereason Bazar July 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0534",
"external_id": "S0534"
},
{
"source_name": "Team9",
"description": "(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)"
},
{
"source_name": "KEGTAP",
"description": "(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: CrowdStrike Wizard Spider October 2020)"
},
{
"source_name": "Bazaloader",
"description": "(Citation: Microsoft Ransomware as a Service)"
},
{
"source_name": "Cybereason Bazar July 2020",
"description": "Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9\u2019S DEVELOPMENT CYCLES. Retrieved November 18, 2020.",
"url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
},
{
"source_name": "FireEye KEGTAP SINGLEMALT October 2020",
"description": "Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.",
"url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "NCC Group Team9 June 2020",
"description": "Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.",
"url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
},
{
"source_name": "CrowdStrike Wizard Spider October 2020",
"description": "Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.",
"url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Bazar",
"KEGTAP",
"Team9",
"Bazaloader"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Cybereason Nocturnus, @nocturnus"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-12-04 19:42:13.073000+00:00\", \"old_value\": \"2022-09-29 20:41:20.065000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.2\"}}, \"iterable_item_added\": {\"root['external_references'][3]\": {\"source_name\": \"Bazaloader\", \"description\": \"(Citation: Microsoft Ransomware as a Service)\"}, \"root['external_references'][6]\": {\"source_name\": \"Microsoft Ransomware as a Service\", \"description\": \"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/\"}, \"root['x_mitre_aliases'][3]\": \"Bazaloader\"}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 2.0"
},
{
"type": "malware",
"id": "malware--4e9bdf9a-4957-47f6-87b3-c76898d3f623",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-11-12 19:02:16.381000+00:00",
"modified": "2023-12-04 20:15:22.258000+00:00",
"name": "Diavol",
"description": "[Diavol](https://attack.mitre.org/software/S0659) is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The [Diavol](https://attack.mitre.org/software/S0659) Ransomware-as-a Service (RaaS) program is managed by [Wizard Spider](https://attack.mitre.org/groups/G0102) and it has been observed being deployed by [Bazar](https://attack.mitre.org/software/S0534).(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diavol Ransomware December 2021)(Citation: Microsoft Ransomware as a Service)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0659",
"external_id": "S0659"
},
{
"source_name": "Diavol",
"description": "(Citation: Fortinet Diavol July 2021)"
},
{
"source_name": "DFIR Diavol Ransomware December 2021",
"description": "DFIR Report. (2021, December 13). Diavol Ransomware. Retrieved March 9, 2022.",
"url": "https://thedfirreport.com/2021/12/13/diavol-ransomware/"
},
{
"source_name": "FBI Flash Diavol January 2022",
"description": "FBI. (2022, January 19). Indicators of Compromise Associated with Diavol. Retrieved March 9, 2022.",
"url": "https://www.ic3.gov/Media/News/2022/220120.pdf"
},
{
"source_name": "Microsoft Ransomware as a Service",
"description": "Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Fortinet Diavol July 2021",
"description": "Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.",
"url": "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Diavol"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Massimiliano Romano, BT Security"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.0",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-12-04 20:15:22.258000+00:00\", \"old_value\": \"2022-04-15 00:59:33.522000+00:00\"}, \"root['description']\": {\"new_value\": \"[Diavol](https://attack.mitre.org/software/S0659) is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The [Diavol](https://attack.mitre.org/software/S0659) Ransomware-as-a Service (RaaS) program is managed by [Wizard Spider](https://attack.mitre.org/groups/G0102) and it has been observed being deployed by [Bazar](https://attack.mitre.org/software/S0534).(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diavol Ransomware December 2021)(Citation: Microsoft Ransomware as a Service)\", \"old_value\": \"[Diavol](https://attack.mitre.org/software/S0659) is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. [Diavol](https://attack.mitre.org/software/S0659) has been deployed by [Bazar](https://attack.mitre.org/software/S0534) and is thought to have potential ties to [Wizard Spider](https://attack.mitre.org/groups/G0102).(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diavol Ransomware December 2021)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.0\", \"old_value\": \"1.0\"}}, \"iterable_item_added\": {\"root['external_references'][4]\": {\"source_name\": \"Microsoft Ransomware as a Service\", \"description\": \"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.\", \"url\": \"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 2.0",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Diavol](https://attack.mitre.org/software/S0659) is a ranso | t | 1 | [Diavol](https://attack.mitre.org/software/S0659) is a ranso |
| > | mware variant first observed in June 2021 that is capable of | > | mware variant first observed in June 2021 that is capable of | ||
| > | prioritizing file types to encrypt based on a pre-configure | > | prioritizing file types to encrypt based on a pre-configure | ||
| > | d list of extensions defined by the attacker. [Diavol](https | > | d list of extensions defined by the attacker. The [Diavol]( | ||
| > | ://attack.mitre.org/software/S0659) has been deployed by [Ba | > | https://attack.mitre.org/software/S0659) Ransomware-as-a Ser | ||
| > | zar](https://attack.mitre.org/software/S0534) and is thought | > | vice (RaaS) program is managed by [Wizard Spider](https://at | ||
| > | to have potential ties to [Wizard Spider](https://attack.mi | > | tack.mitre.org/groups/G0102) and it has been observed being | ||
| > | tre.org/groups/G0102).(Citation: Fortinet Diavol July 2021)( | > | deployed by [Bazar](https://attack.mitre.org/software/S0534) | ||
| > | Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diav | > | .(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash D | ||
| > | ol Ransomware December 2021) | > | iavol January 2022)(Citation: DFIR Diavol Ransomware Decembe | ||
| > | r 2021)(Citation: Microsoft Ransomware as a Service) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Kwampirs](https://attack.mitre.org/software/S0236) is a bac | t | 1 | [Kwampirs](https://attack.mitre.org/software/S0236) is a bac |
| > | kdoor Trojan used by [Orangeworm](https://attack.mitre.org/g | > | kdoor Trojan used by [Orangeworm](https://attack.mitre.org/g | ||
| > | roups/G0071). It has been found on machines which had softwa | > | roups/G0071). [Kwampirs](https://attack.mitre.org/software/S | ||
| > | re installed for the use and control of high-tech imaging de | > | 0236) has been found on machines which had software installe | ||
| > | vices such as X-Ray and MRI machines. (Citation: Symantec Or | > | d for the use and control of high-tech imaging devices such | ||
| > | angeworm April 2018) | > | as X-Ray and MRI machines.(Citation: Symantec Orangeworm Apr | ||
| > | il 2018) [Kwampirs](https://attack.mitre.org/software/S0236) | ||||
| > | has multiple technical overlaps with [Shamoon](https://atta | ||||
| > | ck.mitre.org/software/S0140) based on reverse engineering an | ||||
| > | alysis.(Citation: Cylera Kwampirs 2022) |
net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.",
"revoked": false,
"labels": [
"tool"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0039",
"external_id": "S0039"
},
{
"source_name": "Microsoft Net Utility",
"description": "Microsoft. (2006, October 18). Net.exe Utility. Retrieved September 22, 2015.",
"url": "https://msdn.microsoft.com/en-us/library/aa939914"
},
{
"source_name": "Savill 1999",
"description": "Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.",
"url": "https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Net",
"net.exe"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"David Ferguson, CyberSponse"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-01 04:34:30.855000+00:00\", \"old_value\": \"2023-07-25 19:25:59.767000+00:00\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference\", \"old_value\": \"http://windowsitpro.com/windows/netexe-reference\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.6\", \"old_value\": \"2.5\"}}}",
"previous_version": "2.5",
"version_change": "2.5 \u2192 2.6"
},
{
"type": "malware",
"id": "malware--b00f90b6-c75c-4bfd-b813-ca9e6c9ebf29",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-30 19:18:19.667000+00:00",
"modified": "2024-04-11 00:28:52.310000+00:00",
"name": "OSX_OCEANLOTUS.D",
"description": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a macOS backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First discovered in 2015, [APT32](https://attack.mitre.org/groups/G0050) has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can also determine it's permission level and execute according to access type (`root` or `user`).(Citation: Unit42 OceanLotus 2017)(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0352",
"external_id": "S0352"
},
{
"source_name": "Backdoor.MacOS.OCEANLOTUS.F",
"description": "(Citation: Trend Micro MacOS Backdoor November 2020)"
},
{
"source_name": "OSX_OCEANLOTUS.D",
"description": "(Citation: TrendMicro MacOS April 2018)"
},
{
"source_name": "Unit42 OceanLotus 2017",
"description": "Erye Hernandez and Danny Tsechansky. (2017, June 22). The New and Improved macOS Backdoor from OceanLotus. Retrieved September 8, 2023.",
"url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
},
{
"source_name": "TrendMicro MacOS April 2018",
"description": "Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.",
"url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"
},
{
"source_name": "Trend Micro MacOS Backdoor November 2020",
"description": "Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.",
"url": "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"OSX_OCEANLOTUS.D",
"Backdoor.MacOS.OCEANLOTUS.F"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"macOS"
],
"x_mitre_version": "3.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:28:52.310000+00:00\", \"old_value\": \"2023-10-12 20:21:08.235000+00:00\"}, \"root['x_mitre_version']\": {\"new_value\": \"3.1\", \"old_value\": \"3.0\"}}}",
"previous_version": "3.0",
"version_change": "3.0 \u2192 3.1"
},
{
"type": "malware",
"id": "malware--13183cdf-280b-46be-913a-5c6df47831e7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-05-24 14:55:59.316000+00:00",
"modified": "2024-04-11 00:25:13.397000+00:00",
"name": "PS1",
"description": "[PS1](https://attack.mitre.org/software/S0613) is a loader that was used to deploy 64-bit backdoors in the [CostaRicto](https://attack.mitre.org/groups/G0132) campaign.(Citation: BlackBerry CostaRicto November 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0613",
"external_id": "S0613"
},
{
"source_name": "BlackBerry CostaRicto November 2020",
"description": "The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.",
"url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PS1"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:25:13.397000+00:00\", \"old_value\": \"2022-10-05 16:04:51.193000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "tool",
"id": "tool--3a53b207-aba2-4a2b-9cdb-273d633669e7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-10-13 14:07:52.541000+00:00",
"modified": "2024-04-11 00:28:17.175000+00:00",
"name": "PcShare",
"description": "[PcShare](https://attack.mitre.org/software/S1050) is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: GitHub PcShare 2014)",
"revoked": false,
"labels": [
"tool"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1050",
"external_id": "S1050"
},
{
"source_name": "GitHub PcShare 2014",
"description": "LiveMirror. (2014, September 17). PcShare. Retrieved October 11, 2022.",
"url": "https://github.com/LiveMirror/pcshare"
},
{
"source_name": "Bitdefender FunnyDream Campaign November 2020",
"description": "Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PcShare"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:28:17.175000+00:00\", \"old_value\": \"2022-10-13 14:12:41.582000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--d18cb958-f4ad-4fb3-bb4f-e8994d206550",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-03-11 15:06:57.934000+00:00",
"modified": "2024-04-11 00:27:30.199000+00:00",
"name": "Penquin",
"description": "[Penquin](https://attack.mitre.org/software/S0587) is a remote access trojan (RAT) with multiple versions used by [Turla](https://attack.mitre.org/groups/G0010) to target Linux systems since at least 2014.(Citation: Kaspersky Turla Penquin December 2014)(Citation: Leonardo Turla Penquin May 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0587",
"external_id": "S0587"
},
{
"source_name": "Penquin 2.0",
"description": "(Citation: Leonardo Turla Penquin May 2020)"
},
{
"source_name": "Penquin_x64",
"description": "(Citation: Leonardo Turla Penquin May 2020)"
},
{
"source_name": "Kaspersky Turla Penquin December 2014",
"description": "Baumgartner, K. and Raiu, C. (2014, December 8). The \u2018Penquin\u2019 Turla. Retrieved March 11, 2021.",
"url": "https://securelist.com/the-penquin-turla-2/67962/"
},
{
"source_name": "Leonardo Turla Penquin May 2020",
"description": "Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA \u201cPenquin_x64\u201d. Retrieved March 11, 2021.",
"url": "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Penquin",
"Penquin 2.0",
"Penquin_x64"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Silvio La Porta, @LDO_CyberSec, Leonardo's Cyber Security Division",
"Antonio Villani, @LDO_CyberSec, Leonardo's Cyber Security Division",
"Nino Verde, @LDO_CyberSec, Leonardo's Cyber Security Division"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:27:30.199000+00:00\", \"old_value\": \"2022-10-20 04:12:29.037000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--8393dac0-0583-456a-9372-fd81691bca20",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-24 13:15:51.706000+00:00",
"modified": "2024-04-11 00:26:37.214000+00:00",
"name": "PipeMon",
"description": "[PipeMon](https://attack.mitre.org/software/S0501) is a multi-stage modular backdoor used by [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: ESET PipeMon May 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0501",
"external_id": "S0501"
},
{
"source_name": "ESET PipeMon May 2020",
"description": "Tartare, M. et al. (2020, May 21). No \u201cGame over\u201d for the Winnti Group. Retrieved August 24, 2020.",
"url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PipeMon"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Mathieu Tartare, ESET",
"Martin Smol\u00e1r, ESET"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:26:37.214000+00:00\", \"old_value\": \"2023-03-26 19:38:46.705000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--b42378e0-f147-496f-992a-26a49705395b",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:15.263000+00:00",
"modified": "2024-02-14 19:16:01.583000+00:00",
"name": "PoisonIvy",
"description": "[PoisonIvy](https://attack.mitre.org/software/S0012) is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison Ivy)(Citation: Symantec Elderwood Sept 2012)(Citation: Symantec Darkmoon Aug 2005)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0012",
"external_id": "S0012"
},
{
"source_name": "Poison Ivy",
"description": "(Citation: FireEye Poison Ivy) (Citation: Symantec Darkmoon Sept 2014)"
},
{
"source_name": "PoisonIvy",
"description": "(Citation: FireEye Poison Ivy)(Citation: Symantec Darkmoon Sept 2014)"
},
{
"source_name": "Breut",
"description": "(Citation: Novetta-Axiom)"
},
{
"source_name": "Darkmoon",
"description": "(Citation: Symantec Darkmoon Sept 2014)"
},
{
"source_name": "FireEye Poison Ivy",
"description": "FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014.",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf"
},
{
"source_name": "Symantec Darkmoon Aug 2005",
"description": "Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.",
"url": "https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"
},
{
"source_name": "Novetta-Axiom",
"description": "Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.",
"url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
},
{
"source_name": "Symantec Elderwood Sept 2012",
"description": "O'Gorman, G., and McDonald, G.. (2012, September 6). The Elderwood Project. Retrieved February 15, 2018.",
"url": "https://web.archive.org/web/20190717233006/http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
},
{
"source_name": "Symantec Darkmoon Sept 2014",
"description": "Payet, L. (2014, September 19). Life on Mars: How attackers took advantage of hope for alien existance in new Darkmoon campaign. Retrieved September 13, 2018.",
"url": "https://www.symantec.com/connect/blogs/life-mars-how-attackers-took-advantage-hope-alien-existance-new-darkmoon-campaign"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PoisonIvy",
"Breut",
"Poison Ivy",
"Darkmoon"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Darren Spruell"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-14 19:16:01.583000+00:00\", \"old_value\": \"2023-03-20 22:03:44.669000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.2\", \"old_value\": \"2.1\"}}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 2.2"
},
{
"type": "malware",
"id": "malware--37cc7eb6-12e3-467b-82e8-f20f2cc73c69",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:33:07.943000+00:00",
"modified": "2024-04-11 00:25:44.638000+00:00",
"name": "Prikormka",
"description": "[Prikormka](https://attack.mitre.org/software/S0113) is a malware family used in a campaign known as Operation Groundbait. It has predominantly been observed in Ukraine and was used as early as 2008. (Citation: ESET Operation Groundbait)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0113",
"external_id": "S0113"
},
{
"source_name": "ESET Operation Groundbait",
"description": "Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.",
"url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Prikormka"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.4",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:25:44.638000+00:00\", \"old_value\": \"2022-04-19 01:42:59.312000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.4\", \"old_value\": \"1.3\"}}}",
"previous_version": "1.3",
"version_change": "1.3 \u2192 1.4"
},
{
"type": "tool",
"id": "tool--ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:21.771000+00:00",
"modified": "2024-04-04 03:50:11+00:00",
"name": "PsExec",
"description": "[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS PsExec)",
"revoked": false,
"labels": [
"tool"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0029",
"external_id": "S0029"
},
{
"source_name": "SANS PsExec",
"description": "Pilkington, M. (2012, December 17). Protecting Privileged Domain Accounts: PsExec Deep-Dive. Retrieved August 17, 2016.",
"url": "https://www.sans.org/blog/protecting-privileged-domain-accounts-psexec-deep-dive/"
},
{
"source_name": "Russinovich Sysinternals",
"description": "Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015.",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PsExec"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Janantha Marasinghe"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.6",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-04 03:50:11+00:00\", \"old_value\": \"2023-08-09 18:07:11.859000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.6\", \"old_value\": \"1.5\"}}}",
"previous_version": "1.5",
"version_change": "1.5 \u2192 1.6"
},
{
"type": "malware",
"id": "malware--2ac41e8b-4865-4ced-839d-78e7852c47f3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-11 22:00:20.194000+00:00",
"modified": "2024-04-11 00:23:58.415000+00:00",
"name": "PyDCrypt",
"description": "[PyDCrypt](https://attack.mitre.org/software/S1032) is malware written in Python designed to deliver [DCSrv](https://attack.mitre.org/software/S1033). It has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021, with each sample tailored for its intended victim organization.(Citation: Checkpoint MosesStaff Nov 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1032",
"external_id": "S1032"
},
{
"source_name": "Checkpoint MosesStaff Nov 2021",
"description": "Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.",
"url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"PyDCrypt"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Pooja Natarajan, NEC Corporation India",
"Hiroki Nagahama, NEC Corporation",
"Manikantan Srinivasan, NEC Corporation India"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:23:58.415000+00:00\", \"old_value\": \"2022-10-24 18:54:58.048000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.0.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--edc5e045-5401-42bb-ad92-52b5b2ee0de9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-09-27 19:35:35.326000+00:00",
"modified": "2023-12-05 20:22:37.368000+00:00",
"name": "QakBot",
"description": "[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably [ProLock](https://attack.mitre.org/software/S0654) and [Egregor](https://attack.mitre.org/software/S0554).(Citation: Trend Micro Qakbot December 2020)(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0650",
"external_id": "S0650"
},
{
"source_name": "QuackBot",
"description": "(Citation: Kaspersky QakBot September 2021)"
},
{
"source_name": "Pinkslipbot",
"description": "(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)"
},
{
"source_name": "QBot",
"description": "(Citation: Trend Micro Qakbot December 2020)(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)"
},
{
"source_name": "Kaspersky QakBot September 2021",
"description": "Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.",
"url": "https://securelist.com/qakbot-technical-analysis/103931/"
},
{
"source_name": "ATT QakBot April 2021",
"description": "Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.",
"url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
},
{
"source_name": "Red Canary Qbot",
"description": "Rainey, K. (n.d.). Qbot. Retrieved September 27, 2021.",
"url": "https://redcanary.com/threat-detection-report/threats/qbot/"
},
{
"source_name": "Trend Micro Qakbot December 2020",
"description": "Trend Micro. (2020, December 17). QAKBOT: A decade-old malware still with new tricks. Retrieved September 27, 2021.",
"url": "https://success.trendmicro.com/solution/000283381"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"QakBot",
"Pinkslipbot",
"QuackBot",
"QBot"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Edward Millington",
"Inna Danilevich, U.S. Bank"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-12-05 20:22:37.368000+00:00\", \"old_value\": \"2023-05-01 17:05:20.902000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--03acae53-9b98-46f6-b204-16b930839055",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-11-19 19:47:26.552000+00:00",
"modified": "2024-04-11 00:21:49.455000+00:00",
"name": "RCSession",
"description": "[RCSession](https://attack.mitre.org/software/S0662) is a backdoor written in C++ that has been in use since at least 2018 by [Mustang Panda](https://attack.mitre.org/groups/G0129) and by [Threat Group-3390](https://attack.mitre.org/groups/G0027) (Type II Backdoor).(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Trend Micro Iron Tiger April 2021)(Citation: Trend Micro DRBControl February 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0662",
"external_id": "S0662"
},
{
"source_name": "Secureworks BRONZE PRESIDENT December 2019",
"description": "Counter Threat Unit Research Team. (2019, December 29). BRONZE PRESIDENT Targets NGOs. Retrieved April 13, 2021.",
"url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
},
{
"source_name": "Trend Micro Iron Tiger April 2021",
"description": "Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.",
"url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
},
{
"source_name": "Trend Micro DRBControl February 2020",
"description": "Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.",
"url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"RCSession"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:21:49.455000+00:00\", \"old_value\": \"2023-03-26 19:54:58.293000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-08-04 15:06:14.796000+00:00",
"modified": "2024-04-11 00:15:32.724000+00:00",
"name": "REvil",
"description": "[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0496",
"external_id": "S0496"
},
{
"source_name": "Sodin",
"description": "(Citation: Intel 471 REvil March 2020)(Citation: Kaspersky Sodin July 2019)"
},
{
"source_name": "Sodinokibi",
"description": "(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Talos Sodinokibi April 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee REvil October 2019)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)(Citation: Tetra Defense Sodinokibi March 2020)"
},
{
"source_name": "Talos Sodinokibi April 2019",
"description": "Cadieux, P, et al (2019, April 30). Sodinokibi ransomware exploits WebLogic Server vulnerability. Retrieved August 4, 2020.",
"url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
},
{
"source_name": "Secureworks REvil September 2019",
"description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
},
{
"source_name": "Cylance Sodinokibi July 2019",
"description": "Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.",
"url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
},
{
"source_name": "Group IB Ransomware May 2020",
"description": "Group IB. (2020, May). Ransomware Uncovered: Attackers\u2019 Latest Methods. Retrieved August 5, 2020.",
"url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
},
{
"source_name": "G Data Sodinokibi June 2019",
"description": "Han, Karsten. (2019, June 4). Strange Bits: Sodinokibi Spam, CinaRAT, and Fake G DATA. Retrieved August 4, 2020.",
"url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
},
{
"source_name": "Intel 471 REvil March 2020",
"description": "Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service \u2013 An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.",
"url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
},
{
"source_name": "Kaspersky Sodin July 2019",
"description": "Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.",
"url": "https://securelist.com/sodin-ransomware/91473/"
},
{
"source_name": "McAfee Sodinokibi October 2019",
"description": "McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service \u2013 What The Code Tells Us. Retrieved August 4, 2020.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
},
{
"source_name": "Picus Sodinokibi January 2020",
"description": "Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.",
"url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
},
{
"source_name": "McAfee REvil October 2019",
"description": "Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service \u2013 Crescendo. Retrieved August 5, 2020.",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"
},
{
"source_name": "Secureworks GandCrab and REvil September 2019",
"description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
"url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
},
{
"source_name": "Tetra Defense Sodinokibi March 2020",
"description": "Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved December 14, 2020.",
"url": "https://www.tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"REvil",
"Sodin",
"Sodinokibi"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Edward Millington"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack",
"ics-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:15:32.724000+00:00\", \"old_value\": \"2023-03-26 20:06:33.317000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.2\", \"old_value\": \"2.1\"}}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 2.2"
},
{
"type": "malware",
"id": "malware--4efc3e00-72f2-466a-ab7c-8a7dc6603b19",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-01-19 19:43:27.828000+00:00",
"modified": "2024-04-11 00:23:21.599000+00:00",
"name": "Raindrop",
"description": "[Raindrop](https://attack.mitre.org/software/S0565) is a loader used by [APT29](https://attack.mitre.org/groups/G0016) that was discovered on some victim machines during investigations related to the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024). It was discovered in January 2021 and was likely used since at least May 2020.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0565",
"external_id": "S0565"
},
{
"source_name": "Raindrop",
"description": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
},
{
"source_name": "Microsoft Deep Dive Solorigate January 2021",
"description": "MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
},
{
"source_name": "Symantec RAINDROP January 2021",
"description": "Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Raindrop"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:23:21.599000+00:00\", \"old_value\": \"2023-03-27 19:53:24.461000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3"
},
{
"type": "malware",
"id": "malware--29231689-5837-4a7a-aafc-1b65b3f50cc7",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-06-29 14:46:45.468000+00:00",
"modified": "2024-04-11 00:22:35.591000+00:00",
"name": "RainyDay",
"description": "[RainyDay](https://attack.mitre.org/software/S0629) is a backdoor tool that has been used by [Naikon](https://attack.mitre.org/groups/G0019) since at least 2020.(Citation: Bitdefender Naikon April 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0629",
"external_id": "S0629"
},
{
"source_name": "Bitdefender Naikon April 2021",
"description": "Vrabie, V. (2021, April 23). NAIKON \u2013 Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"RainyDay"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:22:35.591000+00:00\", \"old_value\": \"2021-08-19 19:14:14.922000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "tool",
"id": "tool--59096109-a1dd-463b-87e7-a8d110fe3a79",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-30 13:02:36.422000+00:00",
"modified": "2024-04-04 03:50:32.975000+00:00",
"name": "Rclone",
"description": "[Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in a number of ransomware campaigns, including those associated with the [Conti](https://attack.mitre.org/software/S0575) and DarkSide Ransomware-as-a-Service operations.(Citation: Rclone)(Citation: Rclone Wars)(Citation: Detecting Rclone)(Citation: DarkSide Ransomware Gang)(Citation: DFIR Conti Bazar Nov 2021)",
"revoked": false,
"labels": [
"tool"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1040",
"external_id": "S1040"
},
{
"source_name": "Detecting Rclone",
"description": " Aaron Greetham. (2021, May 27). Detecting Rclone \u2013 An Effective Tool for Exfiltration. Retrieved August 30, 2022.",
"url": "https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/"
},
{
"source_name": "DFIR Conti Bazar Nov 2021",
"description": "DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.",
"url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
},
{
"source_name": "Rclone Wars",
"description": "Justin Schoenfeld and Aaron Didier. (2021, May 4). Rclone Wars: Transferring leverage in a ransomware attack. Retrieved August 30, 2022.",
"url": "https://redcanary.com/blog/rclone-mega-extortion/"
},
{
"source_name": "Rclone",
"description": "Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.",
"url": "https://rclone.org"
},
{
"source_name": "DarkSide Ransomware Gang",
"description": "Ramarcus Baylor. (2021, May 12). DarkSide Ransomware Gang: An Overview. Retrieved August 30, 2022.",
"url": "https://unit42.paloaltonetworks.com/darkside-ransomware/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Rclone"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Edward Millington",
"Ian McKay"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-04 03:50:32.975000+00:00\", \"old_value\": \"2023-04-13 13:14:41.257000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--65341f30-bec6-4b1d-8abf-1a5620446c29",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2018-01-16 16:13:52.465000+00:00",
"modified": "2024-04-11 00:21:09.543000+00:00",
"name": "Reaver",
"description": "[Reaver](https://attack.mitre.org/software/S0172) is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the \"Five Poisons,\" which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of [Control Panel](https://attack.mitre.org/techniques/T1218/002) items.(Citation: Palo Alto Reaver Nov 2017)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0172",
"external_id": "S0172"
},
{
"source_name": "Reaver",
"description": "(Citation: Palo Alto Reaver Nov 2017)"
},
{
"source_name": "Palo Alto Reaver Nov 2017",
"description": "Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Reaver"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:21:09.543000+00:00\", \"old_value\": \"2021-02-09 15:02:42.727000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--17b40f60-729f-4fe8-8aea-cc9ee44a95d5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-12-14 16:46:06.044000+00:00",
"modified": "2024-04-11 00:17:52.256000+00:00",
"name": "RedLeaves",
"description": "[RedLeaves](https://attack.mitre.org/software/S0153) is a malware family used by [menuPass](https://attack.mitre.org/groups/G0045). The code overlaps with [PlugX](https://attack.mitre.org/software/S0013) and may be based upon the open source tool Trochilus. (Citation: PWC Cloud Hopper Technical Annex April 2017) (Citation: FireEye APT10 April 2017)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0153",
"external_id": "S0153"
},
{
"source_name": "RedLeaves",
"description": "(Citation: PWC Cloud Hopper Technical Annex April 2017)"
},
{
"source_name": "BUGJUICE",
"description": "Based on similarities in reported malware behavior and open source reporting, it is assessed that the malware named BUGJUICE by FireEye is likely the same as the malware RedLeaves. (Citation: FireEye APT10 April 2017) (Citation: Twitter Nick Carr APT10)"
},
{
"source_name": "Twitter Nick Carr APT10",
"description": "Carr, N.. (2017, April 6). Retrieved June 29, 2017.",
"url": "https://twitter.com/ItsReallyNick/status/850105140589633536"
},
{
"source_name": "FireEye APT10 April 2017",
"description": "FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"
},
{
"source_name": "PWC Cloud Hopper Technical Annex April 2017",
"description": "PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.",
"url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"RedLeaves",
"BUGJUICE"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Edward Millington"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:17:52.256000+00:00\", \"old_value\": \"2023-03-23 15:14:18.594000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--ecc2f65a-b452-4eaf-9689-7e181f17f7a5",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-17 19:18:00.270000+00:00",
"modified": "2024-04-11 00:17:12.008000+00:00",
"name": "Remexi",
"description": "[Remexi](https://attack.mitre.org/software/S0375) is a Windows-based Trojan that was developed in the C programming language.(Citation: Securelist Remexi Jan 2019)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0375",
"external_id": "S0375"
},
{
"source_name": "Securelist Remexi Jan 2019",
"description": "Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.",
"url": "https://securelist.com/chafer-used-remexi-malware/89538/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Remexi"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:17:12.008000+00:00\", \"old_value\": \"2020-03-30 18:04:25.880000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--69d6f4a9-fcf0-4f51-bca7-597c51ad0bb8",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:33:12.858000+00:00",
"modified": "2024-04-11 00:16:18.864000+00:00",
"name": "Remsec",
"description": "[Remsec](https://attack.mitre.org/software/S0125) is a modular backdoor that has been used by [Strider](https://attack.mitre.org/groups/G0041) and appears to have been designed primarily for espionage purposes. Many of its modules are written in Lua. (Citation: Symantec Strider Blog)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0125",
"external_id": "S0125"
},
{
"source_name": "Kaspersky ProjectSauron Blog",
"description": "Kaspersky Lab's Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016.",
"url": "https://securelist.com/faq-the-projectsauron-apt/75533/"
},
{
"source_name": "ProjectSauron",
"description": "ProjectSauron is used to refer both to the threat group also known as G0041 as well as the malware platform also known as S0125. (Citation: Kaspersky ProjectSauron Blog)"
},
{
"source_name": "Symantec Strider Blog",
"description": "Symantec Security Response. (2016, August 7). Strider: Cyberespionage group turns eye of Sauron on targets. Retrieved August 17, 2016.",
"url": "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Remsec",
"Backdoor.Remsec",
"ProjectSauron"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.3",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:16:18.864000+00:00\", \"old_value\": \"2023-03-28 20:28:28.088000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.3\", \"old_value\": \"1.2\"}}}",
"previous_version": "1.2",
"version_change": "1.2 \u2192 1.3"
},
{
"type": "malware",
"id": "malware--44c75271-0e4d-496f-ae0a-a6d883a42a65",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-05 14:03:11.359000+00:00",
"modified": "2024-04-11 00:14:59.199000+00:00",
"name": "Rifdoor",
"description": "[Rifdoor](https://attack.mitre.org/software/S0433) is a remote access trojan (RAT) that shares numerous code similarities with [HotCroissant](https://attack.mitre.org/software/S0431).(Citation: Carbon Black HotCroissant April 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0433",
"external_id": "S0433"
},
{
"source_name": "Carbon Black HotCroissant April 2020",
"description": "Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.",
"url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Rifdoor"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:14:59.199000+00:00\", \"old_value\": \"2020-05-08 00:24:24.402000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--56e6b6c2-e573-4969-8bab-783205cebbbf",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2020-05-14 22:29:25.653000+00:00",
"modified": "2024-04-11 00:14:23.264000+00:00",
"name": "Rising Sun",
"description": "[Rising Sun](https://attack.mitre.org/software/S0448) is a modular backdoor that was used extensively in [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) between 2017 and 2019. [Rising Sun](https://attack.mitre.org/software/S0448) infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed [Rising Sun](https://attack.mitre.org/software/S0448) included some source code from [Lazarus Group](https://attack.mitre.org/groups/G0032)'s Trojan Duuzer.(Citation: McAfee Sharpshooter December 2018)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0448",
"external_id": "S0448"
},
{
"source_name": "McAfee Sharpshooter December 2018",
"description": "Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.",
"url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Rising Sun"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:14:23.264000+00:00\", \"old_value\": \"2022-10-13 15:46:29.677000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.1\", \"old_value\": \"2.0\"}}}",
"previous_version": "2.0",
"version_change": "2.0 \u2192 2.1"
},
{
"type": "malware",
"id": "malware--e355fc84-6f3c-4888-8e0a-d7fa9c378532",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2022-08-18 15:00:32.571000+00:00",
"modified": "2024-04-11 00:01:29.506000+00:00",
"name": "STARWHALE",
"description": "[STARWHALE](https://attack.mitre.org/software/S1037) is Windows Script File (WSF) backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069), possibly since at least November 2021; there is also a [STARWHALE](https://attack.mitre.org/software/S1037) variant written in Golang with similar capabilities. Security researchers have also noted the use of [STARWHALE](https://attack.mitre.org/software/S1037) by UNC3313, which may be associated with [MuddyWater](https://attack.mitre.org/groups/G0069).(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S1037",
"external_id": "S1037"
},
{
"source_name": "CANOPY",
"description": "(Citation: DHS CISA AA22-055A MuddyWater February 2022)"
},
{
"source_name": "DHS CISA AA22-055A MuddyWater February 2022",
"description": "FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.",
"url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
},
{
"source_name": "Mandiant UNC3313 Feb 2022",
"description": "Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.",
"url": "https://www.mandiant.com/resources/telegram-malware-iranian-espionage"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"STARWHALE",
"CANOPY"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:01:29.506000+00:00\", \"old_value\": \"2022-10-14 15:23:17.961000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--a8839c95-029f-44cf-8f3d-a3cf2039e927",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-01-05 22:42:05.965000+00:00",
"modified": "2023-12-26 19:44:49.643000+00:00",
"name": "SUNBURST",
"description": "[SUNBURST](https://attack.mitre.org/software/S0559) is a trojanized DLL designed to fit within the SolarWinds Orion software update framework. It was used by [APT29](https://attack.mitre.org/groups/G0016) since at least February 2020.(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0559",
"external_id": "S0559"
},
{
"source_name": "SUNBURST",
"description": "(Citation: FireEye SUNBURST Backdoor December 2020)"
},
{
"source_name": "Solorigate",
"description": "(Citation: Microsoft Deep Dive Solorigate January 2021)"
},
{
"source_name": "FireEye SUNBURST Backdoor December 2020",
"description": "FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.",
"url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
},
{
"source_name": "Microsoft Deep Dive Solorigate January 2021",
"description": "MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.",
"url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
},
{
"source_name": "SolarWinds Sunburst Sunspot Update January 2021",
"description": "Sudhakar Ramakrishna . (2021, January 11). New Findings From Our Investigation of SUNBURST. Retrieved January 13, 2021.",
"url": "https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SUNBURST",
"Solorigate"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_contributors": [
"Daniyal Naeem, BT Security",
"Matt Brenton, Zurich Insurance Group"
],
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.5",
"detailed_diff": "{\"values_changed\": {\"root['modified']\": {\"new_value\": \"2023-12-26 19:44:49.643000+00:00\", \"old_value\": \"2023-03-27 20:01:39.552000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"3.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.5\", \"old_value\": \"2.4\"}}}",
"previous_version": "2.4",
"version_change": "2.4 \u2192 2.5"
},
{
"type": "malware",
"id": "malware--b2b0b946-be0a-4a7f-9c32-a2e5211d1cd9",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2021-02-18 17:35:13.361000+00:00",
"modified": "2024-04-10 23:45:34.261000+00:00",
"name": "SUPERNOVA",
"description": "[SUPERNOVA](https://attack.mitre.org/software/S0578) is an in-memory web shell written in .NET C#. It was discovered in November 2020 during the investigation of [APT29](https://attack.mitre.org/groups/G0016)'s SolarWinds cyber operation but determined to be unrelated. Subsequent analysis suggests [SUPERNOVA](https://attack.mitre.org/software/S0578) may have been used by the China-based threat group SPIRAL.(Citation: Guidepoint SUPERNOVA Dec 2020)(Citation: Unit42 SUPERNOVA Dec 2020)(Citation: SolarWinds Advisory Dec 2020)(Citation: CISA Supernova Jan 2021)(Citation: Microsoft Analyzing Solorigate Dec 2020)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0578",
"external_id": "S0578"
},
{
"source_name": "CISA Supernova Jan 2021",
"description": "CISA. (2021, January 27). Malware Analysis Report (AR21-027A). Retrieved February 22, 2021.",
"url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-027a"
},
{
"source_name": "Microsoft Analyzing Solorigate Dec 2020",
"description": "MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.",
"url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
},
{
"source_name": "Guidepoint SUPERNOVA Dec 2020",
"description": "Riley, W. (2020, December 1). SUPERNOVA SolarWinds .NET Webshell Analysis. Retrieved February 18, 2021.",
"url": "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
},
{
"source_name": "SolarWinds Advisory Dec 2020",
"description": "SolarWinds. (2020, December 24). SolarWinds Security Advisory. Retrieved February 22, 2021.",
"url": "https://www.solarwinds.com/sa-overview/securityadvisory"
},
{
"source_name": "Unit42 SUPERNOVA Dec 2020",
"description": "Tennis, M. (2020, December 17). SUPERNOVA: A Novel .NET Webshell. Retrieved February 22, 2021.",
"url": "https://unit42.paloaltonetworks.com/solarstorm-supernova/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SUPERNOVA"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-10 23:45:34.261000+00:00\", \"old_value\": \"2021-04-23 23:00:41.648000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--96b08451-b27a-4ff6-893f-790e26393a8e",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:32:48.482000+00:00",
"modified": "2024-04-11 00:10:10.398000+00:00",
"name": "Sakula",
"description": "[Sakula](https://attack.mitre.org/software/S0074) is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. (Citation: Dell Sakula)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0074",
"external_id": "S0074"
},
{
"source_name": "Dell Sakula",
"description": "Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.",
"url": "http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Sakula",
"Sakurel",
"VIPER"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:10:10.398000+00:00\", \"old_value\": \"2020-03-30 18:13:29.169000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--4d56e6e9-1a6d-46e3-896c-dfdf3cc96e62",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-04-15 19:40:07.664000+00:00",
"modified": "2024-04-11 00:09:42.414000+00:00",
"name": "SamSam",
"description": "[SamSam](https://attack.mitre.org/software/S0370) is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.(Citation: US-CERT SamSam 2018)(Citation: Talos SamSam Jan 2018)(Citation: Sophos SamSam Apr 2018)(Citation: Symantec SamSam Oct 2018)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0370",
"external_id": "S0370"
},
{
"source_name": "Sophos SamSam Apr 2018",
"description": " Palotay, D. and Mackenzie, P. (2018, April). SamSam Ransomware Chooses Its Targets Carefully. Retrieved April 15, 2019.",
"url": "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf"
},
{
"source_name": "Samas",
"description": "(Citation: US-CERT SamSam 2018)"
},
{
"source_name": "Symantec SamSam Oct 2018",
"description": "Symantec Security Response Attack Investigation Team. (2018, October 30). SamSam: Targeted Ransomware Attacks Continue. Retrieved April 16, 2019.",
"url": "https://www.symantec.com/blogs/threat-intelligence/samsam-targeted-ransomware-attacks"
},
{
"source_name": "US-CERT SamSam 2018",
"description": "US-CERT. (2018, December 3). Alert (AA18-337A): SamSam Ransomware. Retrieved March 15, 2019.",
"url": "https://www.us-cert.gov/ncas/alerts/AA18-337A"
},
{
"source_name": "Talos SamSam Jan 2018",
"description": "Ventura, V. (2018, January 22). SamSam - The Evolution Continues Netting Over $325,000 in 4 Weeks. Retrieved April 16, 2019.",
"url": "https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"SamSam",
"Samas"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.1",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:09:42.414000+00:00\", \"old_value\": \"2019-04-18 20:59:56.853000+00:00\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.1\", \"old_value\": \"1.0\"}}}",
"previous_version": "1.0",
"version_change": "1.0 \u2192 1.1"
},
{
"type": "malware",
"id": "malware--b45747dc-87ca-4597-a245-7e16a61bc491",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2019-01-30 15:27:06.404000+00:00",
"modified": "2024-04-11 00:08:51.818000+00:00",
"name": "Seasalt",
"description": "[Seasalt](https://attack.mitre.org/software/S0345) is malware that has been linked to [APT1](https://attack.mitre.org/groups/G0006)'s 2010 operations. It shares some code similarities with [OceanSalt](https://attack.mitre.org/software/S0346).(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0345",
"external_id": "S0345"
},
{
"source_name": "Seasalt",
"description": "(Citation: Mandiant APT1 Appendix)(Citation: McAfee Oceansalt Oct 2018)"
},
{
"source_name": "Mandiant APT1 Appendix",
"description": "Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.",
"url": "https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"
},
{
"source_name": "McAfee Oceansalt Oct 2018",
"description": "Sherstobitoff, R., Malhotra, A. (2018, October 18). \u2018Operation Oceansalt\u2019 Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.",
"url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Seasalt"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "1.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-04-11 00:08:51.818000+00:00\", \"old_value\": \"2020-03-19 19:18:10.963000+00:00\"}, \"root['external_references'][2]['url']\": {\"new_value\": \"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf\", \"old_value\": \"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report-appendix.zip\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"1.2\", \"old_value\": \"1.1\"}}}",
"previous_version": "1.1",
"version_change": "1.1 \u2192 1.2"
},
{
"type": "malware",
"id": "malware--8901ac23-6b50-410c-b0dd-d8174a86f9b3",
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"created": "2017-05-31 21:33:20.223000+00:00",
"modified": "2024-02-08 20:53:17.332000+00:00",
"name": "Shamoon",
"description": "[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the \"Cutting Sword of Justice\" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) and Filerase to carry out data wiping tasks. Analysis has linked [Shamoon](https://attack.mitre.org/software/S0140) with [Kwampirs](https://attack.mitre.org/software/S0236) based on multiple shared artifacts and coding patterns.(Citation: Cylera Kwampirs 2022) The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)",
"revoked": false,
"labels": [
"malware"
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://attack.mitre.org/software/S0140",
"external_id": "S0140"
},
{
"source_name": "Disttrack",
"description": "(Citation: Palo Alto Shamoon Nov 2016)"
},
{
"source_name": "Unit 42 Shamoon3 2018",
"description": "Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.",
"url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
},
{
"source_name": "Palo Alto Shamoon Nov 2016",
"description": "Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.",
"url": "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"
},
{
"source_name": "FireEye Shamoon Nov 2016",
"description": "FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved January 11, 2017.",
"url": "https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"
},
{
"source_name": "Cylera Kwampirs 2022",
"description": "Pablo Rinc\u00f3n Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.",
"url": "https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf"
},
{
"source_name": "Symantec Shamoon 2012",
"description": "Symantec. (2012, August 16). The Shamoon Attacks. Retrieved March 14, 2019.",
"url": "https://www.symantec.com/connect/blogs/shamoon-attacks"
}
],
"object_marking_refs": [
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
],
"x_mitre_aliases": [
"Shamoon",
"Disttrack"
],
"x_mitre_attack_spec_version": "3.2.0",
"x_mitre_deprecated": false,
"x_mitre_domains": [
"enterprise-attack"
],
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
"x_mitre_platforms": [
"Windows"
],
"x_mitre_version": "2.2",
"detailed_diff": "{\"dictionary_item_added\": {\"root['x_mitre_deprecated']\": false}, \"values_changed\": {\"root['modified']\": {\"new_value\": \"2024-02-08 20:53:17.332000+00:00\", \"old_value\": \"2021-02-09 13:42:15.121000+00:00\"}, \"root['description']\": {\"new_value\": \"[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the \\\"Cutting Sword of Justice\\\" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) and Filerase to carry out data wiping tasks. Analysis has linked [Shamoon](https://attack.mitre.org/software/S0140) with [Kwampirs](https://attack.mitre.org/software/S0236) based on multiple shared artifacts and coding patterns.(Citation: Cylera Kwampirs 2022) The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)\", \"old_value\": \"[Shamoon](https://attack.mitre.org/software/S0140) is wiper malware that was first used by an Iranian group known as the \\\"Cutting Sword of Justice\\\" in 2012. Other versions known as Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Shamoon](https://attack.mitre.org/software/S0140) has also been seen leveraging [RawDisk](https://attack.mitre.org/software/S0364) and Filerase to carry out data wiping tasks. The term Shamoon is sometimes used to refer to the group using the malware as well as the malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)\"}, \"root['x_mitre_attack_spec_version']\": {\"new_value\": \"3.2.0\", \"old_value\": \"2.1.0\"}, \"root['x_mitre_version']\": {\"new_value\": \"2.2\", \"old_value\": \"2.1\"}}, \"iterable_item_added\": {\"root['external_references'][5]\": {\"source_name\": \"Cylera Kwampirs 2022\", \"description\": \"Pablo Rinc\\u00f3n Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.\", \"url\": \"https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf\"}}}",
"previous_version": "2.1",
"version_change": "2.1 \u2192 2.2",
"description_change_table": "\n | Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Shamoon](https://attack.mitre.org/software/S0140) is wiper | t | 1 | [Shamoon](https://attack.mitre.org/software/S0140) is wiper |
| > | malware that was first used by an Iranian group known as the | > | malware that was first used by an Iranian group known as the | ||
| > | \"Cutting Sword of Justice\" in 2012. Other versions known as | > | \"Cutting Sword of Justice\" in 2012. Other versions known as | ||
| > | Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Sh | > | Shamoon 2 and Shamoon 3 were observed in 2016 and 2018. [Sh | ||
| > | amoon](https://attack.mitre.org/software/S0140) has also bee | > | amoon](https://attack.mitre.org/software/S0140) has also bee | ||
| > | n seen leveraging [RawDisk](https://attack.mitre.org/softwar | > | n seen leveraging [RawDisk](https://attack.mitre.org/softwar | ||
| > | e/S0364) and Filerase to carry out data wiping tasks. The te | > | e/S0364) and Filerase to carry out data wiping tasks. Analys | ||
| > | rm Shamoon is sometimes used to refer to the group using the | > | is has linked [Shamoon](https://attack.mitre.org/software/S0 | ||
| > | malware as well as the malware itself.(Citation: Palo Alto | > | 140) with [Kwampirs](https://attack.mitre.org/software/S0236 | ||
| > | Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)(Citation: | > | ) based on multiple shared artifacts and coding patterns.(Ci | ||
| > | Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016) | > | tation: Cylera Kwampirs 2022) The term Shamoon is sometimes | ||
| > | used to refer to the group using the malware as well as the | ||||
| > | malware itself.(Citation: Palo Alto Shamoon Nov 2016)(Citati | ||||
| > | on: Unit 42 Shamoon3 2018)(Citation: Symantec Shamoon 2012)( | ||||
| > | Citation: FireEye Shamoon Nov 2016) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g | t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g |
| > | roup that has been attributed to Russia's General Staff Main | > | roup that has been attributed to Russia's General Staff Main | ||
| > | Intelligence Directorate (GRU) 85th Main Special Service Ce | > | Intelligence Directorate (GRU) 85th Main Special Service Ce | ||
| > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | ||
| > | August 2020)(Citation: Cybersecurity Advisory GRU Brute For | > | August 2020)(Citation: Cybersecurity Advisory GRU Brute For | ||
| > | ce Campaign July 2021) This group has been active since at l | > | ce Campaign July 2021) This group has been active since at l | ||
| > | east 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: | > | east 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: | ||
| > | Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike | > | Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike | ||
| > | DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWork | > | DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWork | ||
| > | s TG-4127)(Citation: FireEye APT28 January 2017)(Citation: G | > | s TG-4127)(Citation: FireEye APT28 January 2017)(Citation: G | ||
| > | RIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: | > | RIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: | ||
| > | Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018 | > | Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018 | ||
| > | )(Citation: ESET Zebrocy May 2019) [APT28](https://attack.m | > | )(Citation: ESET Zebrocy May 2019) [APT28](https://attack.m | ||
| > | itre.org/groups/G0007) reportedly compromised the Hillary Cl | > | itre.org/groups/G0007) reportedly compromised the Hillary Cl | ||
| > | inton campaign, the Democratic National Committee, and the D | > | inton campaign, the Democratic National Committee, and the D | ||
| > | emocratic Congressional Campaign Committee in 2016 in an att | > | emocratic Congressional Campaign Committee in 2016 in an att | ||
| > | empt to interfere with the U.S. presidential election. (Cita | > | empt to interfere with the U.S. presidential election.(Citat | ||
| > | tion: Crowdstrike DNC June 2016) In 2018, the US indicted fi | > | ion: Crowdstrike DNC June 2016) In 2018, the US indicted fiv | ||
| > | ve GRU Unit 26165 officers associated with [APT28](https://a | > | e GRU Unit 26165 officers associated with [APT28](https://at | ||
| > | ttack.mitre.org/groups/G0007) for cyber operations (includin | > | tack.mitre.org/groups/G0007) for cyber operations (including | ||
| > | g close-access operations) conducted between 2014 and 2018 a | > | close-access operations) conducted between 2014 and 2018 ag | ||
| > | gainst the World Anti-Doping Agency (WADA), the US Anti-Dopi | > | ainst the World Anti-Doping Agency (WADA), the US Anti-Dopin | ||
| > | ng Agency, a US nuclear facility, the Organization for the P | > | g Agency, a US nuclear facility, the Organization for the Pr | ||
| > | rohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemi | > | ohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemic | ||
| > | cals Laboratory, and other organizations.(Citation: US Distr | > | als Laboratory, and other organizations.(Citation: US Distri | ||
| > | ict Court Indictment GRU Oct 2018) Some of these were conduc | > | ct Court Indictment GRU Oct 2018) Some of these were conduct | ||
| > | ted with the assistance of GRU Unit 74455, which is also ref | > | ed with the assistance of GRU Unit 74455, which is also refe | ||
| > | erred to as [Sandworm Team](https://attack.mitre.org/groups/ | > | rred to as [Sandworm Team](https://attack.mitre.org/groups/G | ||
| > | G0034). | > | 0034). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT33](https://attack.mitre.org/groups/G0064) is a suspecte | t | 1 | [APT33](https://attack.mitre.org/groups/G0064) is a suspecte |
| > | d Iranian threat group that has carried out operations since | > | d Iranian threat group that has carried out operations since | ||
| > | at least 2013. The group has targeted organizations across | > | at least 2013. The group has targeted organizations across | ||
| > | multiple industries in the United States, Saudi Arabia, and | > | multiple industries in the United States, Saudi Arabia, and | ||
| > | South Korea, with a particular interest in the aviation and | > | South Korea, with a particular interest in the aviation and | ||
| > | energy sectors. (Citation: FireEye APT33 Sept 2017) (Citatio | > | energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: | ||
| > | n: FireEye APT33 Webinar Sept 2017) | > | FireEye APT33 Webinar Sept 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko | t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko |
| > | rean state-sponsored threat group that specializes in financ | > | rean state-sponsored threat group that specializes in financ | ||
| > | ial cyber operations; it has been attributed to the Reconnai | > | ial cyber operations; it has been attributed to the Reconnai | ||
| > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | ||
| > | ugust 2020) Active since at least 2014, [APT38](https://atta | > | ugust 2020) Active since at least 2014, [APT38](https://atta | ||
| > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | ||
| > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | ||
| > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | ||
| > | ficant operations include the 2016 Bank of Bangladesh heist, | > | ficant operations include the 2016 Bank of Bangladesh heist, | ||
| > | during which [APT38](https://attack.mitre.org/groups/G0082) | > | during which [APT38](https://attack.mitre.org/groups/G0082) | ||
| > | stole $81 million, as well as attacks against Bancomext (20 | > | stole $81 million, as well as attacks against Bancomext (Ci | ||
| > | 18) and Banco de Chile (2018); some of their attacks have be | > | tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation | ||
| > | en destructive.(Citation: CISA AA20-239A BeagleBoyz August 2 | > | : FireEye APT38 Oct 2018); some of their attacks have been d | ||
| > | 020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North K | > | estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020) | ||
| > | orea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under | > | (Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea | ||
| > | The Hood Blog 2017) North Korean group definitions are know | > | Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The | ||
| > | n to have significant overlap, and some security researchers | > | Hood Blog 2017) North Korean group definitions are known to | ||
| > | report all North Korean state-sponsored cyber activity unde | > | have significant overlap, and some security researchers rep | ||
| > | r the name [Lazarus Group](https://attack.mitre.org/groups/G | > | ort all North Korean state-sponsored cyber activity under th | ||
| > | 0032) instead of tracking clusters or subgroups. | > | e name [Lazarus Group](https://attack.mitre.org/groups/G0032 | ||
| > | ) instead of tracking clusters or subgroups. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [GALLIUM](https://attack.mitre.org/groups/G0093) is a cybere | t | 1 | [GALLIUM](https://attack.mitre.org/groups/G0093) is a cybere |
| > | spionage group that has been active since at least 2012, pri | > | spionage group that has been active since at least 2012, pri | ||
| > | marily targeting telecommunications companies, financial ins | > | marily targeting telecommunications companies, financial ins | ||
| > | titutions, and government entities in Afghanistan, Australia | > | titutions, and government entities in Afghanistan, Australia | ||
| > | , Belgium, Cambodia, Malaysia, Mozambique, the Philippines, | > | , Belgium, Cambodia, Malaysia, Mozambique, the Philippines, | ||
| > | Russia, and Vietnam. Security researchers have identified [G | > | Russia, and Vietnam. This group is particularly known for la | ||
| > | ALLIUM](https://attack.mitre.org/groups/G0093) as a likely C | > | unching Operation Soft Cell, a long-term campaign targeting | ||
| > | hinese state-sponsored group, based in part on tools used an | > | telecommunications providers.(Citation: Cybereason Soft Cell | ||
| > | d TTPs commonly associated with Chinese threat actors.(Citat | > | June 2019) Security researchers have identified [GALLIUM](h | ||
| > | ion: Cybereason Soft Cell June 2019)(Citation: Microsoft GAL | > | ttps://attack.mitre.org/groups/G0093) as a likely Chinese st | ||
| > | LIUM December 2019)(Citation: Unit 42 PingPull Jun 2022) | > | ate-sponsored group, based in part on tools used and TTPs co | ||
| > | mmonly associated with Chinese threat actors.(Citation: Cybe | ||||
| > | reason Soft Cell June 2019)(Citation: Microsoft GALLIUM Dece | ||||
| > | mber 2019)(Citation: Unit 42 PingPull Jun 2022) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Lazarus Group](https://attack.mitre.org/groups/G0032) is a | t | 1 | [Lazarus Group](https://attack.mitre.org/groups/G0032) is a |
| > | North Korean state-sponsored cyber threat group that has bee | > | North Korean state-sponsored cyber threat group that has bee | ||
| > | n attributed to the Reconnaissance General Bureau.(Citation: | > | n attributed to the Reconnaissance General Bureau.(Citation: | ||
| > | US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko | > | US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko | ||
| > | rean Cyber Groups September 2019) The group has been active | > | rean Cyber Groups September 2019) The group has been active | ||
| > | since at least 2009 and was reportedly responsible for the N | > | since at least 2009 and was reportedly responsible for the N | ||
| > | ovember 2014 destructive wiper attack against Sony Pictures | > | ovember 2014 destructive wiper attack against Sony Pictures | ||
| > | Entertainment as part of a campaign named Operation Blockbus | > | Entertainment as part of a campaign named Operation Blockbus | ||
| > | ter by Novetta. Malware used by [Lazarus Group](https://atta | > | ter by Novetta. Malware used by [Lazarus Group](https://atta | ||
| > | ck.mitre.org/groups/G0032) correlates to other reported camp | > | ck.mitre.org/groups/G0032) correlates to other reported camp | ||
| > | aigns, including Operation Flame, Operation 1Mission, Operat | > | aigns, including Operation Flame, Operation 1Mission, Operat | ||
| > | ion Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novett | > | ion Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta | ||
| > | a Blockbuster) North Korean group definitions are known to | > | Blockbuster) North Korean group definitions are known to h | ||
| > | have significant overlap, and some security researchers repo | > | ave significant overlap, and some security researchers repor | ||
| > | rt all North Korean state-sponsored cyber activity under the | > | t all North Korean state-sponsored cyber activity under the | ||
| > | name [Lazarus Group](https://attack.mitre.org/groups/G0032) | > | name [Lazarus Group](https://attack.mitre.org/groups/G0032) | ||
| > | instead of tracking clusters or subgroups, such as [Andarie | > | instead of tracking clusters or subgroups, such as [Andariel | ||
| > | l](https://attack.mitre.org/groups/G0138), [APT37](https://a | > | ](https://attack.mitre.org/groups/G0138), [APT37](https://at | ||
| > | ttack.mitre.org/groups/G0067), [APT38](https://attack.mitre. | > | tack.mitre.org/groups/G0067), [APT38](https://attack.mitre.o | ||
| > | org/groups/G0082), and [Kimsuky](https://attack.mitre.org/gr | > | rg/groups/G0082), and [Kimsuky](https://attack.mitre.org/gro | ||
| > | oups/G0094). | > | ups/G0094). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [OilRig](https://attack.mitre.org/groups/G0049) is a suspect | t | 1 | [OilRig](https://attack.mitre.org/groups/G0049) is a suspect |
| > | ed Iranian threat group that has targeted Middle Eastern and | > | ed Iranian threat group that has targeted Middle Eastern and | ||
| > | international victims since at least 2014. The group has ta | > | international victims since at least 2014. The group has ta | ||
| > | rgeted a variety of sectors, including financial, government | > | rgeted a variety of sectors, including financial, government | ||
| > | , energy, chemical, and telecommunications. It appears the g | > | , energy, chemical, and telecommunications. It appears the g | ||
| > | roup carries out supply chain attacks, leveraging the trust | > | roup carries out supply chain attacks, leveraging the trust | ||
| > | relationship between organizations to attack their primary t | > | relationship between organizations to attack their primary t | ||
| > | argets. FireEye assesses that the group works on behalf of t | > | argets. The group works on behalf of the Iranian government | ||
| > | he Iranian government based on infrastructure details that c | > | based on infrastructure details that contain references to I | ||
| > | ontain references to Iran, use of Iranian infrastructure, an | > | ran, use of Iranian infrastructure, and targeting that align | ||
| > | d targeting that aligns with nation-state interests.(Citatio | > | s with nation-state interests.(Citation: FireEye APT34 Dec 2 | ||
| > | n: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Ja | > | 017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearS | ||
| > | n 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo | > | ky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Cit | ||
| > | Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023) | > | ation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Pl | ||
| > | (Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGE | > | aybook 2023)(Citation: Unit 42 QUADAGENT July 2018) | ||
| > | NT July 2018) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Orangeworm](https://attack.mitre.org/groups/G0071) is a gro | t | 1 | [Orangeworm](https://attack.mitre.org/groups/G0071) is a gro |
| > | up that has targeted organizations in the healthcare sector | > | up that has targeted organizations in the healthcare sector | ||
| > | in the United States, Europe, and Asia since at least 2015, | > | in the United States, Europe, and Asia since at least 2015, | ||
| > | likely for the purpose of corporate espionage.(Citation: Sym | > | likely for the purpose of corporate espionage.(Citation: Sym | ||
| > | antec Orangeworm April 2018) | > | antec Orangeworm April 2018) Reverse engineering of [Kwampir | ||
| > | s](https://attack.mitre.org/software/S0236), directly associ | ||||
| > | ated with [Orangeworm](https://attack.mitre.org/groups/G0071 | ||||
| > | ) activity, indicates significant functional and development | ||||
| > | overlaps with [Shamoon](https://attack.mitre.org/software/S | ||||
| > | 0140).(Citation: Cylera Kwampirs 2022) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Scattered Spider](https://attack.mitre.org/groups/G1015) is | t | 1 | [Scattered Spider](https://attack.mitre.org/groups/G1015) is |
| > | a cybercriminal group that has been active since at least 2 | > | a native English-speaking cybercriminal group that has been | ||
| > | 022 targeting customer relationship management and business- | > | active since at least 2022.(Citation: CrowdStrike Scattered | ||
| > | process outsourcing (BPO) firms as well as telecommunicatio | > | Spider Profile)(Citation: MSTIC Octo Tempest Operations Oct | ||
| > | ns and technology companies. During campaigns [Scattered Spi | > | ober 2023) The group initially targeted customer relationshi | ||
| > | der](https://attack.mitre.org/groups/G1015) has leveraged ta | > | p management and business-process outsourcing (BPO) firms as | ||
| > | rgeted social-engineering techniques and attempted to bypass | > | well as telecommunications and technology companies. Beginn | ||
| > | popular endpoint security tools.(Citation: CrowdStrike Scat | > | ing in 2023, [Scattered Spider](https://attack.mitre.org/gro | ||
| > | tered Spider Profile)(Citation: CrowdStrike Scattered Spider | > | ups/G1015) expanded its operations to compromise victims in | ||
| > | BYOVD January 2023)(Citation: Crowdstrike TELCO BPO Campaig | > | the gaming, hospitality, retail, MSP, manufacturing, and fin | ||
| > | n December 2022) | > | ancial sectors.(Citation: MSTIC Octo Tempest Operations Octo | ||
| > | ber 2023) During campaigns, [Scattered Spider](https://attac | ||||
| > | k.mitre.org/groups/G1015) has leveraged targeted social-engi | ||||
| > | neering techniques, attempted to bypass popular endpoint sec | ||||
| > | urity tools, and more recently, deployed ransomware for fina | ||||
| > | ncial gain.(Citation: CISA Scattered Spider Advisory Novembe | ||||
| > | r 2023)(Citation: CrowdStrike Scattered Spider BYOVD January | ||||
| > | 2023)(Citation: CrowdStrike Scattered Spider Profile)(Citat | ||||
| > | ion: MSTIC Octo Tempest Operations October 2023)(Citation: C | ||||
| > | rowdstrike TELCO BPO Campaign December 2022) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [BITTER](https://attack.mitre.org/groups/G1002) is a suspect | t | 1 | [BITTER](https://attack.mitre.org/groups/G1002) is a suspect |
| > | ed South Asian cyber espionage threat group that has been ac | > | ed South Asian cyber espionage threat group that has been ac | ||
| > | tive since at least 2013. [BITTER](https://attack.mitre.org/ | > | tive since at least 2013. [BITTER](https://attack.mitre.org/ | ||
| > | groups/G1002) has primarily targeted government, energy, and | > | groups/G1002) has targeted government, energy, and engineeri | ||
| > | engineering organizations in Pakistan, China, Bangladesh, a | > | ng organizations in Pakistan, China, Bangladesh, and Saudi A | ||
| > | nd Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May | > | rabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Cit | ||
| > | 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016) | > | ation: Forcepoint BITTER Pakistan Oct 2016) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT3](https://attack.mitre.org/groups/G0022) is a China-bas | t | 1 | [APT3](https://attack.mitre.org/groups/G0022) is a China-bas |
| > | ed threat group that researchers have attributed to China's | > | ed threat group that researchers have attributed to China's | ||
| > | Ministry of State Security.(Citation: FireEye Clandestine Wo | > | Ministry of State Security.(Citation: FireEye Clandestine Wo | ||
| > | lf)(Citation: Recorded Future APT3 May 2017) This group is r | > | lf)(Citation: Recorded Future APT3 May 2017) This group is r | ||
| > | esponsible for the campaigns known as Operation Clandestine | > | esponsible for the campaigns known as Operation Clandestine | ||
| > | Fox, Operation Clandestine Wolf, and Operation Double Tap.(C | > | Fox, Operation Clandestine Wolf, and Operation Double Tap.(C | ||
| > | itation: FireEye Clandestine Wolf)(Citation: FireEye Operati | > | itation: FireEye Clandestine Wolf)(Citation: FireEye Operati | ||
| > | on Double Tap) As of June 2015, the group appears to have sh | > | on Double Tap) As of June 2015, the group appears to have sh | ||
| > | ifted from targeting primarily US victims to primarily polit | > | ifted from targeting primarily US victims to primarily polit | ||
| > | ical organizations in Hong Kong.(Citation: Symantec Buckeye) | > | ical organizations in Hong Kong.(Citation: Symantec Buckeye) | ||
| > | In 2017, MITRE developed an APT3 Adversary Emulation Plan. | ||||
| > | (Citation: APT3 Adversary Emulation Plan) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may attempt to position themselves between two o | t | 1 | Adversaries may attempt to position themselves between two o |
| > | r more networked devices to support follow-on behaviors such | > | r more networked devices to support follow-on behaviors such | ||
| > | as [Transmitted Data Manipulation](https://attack.mitre.org | > | as [Transmitted Data Manipulation](https://attack.mitre.org | ||
| > | /techniques/T1565/002) or [Endpoint Denial of Service](https | > | /techniques/T1565/002) or [Endpoint Denial of Service](https | ||
| > | ://attack.mitre.org/techniques/T1642). [Adversary-in-t | > | ://attack.mitre.org/techniques/T1642). [Adversary-in-t | ||
| > | he-Middle](https://attack.mitre.org/techniques/T1638) can be | > | he-Middle](https://attack.mitre.org/techniques/T1638) can be | ||
| > | achieved through several mechanisms, such as a malicious ap | > | achieved through several mechanisms. For example, a malicio | ||
| > | plication registering itself as a VPN client. By doing this, | > | us application may register itself as a VPN client, effectiv | ||
| > | the adversary can effectively redirect device traffic to wh | > | ely redirecting device traffic to adversary-owned resources. | ||
| > | erever they want. However, registering as a VPN client requi | > | Registering as a VPN client requires user consent on both A | ||
| > | res user consent on both Android and iOS. Additionally, on i | > | ndroid and iOS; additionally, a special entitlement granted | ||
| > | OS, the application requires a special entitlement that must | > | by Apple is needed for iOS devices. Alternatively, a malicio | ||
| > | be granted by Apple. Alternatively, if an application is ab | > | us application with escalation privileges may utilize those | ||
| > | le to escalate privileges, it can potentially utilize those | > | privileges to gain access to network traffic. Specific | ||
| > | privileges to gain access to network traffic. Outside | > | to Android devices, adversary-in-the-disk is a type of AiTM | ||
| > | of a mobile device, adversaries may be able to capture traff | > | attack where adversaries monitor and manipulate data that i | ||
| > | ic by employing a rogue base station or Wi-Fi access point. | > | s exchanged between applications and external storage.(Citat | ||
| > | These devices will allow adversaries to capture network traf | > | ion: mitd_kaspersky)(Citation: mitd_checkpoint)(Citation: mi | ||
| > | fic after it has left the device, while it is flowing to its | > | td_checkpoint_research) To accomplish this, a malicious appl | ||
| > | destination. On a local network, enterprise techniques coul | > | ication firsts requests for access to multimedia files on th | ||
| > | d be used, such as DNS redirection or DNS poisoning. I | > | e device (`READ_EXTERNAL STORAGE` and `WRITE_EXTERNAL_STORAG | ||
| > | f applications properly encrypt their network traffic, sensi | > | E`), then the application reads data on the device and/or wr | ||
| > | tive data may not be accessible an adversary, depending on t | > | ites malware to the device. Though the request for access is | ||
| > | he point of capture. | > | common, when used maliciously, adversaries may access files | ||
| > | and other sensitive data due to abusing the permission. Mul | ||||
| > | tiple applications were shown to be vulnerable against this | ||||
| > | attack; however, scrutiny of permissions and input validatio | ||||
| > | ns may mitigate this attack. Outside of a mobile device | ||||
| > | , adversaries may be able to capture traffic by employing a | ||||
| > | rogue base station or Wi-Fi access point. These devices will | ||||
| > | allow adversaries to capture network traffic after it has l | ||||
| > | eft the device, while it is flowing to its destination. On a | ||||
| > | local network, enterprise techniques could be used, such as | ||||
| > | [ARP Cache Poisoning](https://attack.mitre.org/techniques/T | ||||
| > | 1557/002) or [DHCP Spoofing](https://attack.mitre.org/techni | ||||
| > | ques/T1557/003). If applications properly encrypt thei | ||||
| > | r network traffic, sensitive data may not be accessible to a | ||||
| > | dversaries, depending on the point of capture. For example, | ||||
| > | properly implementing Apple\u2019s Application Transport Security | ||||
| > | (ATS) and Android\u2019s Network Security Configuration (NSC) ma | ||||
| > | y prevent sensitive data leaks.(Citation: NSC_Android) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | Adversaries may look for details about the network configura | t | 1 | Adversaries may look for details about the network configura |
| > | tion and settings, such as IP and/or MAC addresses, of opera | > | tion and settings, such as IP and/or MAC addresses, of devic | ||
| > | ting systems they access or through information discovery of | > | es they access or through information discovery of remote sy | ||
| > | remote systems. On Android, details of onboard network | > | stems. Adversaries may use the information from [System Ne | ||
| > | interfaces are accessible to apps through the `java.net.Net | > | twork Configuration Discovery](https://attack.mitre.org/tech | ||
| > | workInterface` class.(Citation: NetworkInterface) Previously | > | niques/T1422) during automated discovery to shape follow-on | ||
| > | , the Android `TelephonyManager` class could be used to gath | > | behaviors, including determining certain access within the t | ||
| > | er telephony-related device identifiers, information such as | > | arget network and what actions to do next. On Android, det | ||
| > | the IMSI, IMEI, and phone number. However, starting with An | > | ails of onboard network interfaces are accessible to apps th | ||
| > | droid 10, only preloaded, carrier, the default SMS, or devic | > | rough the `java.net.NetworkInterface` class.(Citation: Netwo | ||
| > | e and profile owner applications can access the telephony-re | > | rkInterface) Previously, the Android `TelephonyManager` clas | ||
| > | lated device identifiers.(Citation: TelephonyManager) O | > | s could be used to gather telephony-related device identifie | ||
| > | n iOS, gathering network configuration information is not po | > | rs, information such as the IMSI, IMEI, and phone number. Ho | ||
| > | ssible without root access. Adversaries may use the inf | > | wever, starting with Android 10, only preloaded, carrier, th | ||
| > | ormation from [System Network Configuration Discovery](https | > | e default SMS, or device and profile owner applications can | ||
| > | ://attack.mitre.org/techniques/T1422) during automated disco | > | access the telephony-related device identifiers.(Citation: T | ||
| > | very to shape follow-on behaviors, including determining cer | > | elephonyManager) On iOS, gathering network configuratio | ||
| > | tain access within the target network and what actions to do | > | n information is not possible without root access. Adve | ||
| > | next. | > | rsaries may use the information from [System Network Configu | ||
| > | ration Discovery](https://attack.mitre.org/techniques/T1422) | ||||
| > | during automated discovery to shape follow-on behaviors, in | ||||
| > | cluding determining certain access within the target network | ||||
| > | and what actions to do next. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [AndroRAT](https://attack.mitre.org/software/S0292) is malwa | t | 1 | [AndroRAT](https://attack.mitre.org/software/S0292) is an op |
| > | re that allows a third party to control the device and colle | > | en-source remote access tool for Android devices. [AndroRAT] | ||
| > | ct information. (Citation: Lookout-EnterpriseApps) | > | (https://attack.mitre.org/software/S0292) is capable of coll | ||
| > | ecting data, such as device location, call logs, etc., and i | ||||
| > | s capable of executing actions, such as sending SMS messages | ||||
| > | and taking pictures.(Citation: Lookout-EnterpriseApps)(Cita | ||||
| > | tion: github_androrat)(Citation: Forcepoint BITTER Pakistan | ||||
| > | Oct 2016) It is originally available through the `The404Hack | ||||
| > | ing` Github repository.(Citation: github_androrat) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Pegasus for iOS](https://attack.mitre.org/software/S0289) i | t | 1 | [Pegasus for iOS](https://attack.mitre.org/software/S0289) i |
| > | s the iOS version of malware that has reportedly been linked | > | s the iOS version of malware that has reportedly been linked | ||
| > | to the NSO Group. It has been advertised and sold to target | > | to the NSO Group. It has been advertised and sold to target | ||
| > | high-value victims. (Citation: Lookout-Pegasus) (Citation: | > | high-value victims.(Citation: Lookout-Pegasus)(Citation: Pe | ||
| > | PegasusCitizenLab) The Android version is tracked separately | > | gasusCitizenLab) The Android version is tracked separately u | ||
| > | under [Pegasus for Android](https://attack.mitre.org/softwa | > | nder [Pegasus for Android](https://attack.mitre.org/software | ||
| > | re/S0316). | > | /S0316). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g | t | 1 | [APT28](https://attack.mitre.org/groups/G0007) is a threat g |
| > | roup that has been attributed to Russia's General Staff Main | > | roup that has been attributed to Russia's General Staff Main | ||
| > | Intelligence Directorate (GRU) 85th Main Special Service Ce | > | Intelligence Directorate (GRU) 85th Main Special Service Ce | ||
| > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | > | nter (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub | ||
| > | August 2020)(Citation: Cybersecurity Advisory GRU Brute For | > | August 2020)(Citation: Cybersecurity Advisory GRU Brute For | ||
| > | ce Campaign July 2021) This group has been active since at l | > | ce Campaign July 2021) This group has been active since at l | ||
| > | east 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: | > | east 2004.(Citation: DOJ GRU Indictment Jul 2018)(Citation: | ||
| > | Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike | > | Ars Technica GRU indictment Jul 2018)(Citation: Crowdstrike | ||
| > | DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWork | > | DNC June 2016)(Citation: FireEye APT28)(Citation: SecureWork | ||
| > | s TG-4127)(Citation: FireEye APT28 January 2017)(Citation: G | > | s TG-4127)(Citation: FireEye APT28 January 2017)(Citation: G | ||
| > | RIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: | > | RIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: | ||
| > | Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018 | > | Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018 | ||
| > | )(Citation: ESET Zebrocy May 2019) [APT28](https://attack.m | > | )(Citation: ESET Zebrocy May 2019) [APT28](https://attack.m | ||
| > | itre.org/groups/G0007) reportedly compromised the Hillary Cl | > | itre.org/groups/G0007) reportedly compromised the Hillary Cl | ||
| > | inton campaign, the Democratic National Committee, and the D | > | inton campaign, the Democratic National Committee, and the D | ||
| > | emocratic Congressional Campaign Committee in 2016 in an att | > | emocratic Congressional Campaign Committee in 2016 in an att | ||
| > | empt to interfere with the U.S. presidential election. (Cita | > | empt to interfere with the U.S. presidential election.(Citat | ||
| > | tion: Crowdstrike DNC June 2016) In 2018, the US indicted fi | > | ion: Crowdstrike DNC June 2016) In 2018, the US indicted fiv | ||
| > | ve GRU Unit 26165 officers associated with [APT28](https://a | > | e GRU Unit 26165 officers associated with [APT28](https://at | ||
| > | ttack.mitre.org/groups/G0007) for cyber operations (includin | > | tack.mitre.org/groups/G0007) for cyber operations (including | ||
| > | g close-access operations) conducted between 2014 and 2018 a | > | close-access operations) conducted between 2014 and 2018 ag | ||
| > | gainst the World Anti-Doping Agency (WADA), the US Anti-Dopi | > | ainst the World Anti-Doping Agency (WADA), the US Anti-Dopin | ||
| > | ng Agency, a US nuclear facility, the Organization for the P | > | g Agency, a US nuclear facility, the Organization for the Pr | ||
| > | rohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemi | > | ohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemic | ||
| > | cals Laboratory, and other organizations.(Citation: US Distr | > | als Laboratory, and other organizations.(Citation: US Distri | ||
| > | ict Court Indictment GRU Oct 2018) Some of these were conduc | > | ct Court Indictment GRU Oct 2018) Some of these were conduct | ||
| > | ted with the assistance of GRU Unit 74455, which is also ref | > | ed with the assistance of GRU Unit 74455, which is also refe | ||
| > | erred to as [Sandworm Team](https://attack.mitre.org/groups/ | > | rred to as [Sandworm Team](https://attack.mitre.org/groups/G | ||
| > | G0034). | > | 0034). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT33](https://attack.mitre.org/groups/G0064) is a suspecte | t | 1 | [APT33](https://attack.mitre.org/groups/G0064) is a suspecte |
| > | d Iranian threat group that has carried out operations since | > | d Iranian threat group that has carried out operations since | ||
| > | at least 2013. The group has targeted organizations across | > | at least 2013. The group has targeted organizations across | ||
| > | multiple industries in the United States, Saudi Arabia, and | > | multiple industries in the United States, Saudi Arabia, and | ||
| > | South Korea, with a particular interest in the aviation and | > | South Korea, with a particular interest in the aviation and | ||
| > | energy sectors. (Citation: FireEye APT33 Sept 2017) (Citatio | > | energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: | ||
| > | n: FireEye APT33 Webinar Sept 2017) | > | FireEye APT33 Webinar Sept 2017) |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko | t | 1 | [APT38](https://attack.mitre.org/groups/G0082) is a North Ko |
| > | rean state-sponsored threat group that specializes in financ | > | rean state-sponsored threat group that specializes in financ | ||
| > | ial cyber operations; it has been attributed to the Reconnai | > | ial cyber operations; it has been attributed to the Reconnai | ||
| > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | > | ssance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A | ||
| > | ugust 2020) Active since at least 2014, [APT38](https://atta | > | ugust 2020) Active since at least 2014, [APT38](https://atta | ||
| > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | > | ck.mitre.org/groups/G0082) has targeted banks, financial ins | ||
| > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | > | titutions, casinos, cryptocurrency exchanges, SWIFT system e | ||
| > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | > | ndpoints, and ATMs in at least 38 countries worldwide. Signi | ||
| > | ficant operations include the 2016 Bank of Bangladesh heist, | > | ficant operations include the 2016 Bank of Bangladesh heist, | ||
| > | during which [APT38](https://attack.mitre.org/groups/G0082) | > | during which [APT38](https://attack.mitre.org/groups/G0082) | ||
| > | stole $81 million, as well as attacks against Bancomext (20 | > | stole $81 million, as well as attacks against Bancomext (Ci | ||
| > | 18) and Banco de Chile (2018); some of their attacks have be | > | tation: FireEye APT38 Oct 2018) and Banco de Chile (Citation | ||
| > | en destructive.(Citation: CISA AA20-239A BeagleBoyz August 2 | > | : FireEye APT38 Oct 2018); some of their attacks have been d | ||
| > | 020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North K | > | estructive.(Citation: CISA AA20-239A BeagleBoyz August 2020) | ||
| > | orea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under | > | (Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea | ||
| > | The Hood Blog 2017) North Korean group definitions are know | > | Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The | ||
| > | n to have significant overlap, and some security researchers | > | Hood Blog 2017) North Korean group definitions are known to | ||
| > | report all North Korean state-sponsored cyber activity unde | > | have significant overlap, and some security researchers rep | ||
| > | r the name [Lazarus Group](https://attack.mitre.org/groups/G | > | ort all North Korean state-sponsored cyber activity under th | ||
| > | 0032) instead of tracking clusters or subgroups. | > | e name [Lazarus Group](https://attack.mitre.org/groups/G0032 | ||
| > | ) instead of tracking clusters or subgroups. |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [Lazarus Group](https://attack.mitre.org/groups/G0032) is a | t | 1 | [Lazarus Group](https://attack.mitre.org/groups/G0032) is a |
| > | North Korean state-sponsored cyber threat group that has bee | > | North Korean state-sponsored cyber threat group that has bee | ||
| > | n attributed to the Reconnaissance General Bureau.(Citation: | > | n attributed to the Reconnaissance General Bureau.(Citation: | ||
| > | US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko | > | US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Ko | ||
| > | rean Cyber Groups September 2019) The group has been active | > | rean Cyber Groups September 2019) The group has been active | ||
| > | since at least 2009 and was reportedly responsible for the N | > | since at least 2009 and was reportedly responsible for the N | ||
| > | ovember 2014 destructive wiper attack against Sony Pictures | > | ovember 2014 destructive wiper attack against Sony Pictures | ||
| > | Entertainment as part of a campaign named Operation Blockbus | > | Entertainment as part of a campaign named Operation Blockbus | ||
| > | ter by Novetta. Malware used by [Lazarus Group](https://atta | > | ter by Novetta. Malware used by [Lazarus Group](https://atta | ||
| > | ck.mitre.org/groups/G0032) correlates to other reported camp | > | ck.mitre.org/groups/G0032) correlates to other reported camp | ||
| > | aigns, including Operation Flame, Operation 1Mission, Operat | > | aigns, including Operation Flame, Operation 1Mission, Operat | ||
| > | ion Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novett | > | ion Troy, DarkSeoul, and Ten Days of Rain.(Citation: Novetta | ||
| > | a Blockbuster) North Korean group definitions are known to | > | Blockbuster) North Korean group definitions are known to h | ||
| > | have significant overlap, and some security researchers repo | > | ave significant overlap, and some security researchers repor | ||
| > | rt all North Korean state-sponsored cyber activity under the | > | t all North Korean state-sponsored cyber activity under the | ||
| > | name [Lazarus Group](https://attack.mitre.org/groups/G0032) | > | name [Lazarus Group](https://attack.mitre.org/groups/G0032) | ||
| > | instead of tracking clusters or subgroups, such as [Andarie | > | instead of tracking clusters or subgroups, such as [Andariel | ||
| > | l](https://attack.mitre.org/groups/G0138), [APT37](https://a | > | ](https://attack.mitre.org/groups/G0138), [APT37](https://at | ||
| > | ttack.mitre.org/groups/G0067), [APT38](https://attack.mitre. | > | tack.mitre.org/groups/G0067), [APT38](https://attack.mitre.o | ||
| > | org/groups/G0082), and [Kimsuky](https://attack.mitre.org/gr | > | rg/groups/G0082), and [Kimsuky](https://attack.mitre.org/gro | ||
| > | oups/G0094). | > | ups/G0094). |
| Old Description | New Description | ||||
|---|---|---|---|---|---|
| t | 1 | [OilRig](https://attack.mitre.org/groups/G0049) is a suspect | t | 1 | [OilRig](https://attack.mitre.org/groups/G0049) is a suspect |
| > | ed Iranian threat group that has targeted Middle Eastern and | > | ed Iranian threat group that has targeted Middle Eastern and | ||
| > | international victims since at least 2014. The group has ta | > | international victims since at least 2014. The group has ta | ||
| > | rgeted a variety of sectors, including financial, government | > | rgeted a variety of sectors, including financial, government | ||
| > | , energy, chemical, and telecommunications. It appears the g | > | , energy, chemical, and telecommunications. It appears the g | ||
| > | roup carries out supply chain attacks, leveraging the trust | > | roup carries out supply chain attacks, leveraging the trust | ||
| > | relationship between organizations to attack their primary t | > | relationship between organizations to attack their primary t | ||
| > | argets. FireEye assesses that the group works on behalf of t | > | argets. The group works on behalf of the Iranian government | ||
| > | he Iranian government based on infrastructure details that c | > | based on infrastructure details that contain references to I | ||
| > | ontain references to Iran, use of Iranian infrastructure, an | > | ran, use of Iranian infrastructure, and targeting that align | ||
| > | d targeting that aligns with nation-state interests.(Citatio | > | s with nation-state interests.(Citation: FireEye APT34 Dec 2 | ||
| > | n: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Ja | > | 017)(Citation: Palo Alto OilRig April 2017)(Citation: ClearS | ||
| > | n 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo | > | ky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Cit | ||
| > | Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023) | > | ation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Pl | ||
| > | (Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGE | > | aybook 2023)(Citation: Unit 42 QUADAGENT July 2018) | ||
| > | NT July 2018) |