ATT&CK Changes Between v8.2 and v9.0

Key

Colors for description field
Added
Changed
Deleted

Additional formats

These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.

This JSON file contains the machine readble output used to create this page: changelog.json

Techniques

enterprise-attack

New Techniques

[T1547.014] Boot or Logon Autostart Execution: Active Setup

Current version: 1.0

Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.


[T1612] Build Image on Host

Current version: 1.0

Description: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image) An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.


[T1553.006] Subvert Trust Controls: Code Signing Policy Modification

Current version: 1.0

Description: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system. Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.(Citation: Microsoft DSE June 2017)(Citation: Apple Disable SIP) Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system. Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.(Citation: Microsoft Unsigned Driver Apr 2017)(Citation: Apple Disable SIP) Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, [Modify Registry](https://attack.mitre.org/techniques/T1112), rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP)(Citation: FireEye HIKIT Rootkit Part 2)(Citation: GitHub Turla Driver Loader) Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP) Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system. Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the system is in Test Mode). Adversaries may attempt to remove such artifacts.(Citation: F-Secure BlackEnergy 2014) To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) using a signed, but vulnerable driver.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)


[T1552.007] Unsecured Credentials: Container API

Current version: 1.0

Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API) An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.


[T1609] Container Administration Command

Current version: 1.0

Description: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.(Citation: Kubectl Exec Get Shell)


[T1053.007] Scheduled Task/Job: Container Orchestration Job

Current version: 1.0

Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)


[T1613] Container and Resource Discovery

Current version: 1.0

Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.


[T1610] Deploy Container

Current version: 1.0

Description: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)


[T1608.004] Stage Capabilities: Drive-by Target

Current version: 1.0

Description: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts. Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers. In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox) Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).


[T1611] Escape to Host

Current version: 1.0

Description: Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview) There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, and utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.


[T1608.003] Stage Capabilities: Install Digital Certificate

Current version: 1.0

Description: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert) Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. Adversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).


[T1016.001] System Network Configuration Discovery: Internet Connection Discovery

Current version: 1.0

Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.


[T1608.005] Stage Capabilities: Link Target

Current version: 1.0

Description: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link. Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user. Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Link shortening services can also be employed.


[T1204.003] User Execution: Malicious Image

Current version: 1.0

Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).


[T1553.005] Subvert Trust Controls: Mark-of-the-Web Bypass

Current version: 1.0

Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020) Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)


[T1555.005] Credentials from Password Stores: Password Managers

Current version: 1.0

Description: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019) Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610) Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)


[T1608] Stage Capabilities

Current version: 1.0

Description: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020) Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to): * Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox) * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) * Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020) * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert)


[T1614] System Location Discovery

Current version: 1.0

Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)


[T1608.001] Stage Capabilities: Upload Malware

Current version: 1.0

Description: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Malware can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020) Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via [User Execution](https://attack.mitre.org/techniques/T1204). [Masquerading](https://attack.mitre.org/techniques/T1036) may increase the chance of users mistakenly executing these files.


[T1608.002] Stage Capabilities: Upload Tool

Current version: 1.0

Description: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server. Tools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo. Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.


[T1555.004] Credentials from Password Stores: Windows Credential Manager

Current version: 1.0

Description: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker) The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker. Credential Lockers store credentials in encrypted .vcrd files, located under %Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault) Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may gather credentials by reading files located inside of the Credential Lockers. Adversaries may also abuse Windows APIs such as CredEnumerateA to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager) Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)


[T1547.013] Boot or Logon Autostart Execution: XDG Autostart Entries

Current version: 1.0

Description: Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.(Citation: Free Desktop Application Autostart Feb 2006) Within an XDG autostart entry file, the Type key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The Name key indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.(Citation: Free Desktop Entry Keys) Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make XDG autostart entries look as if they are associated with legitimate programs.

Major Version Changes

[T1574.002] Hijack Execution Flow: DLL Side-Loading

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may execute their own malicious payloads by hijat1Adversaries may execute their own malicious payloads by side
>cking the library manifest used to load DLLs. Adversaries ma>-loading DLLs. Similar to [DLL Search Order Hijacking](https
>y take advantage of vague references in the library manifest>://attack.mitre.org/techniques/T1574/001), side-loading invo
> of a program by replacing a legitimate library with a malic>lves hijacking which DLL a program loads. But rather than ju
>ious one, causing the operating system to load their malicio>st planting the DLL within the search order of a program the
>us library when it is called for by the victim program.  Pro>n waiting for the victim application to be invoked, adversar
>grams may specify DLLs that are loaded at runtime. Programs >ies may directly side-load their payloads by planting then i
>that improperly or vaguely specify a required DLL may be ope>nvoking a legitimate application that executes their payload
>n to a vulnerability in which an unintended DLL is loaded. S>(s).  Side-loading takes advantage of the DLL search order u
>ide-loading vulnerabilities specifically occur when Windows >sed by the loader by positioning both the victim application
>Side-by-Side (WinSxS) manifests (Citation: About Side by Sid> and malicious payload(s) alongside each other. Adversaries 
>e Assemblies) are not explicit enough about characteristics >likely use side-loading as a means of masking actions they p
>of the DLL to be loaded. Adversaries may take advantage of a>erform under a legitimate, trusted, and potentially elevated
> legitimate program that is vulnerable by replacing the legi> system or software process. Benign executables used to side
>timate DLL with a malicious one.  (Citation: FireEye DLL Sid>-load payloads may not be flagged during delivery and/or exe
>e-Loading)  Adversaries likely use this technique as a means>cution. Adversary payloads may also be encrypted/packed or o
> of masking actions they perform under a legitimate, trusted>therwise obfuscated until loaded into the memory of the trus
> system or software process.>ted process.(Citation: FireEye DLL Side-Loading)

New Mitigations:

Dropped Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-17 15:15:27.807000+00:002021-04-26 18:31:34.954000+00:00
descriptionAdversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program. Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: About Side by Side Assemblies) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable by replacing the legitimate DLL with a malicious one. (Citation: FireEye DLL Side-Loading) Adversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s). Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other. Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. Benign executables used to side-load payloads may not be flagged during delivery and/or execution. Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.(Citation: FireEye DLL Side-Loading)
external_references[2]['source_name']About Side by Side AssembliesFireEye DLL Side-Loading
external_references[2]['description']Microsoft. (2018, May 31). About Side-by-Side Assemblies. Retrieved March 13, 2020.Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in the Side of the Anti-Virus Industry. Retrieved March 13, 2020.
external_references[2]['url']https://docs.microsoft.com/en-us/windows/win32/sbscs/about-side-by-side-assemblies-https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf
x_mitre_data_sources[0]Loaded DLLsFile: File Creation
x_mitre_data_sources[1]Process monitoringFile: File Modification
x_mitre_data_sources[2]Process use of networkModule: Module Load
x_mitre_detectionMonitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track DLL metadata, such as a hash, and compare DLLs that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so) as well as the introduction of new files/programs. Track DLL metadata, such as a hash, and compare DLLs that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'FireEye DLL Side-Loading', 'description': 'Amanda Steward. (2014). FireEye DLL Side-Loading: A Thorn in the Side of the Anti-Virus Industry. Retrieved March 13, 2020.', 'url': 'https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf'}

[T1556.001] Modify Authentication Process: Domain Controller Authentication

Current version: 2.0

Version changed from: 1.0 → 2.0

Details
values_changed
STIX FieldOld valueNew Value
modified2020-08-26 14:16:48.125000+00:002021-04-20 20:10:26.613000+00:00
x_mitre_data_sources[0]Authentication logsLogon Session: Logon Session Creation
x_mitre_data_sources[1]API monitoringProcess: OS API Execution
x_mitre_data_sources[2]DLL monitoringProcess: Process Access
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
kill_chain_phases{'kill_chain_name': 'mitre-attack', 'phase_name': 'persistence'}
x_mitre_data_sourcesFile: File Modification

[T1574.004] Hijack Execution Flow: Dylib Hijacking

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may execute their own malicious payloads by hijat1Adversaries may execute their own payloads by placing a mali
>cking ambiguous paths  used to load libraries. Adversaries m>cious dynamic library (dylib) with an expected name in a pat
>ay plant trojan dynamic libraries, in a directory that will >h a victim application searches at runtime. The dynamic load
>be searched by the operating system before the legitimate li>er will try to find the dylibs based on the sequential order
>brary specified by the victim program, so that their malicio> of the search paths. Paths to dylibs may be prefixed with <
>us library will be loaded into the victim program instead.  >code>@rpath</code>, which allows developers to use relative 
>MacOS and OS X use a common method to look for required dyna>paths to specify an array of search paths used at runtime ba
>mic libraries (dylib) to load into a program based on search>sed on the location of the executable.  Additionally, if wea
> paths.  A common method is to see what dylibs an applicatio>k linking is used, such as the <code>LC_LOAD_WEAK_DYLIB</cod
>n uses, then plant a malicious version with the same name hi>e> function, an application will still execute even if an ex
>gher up in the search path. This typically results in the dy>pected dylib is not present. Weak linking enables developers
>lib being in the same folder as the application itself. (Cit> to run an application on multiple macOS versions as new API
>ation: Writing Bad Malware for OSX) (Citation: Malware Persi>s are added.  Adversaries may gain execution by inserting ma
>stence on OS X)  If the program is configured to run at a hi>licious dylibs with the name of the missing dylib in the ide
>gher privilege level than the current user, then when the dy>ntified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)
>lib is loaded into the application, the dylib will also run >(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github
>at that elevated level.> EmpireProject HijackScanner)(Citation: Github EmpireProject
 > CreateHijacker Dylib) Dylibs are loaded into an application
 >'s address space allowing the malicious dylib to inherit the
 > application's privilege level and resources. Based on the a
 >pplication, this could result in privilege escalation and un
 >inhibited network access. This method may also evade detecti
 >on from security products since the execution is masked unde
 >r a legitimate process.(Citation: Writing Bad Malware for OS
 >X)(Citation: wardle artofmalware volume1)(Citation: MalwareU
 >nicorn macOS Dylib Injection MachO)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 16:48:09.391000+00:002021-04-27 20:19:15.212000+00:00
descriptionAdversaries may execute their own malicious payloads by hijacking ambiguous paths used to load libraries. Adversaries may plant trojan dynamic libraries, in a directory that will be searched by the operating system before the legitimate library specified by the victim program, so that their malicious library will be loaded into the victim program instead. MacOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. A common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. This typically results in the dylib being in the same folder as the application itself. (Citation: Writing Bad Malware for OSX) (Citation: Malware Persistence on OS X) If the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level.Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added. Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Wardle Dylib Hijacking OSX 2015)(Citation: Github EmpireProject HijackScanner)(Citation: Github EmpireProject CreateHijacker Dylib) Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources. Based on the application, this could result in privilege escalation and uninhibited network access. This method may also evade detection from security products since the execution is masked under a legitimate process.(Citation: Writing Bad Malware for OSX)(Citation: wardle artofmalware volume1)(Citation: MalwareUnicorn macOS Dylib Injection MachO)
external_references[2]['source_name']Writing Bad Malware for OSXWardle Dylib Hijack Vulnerable Apps
external_references[2]['description']Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved July 10, 2017.Patrick Wardle. (2019, July 2). Getting Root with Benign AppStore Apps. Retrieved March 31, 2021.
external_references[2]['url']https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdfhttps://objective-see.com/blog/blog_0x46.html
external_references[3]['source_name']Malware Persistence on OS XWardle Dylib Hijacking OSX 2015
external_references[3]['description']Patrick Wardle. (2015). Malware Persistence on OS X Yosemite. Retrieved July 10, 2017.Patrick Wardle. (2015, March 1). Dylib Hijacking on OS X. Retrieved March 29, 2021.
external_references[3]['url']https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdfhttps://www.virusbulletin.com/uploads/pdf/magazine/2015/vb201503-dylib-hijacking.pdf
x_mitre_data_sources[0]Process monitoringFile: File Creation
x_mitre_data_sources[1]File monitoringFile: File Modification
x_mitre_detectionObjective-See's Dylib Hijacking Scanner can be used to detect potential cases of dylib hijacking. Monitor file systems for moving, renaming, replacing, or modifying dylibs. Changes in the set of dylibs that are loaded by a process (compared to past behavior) that do not correlate with known software, patches, etc., are suspicious. Check the system for multiple dylibs with the same name and monitor which versions have historically been loaded into a process. Monitor file systems for moving, renaming, replacing, or modifying dylibs. Changes in the set of dylibs that are loaded by a process (compared to past behavior) that do not correlate with known software, patches, etc., are suspicious. Check the system for multiple dylibs with the same name and monitor which versions have historically been loaded into a process. Run path dependent libraries can include LC_LOAD_DYLIB, LC_LOAD_WEAK_DYLIB, and LC_RPATH. Other special keywords are recognized by the macOS loader are @rpath, @loader_path, and @executable_path.(Citation: Apple Developer Doco Archive Run-Path) These loader instructions can be examined for individual binaries or frameworks using the otool -l command. Objective-See's Dylib Hijacking Scanner can be used to identify applications vulnerable to dylib hijacking.(Citation: Wardle Dylib Hijack Vulnerable Apps)(Citation: Github EmpireProject HijackScanner)
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Github EmpireProject HijackScanner', 'description': 'Wardle, P., Ross, C. (2017, September 21). Empire Project Dylib Hijack Vulnerability Scanner. Retrieved April 1, 2021.', 'url': 'https://github.com/EmpireProject/Empire/blob/master/lib/modules/python/situational_awareness/host/osx/HijackScanner.py'}
external_references{'source_name': 'Github EmpireProject CreateHijacker Dylib', 'description': 'Wardle, P., Ross, C. (2018, April 8). EmpireProject Create Dylib Hijacker. Retrieved April 1, 2021.', 'url': 'https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/persistence/osx/CreateHijacker.py'}
external_references{'source_name': 'Writing Bad Malware for OSX', 'description': 'Patrick Wardle. (2015). Writing Bad @$$ Malware for OS X. Retrieved July 10, 2017.', 'url': 'https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-Writing-Bad-A-Malware-For-OS-X.pdf'}
external_references{'source_name': 'wardle artofmalware volume1', 'description': 'Patrick Wardle. (2020, August 5). The Art of Mac Malware Volume 0x1: Analysis. Retrieved March 19, 2021.', 'url': 'https://taomm.org/vol1/pdfs.html'}
external_references{'source_name': 'MalwareUnicorn macOS Dylib Injection MachO', 'description': 'Amanda Rousseau. (2020, April 4). MacOS Dylib Injection Workshop. Retrieved March 29, 2021.', 'url': 'https://malwareunicorn.org/workshops/macos_dylib_injection.html#5'}
external_references{'source_name': 'Apple Developer Doco Archive Run-Path', 'description': 'Apple Inc.. (2012, July 7). Run-Path Dependent Libraries. Retrieved March 31, 2021.', 'url': 'https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/RunpathDependentLibraries.html'}
x_mitre_data_sourcesModule: Module Load

[T1574.006] Hijack Execution Flow: Dynamic Linker Hijacking

Current version: 2.0

Version changed from: 1.1 → 2.0


Old Description
New Description
t1Adversaries may execute their own malicious payloads by hijat1Adversaries may execute their own malicious payloads by hija
>cking the dynamic linker used to load libraries. The dynamic>cking environment variables the dynamic linker uses to load 
> linker is used to load shared library dependencies needed b>shared libraries. During the execution preparation phase of 
>y an executing program. The dynamic linker will typically ch>a program, the dynamic linker loads specified absolute paths
>eck provided absolute paths and common directories for these> of shared libraries from environment variables and files, s
> dependencies, but can be overridden by shared objects speci>uch as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT
>fied by LD_PRELOAD to be loaded before all others.(Citation:>_LIBRARIES</code> on macOS. Libraries specified in environme
> Man LD.SO)(Citation: TLDP Shared Libraries)  Adversaries ma>nt variables are loaded first, taking precedence over system
>y set LD_PRELOAD to point to malicious libraries that match > libraries with the same function name.(Citation: Man LD.SO)
>the name of legitimate libraries which are requested by a vi>(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archi
>ctim program, causing the operating system to load the adver>ve Dynamic Libraries) These variables are often used by deve
>sary's malicious code upon execution of the victim program. >lopers to debug binaries without needing to recompile, decon
>LD_PRELOAD can be set via the environment variable or <code>>flict mapped symbols, and implement custom functions without
>/etc/ld.so.preload</code> file.(Citation: Man LD.SO)(Citatio> changing the original library.(Citation: Baeldung LD_PRELOA
>n: TLDP Shared Libraries) Libraries specified by LD_PRELOAD >D)  On Linux and macOS, hijacking dynamic linker variables m
>with be loaded and mapped into memory by <code>dlopen()</cod>ay grant access to the victim process's memory, system/netwo
>e> and <code>mmap()</code> respectively.(Citation: Code Inje>rk resources, and possibly elevated privileges. This method 
>ction on Linux and macOS) (Citation: Uninformed Needle) (Cit>may also evade detection from security products since the ex
>ation: Phrack halfdead 1997)  LD_PRELOAD hijacking may grant>ecution is masked under a legitimate process. Adversaries ca
> access to the victim process's memory, system/network resou>n set environment variables via the command line using the <
>rces, and possibly elevated privileges. Execution via LD_PRE>code>export</code> command, <code>setenv</code> function, or
>LOAD hijacking may also evade detection from security produc> <code>putenv</code> function. Adversaries can also leverage
>ts since the execution is masked under a legitimate process.> [Dynamic Linker Hijacking](https://attack.mitre.org/techniq
 >ues/T1574/006) to export variables in a shell or set variabl
 >es programmatically using higher level syntax such Python’s 
 ><code>os.environ</code>.  On Linux, adversaries may set <cod
 >e>LD_PRELOAD</code> to point to malicious libraries that mat
 >ch the name of legitimate libraries which are requested by a
 > victim program, causing the operating system to load the ad
 >versary's malicious code upon execution of the victim progra
 >m. <code>LD_PRELOAD</code> can be set via the environment va
 >riable or <code>/etc/ld.so.preload</code> file.(Citation: Ma
 >n LD.SO)(Citation: TLDP Shared Libraries) Libraries specifie
 >d by <code>LD_PRELOAD</code> are loaded and mapped into memo
 >ry by <code>dlopen()</code> and <code>mmap()</code> respecti
 >vely.(Citation: Code Injection on Linux and macOS)(Citation:
 > Uninformed Needle) (Citation: Phrack halfdead 1997)(Citatio
 >n: Brown Exploiting Linkers)   On macOS this behavior is con
 >ceptually the same as on Linux, differing only in how the ma
 >cOS dynamic libraries (dyld) is implemented at a lower level
 >. Adversaries can set the <code>DYLD_INSERT_LIBRARIES</code>
 > environment variable to point to malicious libraries contai
 >ning names of legitimate libraries or functions requested by
 > a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIE
 >S)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilond
 >o DYLD_INSERT_LIBRARIES Catalina Bypass) 

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_permissions_required['User']
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 16:49:46.904000+00:002021-04-27 19:55:18.453000+00:00
nameLD_PRELOADDynamic Linker Hijacking
descriptionAdversaries may execute their own malicious payloads by hijacking the dynamic linker used to load libraries. The dynamic linker is used to load shared library dependencies needed by an executing program. The dynamic linker will typically check provided absolute paths and common directories for these dependencies, but can be overridden by shared objects specified by LD_PRELOAD to be loaded before all others.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. LD_PRELOAD can be set via the environment variable or /etc/ld.so.preload file.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Libraries specified by LD_PRELOAD with be loaded and mapped into memory by dlopen() and mmap() respectively.(Citation: Code Injection on Linux and macOS) (Citation: Uninformed Needle) (Citation: Phrack halfdead 1997) LD_PRELOAD hijacking may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. Execution via LD_PRELOAD hijacking may also evade detection from security products since the execution is masked under a legitimate process.Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.(Citation: Baeldung LD_PRELOAD) On Linux and macOS, hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges. This method may also evade detection from security products since the execution is masked under a legitimate process. Adversaries can set environment variables via the command line using the export command, setenv function, or putenv function. Adversaries can also leverage [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) to export variables in a shell or set variables programmatically using higher level syntax such Python’s os.environ. On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program. LD_PRELOAD can be set via the environment variable or /etc/ld.so.preload file.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries) Libraries specified by LD_PRELOAD are loaded and mapped into memory by dlopen() and mmap() respectively.(Citation: Code Injection on Linux and macOS)(Citation: Uninformed Needle) (Citation: Phrack halfdead 1997)(Citation: Brown Exploiting Linkers) On macOS this behavior is conceptually the same as on Linux, differing only in how the macOS dynamic libraries (dyld) is implemented at a lower level. Adversaries can set the DYLD_INSERT_LIBRARIES environment variable to point to malicious libraries containing names of legitimate libraries or functions requested by a victim program.(Citation: TheEvilBit DYLD_INSERT_LIBRARIES)(Citation: Timac DYLD_INSERT_LIBRARIES)(Citation: Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass)
external_references[5]['source_name']Code Injection on Linux and macOSApple Doco Archive Dynamic Libraries
external_references[5]['description']Itamar Turner-Trauring. (2017, April 18). “This will only hurt for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017.Apple Inc.. (2012, July 23). Overview of Dynamic Libraries. Retrieved March 24, 2021.
external_references[5]['url']https://www.datawire.io/code-injection-on-linux-and-macos/https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html
external_references[6]['source_name']Uninformed NeedleBaeldung LD_PRELOAD
external_references[6]['description']skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.baeldung. (2020, August 9). What Is the LD_PRELOAD Trick?. Retrieved March 24, 2021.
external_references[6]['url']http://hick.org/code/skape/papers/needle.txthttps://www.baeldung.com/linux/ld_preload-trick-what-is
external_references[7]['source_name']Phrack halfdead 1997Code Injection on Linux and macOS
external_references[7]['description']halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017.Itamar Turner-Trauring. (2017, April 18). “This will only hurt for a moment”: code injection on Linux and macOS with LD_PRELOAD. Retrieved December 20, 2017.
external_references[7]['url']http://phrack.org/issues/51/8.htmlhttps://www.datawire.io/code-injection-on-linux-and-macos/
x_mitre_data_sources[0]Process monitoringFile: File Creation
x_mitre_data_sources[1]File monitoringFile: File Modification
x_mitre_data_sources[2]Environment variableModule: Module Load
x_mitre_detectionMonitor for changes to environment variables and files associated with loading shared libraries such as LD_PRELOAD, as well as the commands to implement these changes. Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.Monitor for changes to environment variables and files associated with loading shared libraries such as LD_PRELOAD and DYLD_INSERT_LIBRARIES, as well as the commands to implement these changes. Monitor processes for unusual activity (e.g., a process that does not use the network begins to do so). Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.
x_mitre_version1.12.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Uninformed Needle', 'description': 'skape. (2003, January 19). Linux x86 run-time process manipulation. Retrieved December 20, 2017.', 'url': 'http://hick.org/code/skape/papers/needle.txt'}
external_references{'source_name': 'Phrack halfdead 1997', 'description': 'halflife. (1997, September 1). Shared Library Redirection Techniques. Retrieved December 20, 2017.', 'url': 'http://phrack.org/issues/51/8.html'}
external_references{'source_name': 'Brown Exploiting Linkers', 'description': 'Tim Brown. (2011, June 29). Breaking the links: Exploiting the linker. Retrieved March 29, 2021.', 'url': 'http://www.nth-dimension.org.uk/pub/BTL.pdf'}
external_references{'source_name': 'TheEvilBit DYLD_INSERT_LIBRARIES', 'description': 'Fitzl, C. (2019, July 9). DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX. Retrieved March 26, 2020.', 'url': 'https://theevilbit.github.io/posts/dyld_insert_libraries_dylib_injection_in_macos_osx_deep_dive/'}
external_references{'source_name': 'Timac DYLD_INSERT_LIBRARIES', 'description': 'Timac. (2012, December 18). Simple code injection using DYLD_INSERT_LIBRARIES. Retrieved March 26, 2020.', 'url': 'https://blog.timac.org/2012/1218-simple-code-injection-using-dyld_insert_libraries/'}
external_references{'source_name': 'Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass', 'description': 'Jon Gabilondo. (2019, September 22). How to Inject Code into Mach-O Apps. Part II.. Retrieved March 24, 2021.', 'url': 'https://jon-gabilondo-angulo-7635.medium.com/how-to-inject-code-into-mach-o-apps-part-ii-ddb13ebc8191'}
x_mitre_data_sourcesProcess: Process Creation
x_mitre_data_sourcesCommand: Command Execution
x_mitre_platformsmacOS

[T1525] Implant Internal Image

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may implant cloud container images with maliciout1Adversaries may implant cloud or container images with malic
>s code to establish persistence. Amazon Web Service (AWS) Am>ious code to establish persistence after gaining access to a
>azon Machine Images (AMI), Google Cloud Platform (GCP) Image>n environment. Amazon Web Services (AWS) Amazon Machine Imag
>s, and Azure Images as well as popular container runtimes su>es (AMIs), Google Cloud Platform (GCP) Images, and Azure Ima
>ch as Docker can be implanted or backdoored. Depending on ho>ges as well as popular container runtimes such as Docker can
>w the infrastructure is provisioned, this could provide pers> be implanted or backdoored. Unlike [Upload Malware](https:/
>istent access if the infrastructure provisioning tool is ins>/attack.mitre.org/techniques/T1608/001), this technique focu
>tructed to always use the latest image.(Citation: Rhino Labs>ses on adversaries implanting an image in a registry within 
> Cloud Image Backdoor Technique Sept 2019)  A tool has been >a victim’s environment. Depending on how the infrastructure 
>developed to facilitate planting backdoors in cloud containe>is provisioned, this could provide persistent access if the 
>r images.(Citation: Rhino Labs Cloud Backdoor September 2019>infrastructure provisioning tool is instructed to always use
>) If an attacker has access to a compromised AWS instance, a> the latest image.(Citation: Rhino Labs Cloud Image Backdoor
>nd permissions to list the available container images, they > Technique Sept 2019)  A tool has been developed to facilita
>may implant a backdoor such as a [Web Shell](https://attack.>te planting backdoors in cloud container images.(Citation: R
>mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud >hino Labs Cloud Backdoor September 2019) If an attacker has 
>Image Backdoor Technique Sept 2019) Adversaries may also imp>access to a compromised AWS instance, and permissions to lis
>lant Docker images that may be inadvertently used in cloud d>t the available container images, they may implant a backdoo
>eployments, which has been reported in some instances of cry>r such as a [Web Shell](https://attack.mitre.org/techniques/
>ptomining botnets.(Citation: ATT Cybersecurity Cryptocurrenc>T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Techni
>y Attacks on Cloud) >que Sept 2019)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 22:47:34.137000+00:002021-04-12 18:28:27.948000+00:00
nameImplant Container ImageImplant Internal Image
descriptionAdversaries may implant cloud container images with malicious code to establish persistence. Amazon Web Service (AWS) Amazon Machine Images (AMI), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) A tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a [Web Shell](https://attack.mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) Adversaries may also implant Docker images that may be inadvertently used in cloud deployments, which has been reported in some instances of cryptomining botnets.(Citation: ATT Cybersecurity Cryptocurrency Attacks on Cloud) Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019) A tool has been developed to facilitate planting backdoors in cloud container images.(Citation: Rhino Labs Cloud Backdoor September 2019) If an attacker has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a [Web Shell](https://attack.mitre.org/techniques/T1505/003).(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
x_mitre_data_sources[0]File monitoringImage: Image Creation
x_mitre_data_sources[1]Asset managementImage: Image Modification
x_mitre_detectionMonitor interactions with images and containers by users to identify ones that are added or modified anomalously.Monitor interactions with images and containers by users to identify ones that are added or modified anomalously. In containerized environments, changes may be detectable by monitoring the Docker daemon logs or setting up and monitoring Kubernetes audit logs depending on registry configuration.
x_mitre_platforms[0]GCPIaaS
x_mitre_platforms[1]AzureContainers
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsYossi Weizman, Azure Defender Research Team
x_mitre_contributorsVishwas Manral, McAfee
iterable_item_removed
STIX FieldOld valueNew Value
external_references{'source_name': 'ATT Cybersecurity Cryptocurrency Attacks on Cloud', 'description': 'Doman, C. & Hegel, T.. (2019, March 14). Making it Rain - Cryptocurrency Mining Attacks in the Cloud. Retrieved October 3, 2019.', 'url': 'https://www.alienvault.com/blogs/labs-research/making-it-rain-cryptocurrency-mining-attacks-in-the-cloud'}
x_mitre_platformsAWS

[T1059.007] Command and Scripting Interpreter: JavaScript

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may abuse JavaScript and/or JScript for executiot1Adversaries may abuse various implementations of JavaScript 
>n. JavaScript (JS) is a platform-agnostic scripting language>for execution. JavaScript (JS) is a platform-independent scr
> (compiled just-in-time at runtime) commonly associated with>ipting language (compiled just-in-time at runtime) commonly 
> scripts in webpages, though JS can be executed in runtime e>associated with scripts in webpages, though JS can be execut
>nvironments outside the browser.(Citation: NodeJS)  JScript >ed in runtime environments outside the browser.(Citation: No
>is the Microsoft implementation of the same scripting standa>deJS)  JScript is the Microsoft implementation of the same s
>rd. JScript is interpreted via the Windows Script engine and>cripting standard. JScript is interpreted via the Windows Sc
> thus integrated with many components of Windows such as the>ript engine and thus integrated with many components of Wind
> [Component Object Model](https://attack.mitre.org/technique>ows such as the [Component Object Model](https://attack.mitr
>s/T1559/001) and Internet Explorer HTML Application (HTA) pa>e.org/techniques/T1559/001) and Internet Explorer HTML Appli
>ges.(Citation: JScrip May 2018)(Citation: Microsoft JScript >cation (HTA) pages.(Citation: JScrip May 2018)(Citation: Mic
>2007)(Citation: Microsoft Windows Scripts)  Adversaries may >rosoft JScript 2007)(Citation: Microsoft Windows Scripts)  J
>abuse JavaScript / JScript to execute various behaviors. Com>avaScript for Automation (JXA) is a macOS scripting language
>mon uses include hosting malicious scripts on websites as pa> based on JavaScript, included as part of Apple’s Open Scrip
>rt of a [Drive-by Compromise](https://attack.mitre.org/techn>ting Architecture (OSA), that was introduced in OSX 10.10. A
>iques/T1189) or downloading and executing these script files>pple’s OSA provides scripting capabilities to control applic
> as secondary payloads. Since these payloads are text-based,>ations, interface with the operating system, and bridge acce
> it is also very common for adversaries to obfuscate their c>ss into the rest of Apple’s internal APIs. As of OSX 10.10, 
>ontent as part of [Obfuscated Files or Information](https://>OSA only supports two languages, JXA and [AppleScript](https
>attack.mitre.org/techniques/T1027).>://attack.mitre.org/techniques/T1059/002). Scripts can be ex
 >ecuted via the command line utility <code>osascript</code>, 
 >they can be compiled into applications or script files via <
 >code>osacompile</code>, and they can be compiled and execute
 >d in memory of other programs by leveraging the OSAKit Frame
 >work.(Citation: Apple About Mac Scripting 2016)(Citation: Sp
 >ecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Cit
 >ation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec ma
 >cOS JXA and VSCode)  Adversaries may abuse various implement
 >ations of JavaScript to execute various behaviors. Common us
 >es include hosting malicious scripts on websites as part of 
 >a [Drive-by Compromise](https://attack.mitre.org/techniques/
 >T1189) or downloading and executing these script files as se
 >condary payloads. Since these payloads are text-based, it is
 > also very common for adversaries to obfuscate their content
 > as part of [Obfuscated Files or Information](https://attack
 >.mitre.org/techniques/T1027).
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Cody Thomas, SpecterOps']
values_changed
STIX FieldOld valueNew Value
modified2020-06-25 03:23:13.804000+00:002021-04-27 19:21:05.521000+00:00
nameJavaScript/JScriptJavaScript
descriptionAdversaries may abuse JavaScript and/or JScript for execution. JavaScript (JS) is a platform-agnostic scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts) Adversaries may abuse JavaScript / JScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS) JScript is the Microsoft implementation of the same scripting standard. JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and Internet Explorer HTML Application (HTA) pages.(Citation: JScrip May 2018)(Citation: Microsoft JScript 2007)(Citation: Microsoft Windows Scripts) JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10. Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs. As of OSX 10.10, OSA only supports two languages, JXA and [AppleScript](https://attack.mitre.org/techniques/T1059/002). Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.(Citation: Apple About Mac Scripting 2016)(Citation: SpecterOps JXA 2020)(Citation: SentinelOne macOS Red Team)(Citation: Red Canary Silver Sparrow Feb2021)(Citation: MDSec macOS JXA and VSCode) Adversaries may abuse various implementations of JavaScript to execute various behaviors. Common uses include hosting malicious scripts on websites as part of a [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) or downloading and executing these script files as secondary payloads. Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027).
x_mitre_data_sources[0]Loaded DLLsCommand: Command Execution
x_mitre_data_sources[1]DLL monitoringProcess: Process Creation
x_mitre_data_sources[2]File monitoringModule: Module Load
x_mitre_data_sources[3]Process command-line parametersScript: Script Execution
x_mitre_detectionMonitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts, or loading of modules associated with scripting languages (ex: JScript.dll). Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for execution and subsequent behavior. Actions may be related to network and system information [Discovery](https://attack.mitre.org/tactics/TA0007), [Collection](https://attack.mitre.org/tactics/TA0009), or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source. Monitor for execution of JXA through osascript and usage of OSAScript API that may be related to other suspicious behavior occurring on the system. Understanding standard usage patterns is important to avoid a high number of false positives. If scripting is restricted for normal users, then any attempts to enable related components running on a system would be considered suspicious. If scripting is not commonly used on a system, but enabled, execution running out of cycle from patching or other administrator functions is suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Apple About Mac Scripting 2016', 'description': 'Apple. (2016, June 13). About Mac Scripting. Retrieved April 14, 2021.', 'url': 'https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html'}
external_references{'source_name': 'SpecterOps JXA 2020', 'description': 'Pitt, L. (2020, August 6). Persistent JXA. Retrieved April 14, 2021.', 'url': 'https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5'}
external_references{'source_name': 'SentinelOne macOS Red Team', 'description': 'Phil Stokes. (2019, December 5). macOS Red Team: Calling Apple APIs Without Building Binaries. Retrieved July 17, 2020.', 'url': 'https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/'}
external_references{'source_name': 'Red Canary Silver Sparrow Feb2021', 'description': 'Tony Lambert. (2021, February 18). Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight. Retrieved April 20, 2021.', 'url': 'https://redcanary.com/blog/clipping-silver-sparrows-wings/'}
external_references{'source_name': 'MDSec macOS JXA and VSCode', 'description': 'Dominic Chell. (2021, January 1). macOS Post-Exploitation Shenanigans with VSCode Extensions. Retrieved April 20, 2021.', 'url': 'https://www.mdsec.co.uk/2021/01/macos-post-exploitation-shenanigans-with-vscode-extensions/'}
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess monitoring

[T1556] Modify Authentication Process

Current version: 2.0

Version changed from: 1.1 → 2.0


Old Description
New Description
t1Adversaries may modify authentication mechanisms and processt1Adversaries may modify authentication mechanisms and process
>es to access user credentials or enable otherwise unwarrante>es to access user credentials or enable otherwise unwarrante
>d access to accounts. The authentication process is handled >d access to accounts. The authentication process is handled 
>by mechanisms, such as the Local Security Authentication Ser>by mechanisms, such as the Local Security Authentication Ser
>ver (LSASS) process and the Security Accounts Manager (SAM) >ver (LSASS) process and the Security Accounts Manager (SAM) 
>on Windows or pluggable authentication modules (PAM) on Unix>on Windows, pluggable authentication modules (PAM) on Unix-b
>-based systems, responsible for gathering, storing, and vali>ased systems, and authorization plugins on MacOS systems, re
>dating credentials.   Adversaries may maliciously modify a p>sponsible for gathering, storing, and validating credentials
>art of this process to either reveal credentials or bypass a>By modifying an authentication process, an adversary may b
>uthentication mechanisms. Compromised credentials or access >e able to authenticate to a service or system without using 
>may be used to bypass access controls placed on various reso>[Valid Accounts](https://attack.mitre.org/techniques/T1078).
>urces on systems within the network and may even be used for>  Adversaries may maliciously modify a part of this process 
> persistent access to remote systems and externally availabl>to either reveal credentials or bypass authentication mechan
>e services, such as VPNs, Outlook Web Access and remote desk>isms. Compromised credentials or access may be used to bypas
>top. >s access controls placed on various resources on systems wit
 >hin the network and may even be used for persistent access t
 >o remote systems and externally available services, such as 
 >VPNs, Outlook Web Access and remote desktop.

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Chris Ross @xorrior']
values_changed
STIX FieldOld valueNew Value
modified2020-10-21 02:41:11.743000+00:002021-04-26 20:08:31.712000+00:00
descriptionAdversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows or pluggable authentication modules (PAM) on Unix-based systems, responsible for gathering, storing, and validating credentials. Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
external_references[3]['source_name']TechNet Audit PolicyXorrior Authorization Plugins
external_references[3]['description']Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.Chris Ross. (2018, October 17). Persistent Credential Theft with Authorization Plugins. Retrieved April 22, 2021.
external_references[3]['url']https://technet.microsoft.com/en-us/library/dn487457.aspxhttps://xorrior.com/persistent-credential-theft/
x_mitre_data_sources[0]File monitoringLogon Session: Logon Session Creation
x_mitre_data_sources[1]Authentication logsProcess: OS API Execution
x_mitre_data_sources[2]API monitoringProcess: Process Access
x_mitre_data_sources[3]Windows RegistryFile: File Modification
x_mitre_data_sources[4]Process monitoringFile: File Creation
x_mitre_data_sources[5]DLL monitoringModule: Module Load
x_mitre_detectionMonitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages) and correlate then investigate the DLL files these files reference. Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013) Monitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) Monitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer. Monitor for changes to Registry entries for password filters (ex: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages) and correlate then investigate the DLL files these files reference. Password filters will also show up as an autorun and loaded DLL in lsass.exe.(Citation: Clymb3r Function Hook Passwords Sept 2013) Monitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).(Citation: Dell Skeleton) Monitor PAM configuration and module paths (ex: /etc/pam.d/) for changes. Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files. Monitor for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.(Citation: Xorrior Authorization Plugins) Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services. (Citation: TechNet Audit Policy) Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts. Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours. Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account. Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).
x_mitre_version1.12.0
iterable_item_added
STIX FieldOld valueNew Value
kill_chain_phases{'kill_chain_name': 'mitre-attack', 'phase_name': 'persistence'}
external_references{'source_name': 'TechNet Audit Policy', 'description': 'Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.', 'url': 'https://technet.microsoft.com/en-us/library/dn487457.aspx'}
x_mitre_data_sourcesWindows Registry: Windows Registry Key Modification

[T1556.004] Modify Authentication Process: Network Device Authentication

Current version: 2.0

Version changed from: 1.0 → 2.0

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-21 02:41:11.550000+00:002021-04-20 20:11:00.356000+00:00
x_mitre_data_sources[0]File monitoringFile: File Modification
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
kill_chain_phases{'kill_chain_name': 'mitre-attack', 'phase_name': 'persistence'}

[T1556.002] Modify Authentication Process: Password Filter DLL

Current version: 2.0

Version changed from: 1.0 → 2.0

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 20:59:05.209000+00:002021-04-20 20:11:55.147000+00:00
x_mitre_data_sources[0]File monitoringFile: File Creation
x_mitre_data_sources[1]DLL monitoringModule: Module Load
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
kill_chain_phases{'kill_chain_name': 'mitre-attack', 'phase_name': 'persistence'}
x_mitre_data_sourcesWindows Registry: Windows Registry Key Modification

[T1556.003] Modify Authentication Process: Pluggable Authentication Modules

Current version: 2.0

Version changed from: 1.0 → 2.0

Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-13 21:23:01.370000+00:002021-04-20 20:12:34.422000+00:00
x_mitre_data_sources[0]Authentication logsFile: File Modification
x_mitre_data_sources[1]File monitoringLogon Session: Logon Session Creation
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
kill_chain_phases{'kill_chain_name': 'mitre-attack', 'phase_name': 'persistence'}

[T1037.004] Boot or Logon Initialization Scripts: RC Scripts

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may use rc.common automatically executed at boott1Adversaries may establish persistence by modifying RC script
> initialization to establish persistence. During the boot pr>s which are executed during a Unix-like system’s startup. Th
>ocess, macOS executes <code>source /etc/rc.common</code>, wh>ese files allow system administrators to map and start custo
>ich is a shell script containing various utility functions. >m services at startup for different run levels. RC scripts r
>This file also defines routines for processing command-line >equire root privileges to modify.  Adversaries can establish
>arguments and for gathering system settings and is thus reco> persistence by adding a malicious binary path or shell comm
>mmended to include in the start of Startup Item Scripts (Cit>ands to <code>rc.local</code>, <code>rc.common</code>, and o
>ation: Startup Items). In macOS and OS X, this is now a depr>ther RC scripts specific to the Unix-like distribution.(Cita
>ecated mechanism in favor of [Launch Agent](https://attack.m>tion: IranThreats Kittens Dec 2017)(Citation: Intezer Hidden
>itre.org/techniques/T1543/001) and [Launch Daemon](https://a>Wasp Map 2019) Upon reboot, the system executes the script's
>ttack.mitre.org/techniques/T1543/004) but is currently still> contents as root, resulting in persistence.  Adversary abus
> used.  Adversaries can use the rc.common file as a way to h>e of RC scripts is especially effective for lightweight Unix
>ide code for persistence that will execute on each reboot as>-like distributions using the root user as default, such as 
> the root user. (Citation: Methods of Mac Malware Persistenc>IoT or embedded systems.(Citation: intezer-kaiji-malware)  S
>e)>everal Unix-like systems have moved to Systemd and deprecate
 >d the use of RC scripts. This is now a deprecated mechanism 
 >in macOS in favor of [Launchd](https://attack.mitre.org/tech
 >niques/T1053/004). (Citation: Apple Developer Doco Archive L
 >aunchd)(Citation: Startup Items) This technique can be used 
 >on Mac OS X Panther v10.3 and earlier versions which still e
 >xecute the RC scripts.(Citation: Methods of Mac Malware Pers
 >istence) To maintain backwards compatibility some systems, s
 >uch as Ubuntu, will execute the RC scripts if they exist wit
 >h the correct file permissions.(Citation: Ubuntu Manpage sys
 >temd rc)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-24 23:46:20.433000+00:002021-04-27 19:58:01.927000+00:00
nameRc.commonRC Scripts
descriptionAdversaries may use rc.common automatically executed at boot initialization to establish persistence. During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated mechanism in favor of [Launch Agent](https://attack.mitre.org/techniques/T1543/001) and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) but is currently still used. Adversaries can use the rc.common file as a way to hide code for persistence that will execute on each reboot as the root user. (Citation: Methods of Mac Malware Persistence)Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify. Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.(Citation: IranThreats Kittens Dec 2017)(Citation: Intezer HiddenWasp Map 2019) Upon reboot, the system executes the script's contents as root, resulting in persistence. Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.(Citation: intezer-kaiji-malware) Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts. This is now a deprecated mechanism in macOS in favor of [Launchd](https://attack.mitre.org/techniques/T1053/004). (Citation: Apple Developer Doco Archive Launchd)(Citation: Startup Items) This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.(Citation: Methods of Mac Malware Persistence) To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.(Citation: Ubuntu Manpage systemd rc)
external_references[1]['source_name']Startup ItemsIranThreats Kittens Dec 2017
external_references[1]['description']Apple. (2016, September 13). Startup Items. Retrieved July 11, 2017.Iran Threats . (2017, December 5). Flying Kitten to Rocket Kitten, A Case of Ambiguity and Shared Code. Retrieved May 28, 2020.
external_references[1]['url']https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.htmlhttps://iranthreats.github.io/resources/attribution-flying-rocket-kitten/
external_references[2]['source_name']Methods of Mac Malware PersistenceIntezer HiddenWasp Map 2019
external_references[2]['description']Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.
external_references[2]['url']https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdfhttps://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/
x_mitre_data_sources[0]Process monitoringFile: File Creation
x_mitre_data_sources[1]File monitoringFile: File Modification
x_mitre_detectionThe /etc/rc.common file can be monitored to detect changes from the company policy. Monitor process execution resulting from the rc.common script for unusual or unknown applications or behavior. Monitor for unexpected changes to RC scripts in the /etc/ directory. Monitor process execution resulting from RC scripts for unusual or unknown applications or behavior. Monitor for /etc/rc.local file creation. Although types of RC scripts vary for each Unix-like distribution, several execute /etc/rc.local if present.
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'intezer-kaiji-malware', 'description': 'Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware turning to Golang. Retrieved December 17, 2020.', 'url': 'https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/'}
external_references{'source_name': 'Apple Developer Doco Archive Launchd', 'description': 'Apple. (2016, September 13). Daemons and Services Programming Guide - Creating Launch Daemons and Agents. Retrieved February 24, 2021.', 'url': 'https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html'}
external_references{'source_name': 'Startup Items', 'description': 'Apple. (2016, September 13). Startup Items. Retrieved July 11, 2017.', 'url': 'https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html'}
external_references{'source_name': 'Methods of Mac Malware Persistence', 'description': 'Patrick Wardle. (2014, September). Methods of Malware Persistence on Mac OS X. Retrieved July 5, 2017.', 'url': 'https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf'}
external_references{'source_name': 'Ubuntu Manpage systemd rc', 'description': 'Canonical Ltd.. (n.d.). systemd-rc-local-generator - Compatibility generator for starting /etc/rc.local and /usr/sbin/halt.local during boot and shutdown. Retrieved February 23, 2021.', 'url': 'http://manpages.ubuntu.com/manpages/bionic/man8/systemd-rc-local-generator.8.html'}
x_mitre_data_sourcesProcess: Process Creation
x_mitre_data_sourcesCommand: Command Execution
x_mitre_platformsLinux

[T1497.001] Virtualization/Sandbox Evasion: System Checks

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may employ various system checks to detect and at1Adversaries may employ various system checks to detect and a
>void virtualization and analysis environments. This may incl>void virtualization and analysis environments. This may incl
>ude changing behaviors based on the results of checks for th>ude changing behaviors based on the results of checks for th
>e presence of artifacts indicative of a virtual machine envi>e presence of artifacts indicative of a virtual machine envi
>ronment (VME) or sandbox. If the adversary detects a VME, th>ronment (VME) or sandbox. If the adversary detects a VME, th
>ey may alter their malware to disengage from the victim or c>ey may alter their malware to disengage from the victim or c
>onceal the core functions of the implant. They may also sear>onceal the core functions of the implant. They may also sear
>ch for VME artifacts before dropping secondary or additional>ch for VME artifacts before dropping secondary or additional
> payloads. Adversaries may use the information learned from > payloads. Adversaries may use the information learned from 
>[Virtualization/Sandbox Evasion](https://attack.mitre.org/te>[Virtualization/Sandbox Evasion](https://attack.mitre.org/te
>chniques/T1497) during automated discovery to shape follow-o>chniques/T1497) during automated discovery to shape follow-o
>n behaviors.   Specific checks may will vary based on the ta>n behaviors.   Specific checks will vary based on the target
>rget and/or adversary, but may involve behaviors such as [Wi> and/or adversary, but may involve behaviors such as [Window
>ndows Management Instrumentation](https://attack.mitre.org/t>s Management Instrumentation](https://attack.mitre.org/techn
>echniques/T1047), [PowerShell](https://attack.mitre.org/tech>iques/T1047), [PowerShell](https://attack.mitre.org/techniqu
>niques/T1059/001), [System Information Discovery](https://at>es/T1059/001), [System Information Discovery](https://attack
>tack.mitre.org/techniques/T1082), and [Query Registry](https>.mitre.org/techniques/T1082), and [Query Registry](https://a
>://attack.mitre.org/techniques/T1012) to obtain system infor>ttack.mitre.org/techniques/T1012) to obtain system informati
>mation and search for VME artifacts. Adversaries may search >on and search for VME artifacts. Adversaries may search for 
>for VME artifacts in memory, processes, file system, hardwar>VME artifacts in memory, processes, file system, hardware, a
>e, and/or the Registry. Adversaries may use scripting to aut>nd/or the Registry. Adversaries may use scripting to automat
>omate these checks  into one script and then have the progra>e these checks  into one script and then have the program ex
>m exit if it determines the system to be a virtual environme>it if it determines the system to be a virtual environment. 
>nt.   Checks could include generic system properties such as>  Checks could include generic system properties such as hos
> uptime and samples of network traffic. Adversaries may also>t/domain name and samples of network traffic. Adversaries ma
> check the network adapters addresses, CPU core count, and a>y also check the network adapters addresses, CPU core count,
>vailable memory/drive size.   Other common checks may enumer> and available memory/drive size.   Other common checks may 
>ate services running that are unique to these applications, >enumerate services running that are unique to these applicat
>installed programs on the system, manufacturer/product field>ions, installed programs on the system, manufacturer/product
>s for strings relating to virtual machine applications, and > fields for strings relating to virtual machine applications
>VME-specific hardware/processor instructions.(Citation: McAf>, and VME-specific hardware/processor instructions.(Citation
>ee Virtual Jan 2017) In applications like VMWare, adversarie>: McAfee Virtual Jan 2017) In applications like VMWare, adve
>s can also use a special I/O port to send commands and recei>rsaries can also use a special I/O port to send commands and
>ve output.    Hardware checks, such as the presence of the f> receive output.    Hardware checks, such as the presence of
>an, temperature, and audio devices, could also be used to ga> the fan, temperature, and audio devices, could also be used
>ther evidence that can be indicative a virtual environment. > to gather evidence that can be indicative a virtual environ
>Adversaries may also query for specific readings from these >ment. Adversaries may also query for specific readings from 
>devices.(Citation: Unit 42 OilRig Sept 2018)>these devices.(Citation: Unit 42 OilRig Sept 2018)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-01 16:32:02.514000+00:002021-04-21 15:16:10.604000+00:00
descriptionAdversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. Specific checks may will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. Checks could include generic system properties such as uptime and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)
x_mitre_data_sources[0]Process command-line parametersProcess: Process Creation
x_mitre_data_sources[1]Process monitoringCommand: Command Execution
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: OS API Execution

[T1546.004] Event Triggered Execution: Unix Shell Configuration Modification

Current version: 2.0

Version changed from: 1.0 → 2.0


Old Description
New Description
t1Adversaries may establish persistence by executing malicioust1Adversaries may establish persistence through executing mali
> content triggered by a user’s shell. <code>~/.bash_profile<>cious commands triggered by a user’s shell. User [Unix Shell
>/code> and <code>~/.bashrc</code> are shell scripts that con>](https://attack.mitre.org/techniques/T1059/004)s execute se
>tain shell commands. These files are executed in a user's co>veral configuration scripts at different points throughout t
>ntext when a new shell opens or when a user logs in so that >he session based on events. For example, when a user opens a
>their environment is set correctly.  <code>~/.bash_profile</> command-line interface or remotely logs in (such as via SSH
>code> is executed for login shells and <code>~/.bashrc</code>) a login shell is initiated. The login shell executes scrip
>> is executed for interactive non-login shells. This means t>ts from the system (<code>/etc</code>) and the user’s home d
>hat when a user logs in (via username and password) to the c>irectory (<code>~/</code>) to configure the environment. All
>onsole (either locally or remotely via something like SSH), > login shells on a system use /etc/profile when initiated. T
>the <code>~/.bash_profile</code> script is executed before t>hese configuration scripts run at the permission level of th
>he initial command prompt is returned to the user. After tha>eir directory and are often used to set environment variable
>t, every time a new shell is opened, the <code>~/.bashrc</co>s, create aliases, and customize the user’s environment. Whe
>de> script is executed. This allows users more fine-grained >n the shell exits or terminates, additional shell scripts ar
>control over when they want certain commands executed. These>e executed to ensure the shell exits appropriately.   Advers
> shell scripts are meant to be written to by the local user >aries may attempt to establish persistence by inserting comm
>to configure their own environment.  The macOS Terminal.app >ands into scripts automatically executed by shells. Using ba
>is a little different in that it runs a login shell by defau>sh as an example, the default shell for most GNU/Linux syste
>lt each time a new terminal window is opened, thus calling <>ms, adversaries may add commands that launch malicious binar
>code>~/.bash_profile</code> each time instead of <code>~/.ba>ies into the <code>/etc/profile</code> and <code>/etc/profil
>shrc</code>.  Adversaries may abuse these shell scripts by i>e.d</code> files.(Citation: intezer-kaiji-malware)(Citation:
>nserting arbitrary shell commands that may be used to execut> bencane blog bashrc) These files typically require root per
>e other binaries to gain persistence. Every time the user lo>missions to modify and are executed each time any shell on a
>gs in or opens a new shell, the modified ~/.bash_profile and> system launches. For user level permissions, adversaries ca
>/or ~/.bashrc scripts will be executed.(Citation: amnesia ma>n insert malicious commands into <code>~/.bash_profile</code
>lware)>>, <code>~/.bash_login</code>, or <code>~/.profile</code> wh
 >ich are sourced when a user opens a command-line interface o
 >r connects remotely.(Citation: anomali-rocke-tactics)(Citati
 >on: Linux manual bash invocation) Since the system only exec
 >utes the first existing file in the listed order, adversarie
 >s have used <code>~/.bash_profile</code> to ensure execution
 >. Adversaries have also leveraged the <code>~/.bashrc</code>
 > file which is additionally executed if the connection is es
 >tablished remotely or an additional interactive shell is ope
 >ned, such as a new tab in the command-line interface.(Citati
 >on: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anom
 >ali-linux-rabbit)(Citation: Magento) Some malware targets th
 >e termination of a program to trigger execution, adversaries
 > can use the <code>~/.bash_logout</code> file to execute mal
 >icious commands at the end of a session.   For macOS, the fu
 >nctionality of this technique is similar but may leverage zs
 >h, the default shell for macOS 10.15+. When the Terminal.app
 > is opened, the application launches a zsh login shell and a
 > zsh interactive shell. The login shell configures the syste
 >m environment using <code>/etc/profile</code>, <code>/etc/zs
 >henv</code>, <code>/etc/zprofile</code>, and <code>/etc/zlog
 >in</code>.(Citation: ScriptingOSX zsh)(Citation: PersistentJ
 >XA_leopitt)(Citation: code_persistence_zsh) The login shell 
 >then configures the user environment with <code>~/.zprofile<
 >/code> and <code>~/.zlogin</code>. The interactive shell use
 >s the <code>~/.zshrc</code> to configure the user environmen
 >t. Upon exiting, <code>/etc/zlogout</code> and <code>~/.zlog
 >out</code> are executed. For legacy programs, macOS executes
 > <code>/etc/bashrc</code> on startup.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Robert Wilson', 'Tony Lambert, Red Canary']
values_changed
STIX FieldOld valueNew Value
modified2020-03-24 16:28:04.990000+00:002021-03-08 15:22:54.089000+00:00
name.bash_profile and .bashrcUnix Shell Configuration Modification
descriptionAdversaries may establish persistence by executing malicious content triggered by a user’s shell. ~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment. The macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc. Adversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware)Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation) Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.
external_references[1]['source_name']amnesia malwareintezer-kaiji-malware
external_references[1]['description']Claud Xiao, Cong Zheng, Yanhui Jia. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved February 19, 2018.Paul Litvak. (2020, May 4). Kaiji: New Chinese Linux malware turning to Golang. Retrieved December 17, 2020.
external_references[1]['url']https://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
x_mitre_data_sources[0]Process use of networkProcess: Process Creation
x_mitre_data_sources[1]Process command-line parametersCommand: Command Execution
x_mitre_data_sources[2]Process monitoringFile: File Creation
x_mitre_data_sources[3]File monitoringFile: File Modification
x_mitre_detectionWhile users may customize their ~/.bashrc and ~/.bash_profile files , there are only certain types of commands that typically appear in these files. Monitor for abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network when user profiles are loaded during the login process.While users may customize their shell profile files, there are only certain types of commands that typically appear in these files. Monitor for abnormal commands such as execution of unknown programs, opening network sockets, or reaching out across the network when user profiles are loaded during the login process. Monitor for changes to /etc/profile and /etc/profile.d, these files should only be modified by system administrators. MacOS users can leverage Endpoint Security Framework file events monitoring these specific files.(Citation: ESF_filemonitor) For most Linux and macOS systems, a list of file paths for valid shell options available on a system are located in the /etc/shells file.
x_mitre_version1.02.0
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'bencane blog bashrc', 'description': 'Benjamin Cane. (2013, September 16). Understanding a little more about /etc/profile and /etc/bashrc. Retrieved February 25, 2021.', 'url': 'https://bencane.com/2013/09/16/understanding-a-little-more-about-etcprofile-and-etcbashrc/'}
external_references{'source_name': 'anomali-rocke-tactics', 'description': 'Anomali Threat Research. (2019, October 15). Illicit Cryptomining Threat Actor Rocke Changes Tactics, Now More Difficult to Detect. Retrieved December 17, 2020.', 'url': 'https://www.anomali.com/blog/illicit-cryptomining-threat-actor-rocke-changes-tactics-now-more-difficult-to-detect'}
external_references{'source_name': 'Linux manual bash invocation', 'description': 'ArchWiki. (2021, January 19). Bash. Retrieved February 25, 2021.', 'url': 'https://wiki.archlinux.org/index.php/Bash#Invocation'}
external_references{'source_name': 'Tsunami', 'description': 'Claud Xiao and Cong Zheng. (2017, April 6). New IoT/Linux Malware Targets DVRs, Forms Botnet. Retrieved December 17, 2020.', 'url': 'https://unit42.paloaltonetworks.com/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/'}
external_references{'source_name': 'anomali-linux-rabbit', 'description': 'Anomali Threat Research. (2018, December 6). Pulling Linux Rabbit/Rabbot Malware Out of a Hat. Retrieved December 17, 2020.', 'url': 'https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat'}
external_references{'source_name': 'Magento', 'description': 'Cesar Anjos. (2018, May 31). Shell Logins as a Magento Reinfection Vector. Retrieved December 17, 2020.', 'url': 'https://blog.sucuri.net/2018/05/shell-logins-as-a-magento-reinfection-vector.html'}
external_references{'source_name': 'ScriptingOSX zsh', 'description': 'Armin Briegel. (2019, June 5). Moving to zsh, part 2: Configuration Files. Retrieved February 25, 2021.', 'url': 'https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/'}
external_references{'source_name': 'PersistentJXA_leopitt', 'description': "Leo Pitt. (2020, August 6). Persistent JXA - A poor man's Powershell for macOS. Retrieved January 11, 2021.", 'url': 'https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5'}
external_references{'source_name': 'code_persistence_zsh', 'description': 'Leo Pitt. (2020, November 11). Github - PersistentJXA/BashProfilePersist.js. Retrieved January 11, 2021.', 'url': 'https://github.com/D00MFist/PersistentJXA/blob/master/BashProfilePersist.js'}
external_references{'source_name': 'ESF_filemonitor', 'description': "Patrick Wardle. (2019, September 17). Writing a File Monitor with Apple's Endpoint Security Framework. Retrieved December 17, 2020.", 'url': 'https://objective-see.com/blog/blog_0x48.html'}
Minor Version Changes

[T1087] Account Discovery

Current version: 2.3

Version changed from: 2.2 → 2.3

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:10:18.260000+00:002021-04-14 12:26:11.595000+00:00
x_mitre_data_sources[0]Azure activity logsUser Account: User Account Metadata
x_mitre_data_sources[1]Office 365 account logsCommand: Command Execution
x_mitre_data_sources[2]API monitoringProcess: Process Creation
x_mitre_data_sources[3]Process monitoringFile: File Access
x_mitre_detectionSystem and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]Office 365SaaS
x_mitre_platforms[4]Azure ADIaaS
x_mitre_platforms[5]AWSLinux
x_mitre_platforms[6]GCPmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_version2.22.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'}
x_mitre_contributorsDaniel Stepanic, Elastic
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess command-line parameters
x_mitre_platformsSaaS

[T1098] Account Manipulation

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-05 16:43:29.473000+00:002021-04-20 16:21:28.502000+00:00
x_mitre_data_sources[0]Authentication logsFile: File Modification
x_mitre_data_sources[1]Windows event logsCommand: Command Execution
x_mitre_platforms[3]AzureIaaS
x_mitre_version2.12.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess: Process Creation
x_mitre_data_sourcesGroup: Group Modification
x_mitre_data_sourcesUser Account: User Account Modification
x_mitre_data_sourcesActive Directory: Active Directory Object Modification
x_mitre_platformsAzure AD
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure AD
x_mitre_platformsAWS

[T1098.001] Account Manipulation: Additional Cloud Credentials

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-12-18 14:57:07.625000+00:002021-03-08 10:33:01.582000+00:00
x_mitre_data_sources[0]Stackdriver logsUser Account: User Account Modification
x_mitre_data_sources[1]GCP audit logsActive Directory: Active Directory Object Modification
x_mitre_platforms[0]Azure ADIaaS
x_mitre_platforms[1]AzureAzure AD
x_mitre_version2.12.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_data_sourcesAzure activity logs
x_mitre_platformsAWS
x_mitre_platformsGCP

[T1550.001] Use Alternate Authentication Material: Application Access Token

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 19:40:02.024000+00:002021-04-14 18:09:45.539000+00:00
x_mitre_data_sources[0]Office 365 audit logsWeb Credential: Web Credential Usage
x_mitre_data_sources[1]OAuth audit logsApplication Log: Application Log Content
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace

[T1499.003] Endpoint Denial of Service: Application Exhaustion Flood

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-29 02:01:10.832000+00:002021-03-29 16:08:52.118000+00:00
x_mitre_data_sources[0]Network device logsSensor Health: Host Status
x_mitre_data_sources[1]Network device logsApplication Log: Application Log Content
x_mitre_data_sources[2]Network intrusion detection systemNetwork Traffic: Network Traffic Content
x_mitre_data_sources[3]Web application firewall logsNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesWeb logs
x_mitre_data_sourcesSSL/TLS inspection
x_mitre_platformsSaaS

[T1499.004] Endpoint Denial of Service: Application or System Exploitation

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-29 02:07:27.508000+00:002021-03-29 16:09:41.559000+00:00
x_mitre_data_sources[0]Network device logsSensor Health: Host Status
x_mitre_data_sources[1]Network intrusion detection systemApplication Log: Application Log Content
x_mitre_data_sources[2]Web application firewall logsNetwork Traffic: Network Traffic Content
x_mitre_data_sources[3]Web logsNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesSSL/TLS inspection
x_mitre_platformsSaaS

[T1197] BITS Jobs

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may abuse BITS jobs to persistently execute or ct1Adversaries may abuse BITS jobs to persistently execute or c
>lean up after malicious payloads. Windows Background Intelli>lean up after malicious payloads. Windows Background Intelli
>gent Transfer Service (BITS) is a low-bandwidth, asynchronou>gent Transfer Service (BITS) is a low-bandwidth, asynchronou
>s file transfer mechanism exposed through [Component Object >s file transfer mechanism exposed through [Component Object 
>Model](https://attack.mitre.org/techniques/T1559/001) (COM).>Model](https://attack.mitre.org/techniques/T1559/001) (COM).
> (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS i>(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is 
>s commonly used by updaters, messengers, and other applicati>commonly used by updaters, messengers, and other application
>ons preferred to operate in the background (using available >s preferred to operate in the background (using available id
>idle bandwidth) without interrupting other networked applica>le bandwidth) without interrupting other networked applicati
>tions. File transfer tasks are implemented as BITS jobs, whi>ons. File transfer tasks are implemented as BITS jobs, which
>ch contain a queue of one or more file operations.  The inte> contain a queue of one or more file operations.  The interf
>rface to create and manage BITS jobs is accessible through [>ace to create and manage BITS jobs is accessible through [Po
>PowerShell](https://attack.mitre.org/techniques/T1059/001)  >werShell](https://attack.mitre.org/techniques/T1059/001) and
>(Citation: Microsoft BITS) and the [BITSAdmin](https://attac> the [BITSAdmin](https://attack.mitre.org/software/S0190) to
>k.mitre.org/software/S0190) tool. (Citation: Microsoft BITSA>ol.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)
>dmin)  Adversaries may abuse BITS to download, execute, and >  Adversaries may abuse BITS to download, execute, and even 
>even clean up after running malicious code. BITS tasks are s>clean up after running malicious code. BITS tasks are self-c
>elf-contained in the BITS job database, without new files or>ontained in the BITS job database, without new files or regi
> registry modifications, and often permitted by host firewal>stry modifications, and often permitted by host firewalls.(C
>ls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok>itation: CTU BITS Malware June 2016)(Citation: Mondok Window
> Windows PiggyBack BITS May 2007) (Citation: Symantec BITS M>s PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007)
>ay 2007) BITS enabled execution may also enable persistence > BITS enabled execution may also enable persistence by creat
>by creating long-standing jobs (the default maximum lifetime>ing long-standing jobs (the default maximum lifetime is 90 d
> is 90 days and extendable) or invoking an arbitrary program>ays and extendable) or invoking an arbitrary program when a 
> when a job completes or errors (including after system rebo>job completes or errors (including after system reboots).(Ci
>ots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU >tation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malwa
>BITS Malware June 2016)  BITS upload functionalities can als>re June 2016)  BITS upload functionalities can also be used 
>o be used to perform [Exfiltration Over Alternative Protocol>to perform [Exfiltration Over Alternative Protocol](https://
>](https://attack.mitre.org/techniques/T1048). (Citation: CTU>attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malwa
> BITS Malware June 2016)>re June 2016)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 23:28:10.049000+00:002021-04-13 21:36:04.956000+00:00
descriptionAdversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin) Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016) BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016)Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin) Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016) BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016)
x_mitre_data_sources[0]Process monitoringProcess: Process Creation
x_mitre_data_sources[1]Process command-line parametersNetwork Traffic: Network Connection Creation
x_mitre_data_sources[2]Packet captureService: Service Metadata
x_mitre_data_sources[3]Windows event logsCommand: Command Execution
x_mitre_detectionBITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS) Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016) Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS)BITS runs as a service and its status can be checked with the Sc query utility (sc query bits).(Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose).(Citation: Microsoft BITS) Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)(Citation: Microsoft BITS) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.(Citation: Elastic - Hunting for Persistence Part 1) Also consider investigating more detailed information about jobs by parsing the BITS job database.(Citation: CTU BITS Malware June 2016) Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).(Citation: Microsoft BITS)
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Elastic - Hunting for Persistence Part 1', 'description': 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1). Retrieved December 21, 2020.', 'url': 'https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1'}
x_mitre_contributorsBrent Murphy, Elastic
x_mitre_contributorsDavid French, Elastic

[T1176] Browser Extensions

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may abuse Internet browser extensions to establit1Adversaries may abuse Internet browser extensions to establi
>sh persistence access to victim systems. Browser extensions >sh persistent access to victim systems. Browser extensions o
>or plugins are small programs that can add functionality and>r plugins are small programs that can add functionality and 
> customize aspects of Internet browsers. They can be install>customize aspects of Internet browsers. They can be installe
>ed directly or through a browser's app store and generally h>d directly or through a browser's app store and generally ha
>ave access and permissions to everything that the browser ca>ve access and permissions to everything that the browser can
>n access. (Citation: Wikipedia Browser Extension) (Citation:> access.(Citation: Wikipedia Browser Extension)(Citation: Ch
> Chrome Extensions Definition)  Malicious extensions can be >rome Extensions Definition)  Malicious extensions can be ins
>installed into a browser through malicious app store downloa>talled into a browser through malicious app store downloads 
>ds masquerading as legitimate extensions, through social eng>masquerading as legitimate extensions, through social engine
>ineering, or by an adversary that has already compromised a >ering, or by an adversary that has already compromised a sys
>system. Security can be limited on browser app stores so it >tem. Security can be limited on browser app stores so it may
>may not be difficult for malicious extensions to defeat auto> not be difficult for malicious extensions to defeat automat
>mated scanners. (Citation: Malicious Chrome Extension Number>ed scanners.(Citation: Malicious Chrome Extension Numbers) D
>s) Once the extension is installedit can browse to website>epending on the browser, adversaries may also manipulate an 
>s in the background, (Citation: Chrome Extension Crypto Mine>extension's update url to install updates from an adversary 
>r) (Citation: ICEBRG Chrome Extensions) steal all informatio>controlled server or manipulate the mobile configuration fil
>n that a user enters into a browser (including credentials) >e to silently install additional extensions.  Previous to ma
>(Citation: Banker Google Chrome Extension Steals Creds) (Cit>cOS 11, adversaries could silently install browser extension
>ation: Catch All Chrome Extension) and be used as an install>s via the command line using the <code>profiles</code> tool 
>er for a RAT for persistence.  There have also been instance>to install malicious <code>.mobileconfig</code> files. In ma
>s of botnets using a persistent backdoor through malicious C>cOS 11+the use of the <code>profiles</code> tool can no lo
>hrome extensions. (Citation: Stantinko Botnet) There have al>nger install configuration profiles, however <code>.mobileco
>so been similar examples of extensions being used for comman>nfig</code> files can be planted and installed with user int
>d & control  (Citation: Chrome Extension C2 Malware).>eraction.(Citation: xorrior chrome extensions macOS)  Once t
 >he extension is installed, it can browse to websites in the 
 >background,(Citation: Chrome Extension Crypto Miner)(Citatio
 >n: ICEBRG Chrome Extensions) steal all information that a us
 >er enters into a browser (including credentials)(Citation: B
 >anker Google Chrome Extension Steals Creds)(Citation: Catch 
 >All Chrome Extension) and be used as an installer for a RAT 
 >for persistence.  There have also been instances of botnets 
 >using a persistent backdoor through malicious Chrome extensi
 >ons.(Citation: Stantinko Botnet) There have also been simila
 >r examples of extensions being used for command & control.(C
 >itation: Chrome Extension C2 Malware)

New Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 23:36:30.565000+00:002021-04-27 19:56:54.161000+00:00
descriptionAdversaries may abuse Internet browser extensions to establish persistence access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition) Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials) (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware).Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition) Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions. Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS) Once the extension is installed, it can browse to websites in the background,(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence. There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)
external_references[4]['source_name']Chrome Extension Crypto Minerxorrior chrome extensions macOS
external_references[4]['description']Brinkmann, M. (2017, September 19). First Chrome extension with JavaScript Crypto Miner detected. Retrieved November 16, 2017.Chris Ross. (2019, February 8). No Place Like Chrome. Retrieved April 27, 2021.
external_references[4]['url']https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/https://www.xorrior.com/No-Place-Like-Chrome/
external_references[5]['source_name']ICEBRG Chrome ExtensionsChrome Extension Crypto Miner
external_references[5]['description']De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018.Brinkmann, M. (2017, September 19). First Chrome extension with JavaScript Crypto Miner detected. Retrieved November 16, 2017.
external_references[5]['url']https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesseshttps://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/
external_references[6]['source_name']Banker Google Chrome Extension Steals CredsICEBRG Chrome Extensions
external_references[6]['description']Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. Retrieved November 18, 2017.De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018.
external_references[6]['url']https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses
external_references[7]['source_name']Catch All Chrome ExtensionBanker Google Chrome Extension Steals Creds
external_references[7]['description']Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension Steals All Posted Data. Retrieved November 16, 2017.Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. Retrieved November 18, 2017.
external_references[7]['url']https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/
external_references[8]['source_name']Stantinko BotnetCatch All Chrome Extension
external_references[8]['description']Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware campaign operating covertly since 2012. Retrieved November 16, 2017.Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension Steals All Posted Data. Retrieved November 16, 2017.
external_references[8]['url']https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/)
external_references[9]['source_name']Chrome Extension C2 MalwareStantinko Botnet
external_references[9]['description']Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017.Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware campaign operating covertly since 2012. Retrieved November 16, 2017.
external_references[9]['url']https://kjaer.io/extension-malware/https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/
x_mitre_data_sources[0]Windows RegistryCommand: Command Execution
x_mitre_data_sources[1]File monitoringProcess: Process Creation
x_mitre_data_sources[2]Process use of networkNetwork Traffic: Network Connection Creation
x_mitre_data_sources[3]Process monitoringWindows Registry: Windows Registry Key Creation
x_mitre_data_sources[4]Browser extensionsFile: File Creation
x_mitre_detectionInventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates. Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates. Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation. On macOS, monitor the command line for usage of the profiles tool, such as profiles install -type=configuration. Additionally, all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory. Ensure all listed files are in alignment with approved extensions.(Citation: xorrior chrome extensions macOS)
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Chrome Extension C2 Malware', 'description': 'Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017.', 'url': 'https://kjaer.io/extension-malware/'}
x_mitre_contributorsChris Ross @xorrior

[T1110] Brute Force

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-21 16:38:27.781000+00:002021-04-14 12:04:36.243000+00:00
x_mitre_data_sources[0]Office 365 account logsUser Account: User Account Authentication
x_mitre_data_sources[1]Authentication logsApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]Office 365SaaS
x_mitre_platforms[4]Azure ADIaaS
x_mitre_platforms[5]SaaSLinux
x_mitre_platforms[6]GCPmacOS
x_mitre_platforms[7]AWSGoogle Workspace
x_mitre_platforms[8]AzureContainers
x_mitre_version2.12.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsDavid Fiser, @anu4is, Trend Micro
x_mitre_contributorsAlfredo Oliveira, Trend Micro
x_mitre_contributorsMagno Logan, @magnologan, Trend Micro
x_mitre_contributorsYossi Weizman, Azure Defender Research Team

[T1087.004] Account Discovery: Cloud Account

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-08-13 16:53:55.390000+00:002021-03-16 12:54:41.133000+00:00
x_mitre_data_sources[0]Stackdriver logsUser Account: User Account Metadata
x_mitre_data_sources[1]AWS CloudTrail logsCommand: Command Execution
x_mitre_platforms[0]AWSAzure AD
x_mitre_platforms[1]GCPOffice 365
x_mitre_platforms[2]AzureSaaS
x_mitre_platforms[3]Office 365IaaS
x_mitre_platforms[4]Azure ADGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesOffice 365 account logs
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesProcess command-line parameters
x_mitre_platformsSaaS

[T1136.003] Create Account: Cloud Account

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-24 12:44:27.995000+00:002021-03-16 12:47:00.192000+00:00
x_mitre_data_sources[0]Office 365 audit logsUser Account: User Account Creation
x_mitre_platforms[0]AWSAzure AD
x_mitre_platforms[1]GCPOffice 365
x_mitre_platforms[2]AzureIaaS
x_mitre_platforms[3]Office 365Google Workspace
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsAzure AD

[T1078.004] Valid Accounts: Cloud Accounts

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 16:01:22.090000+00:002021-03-16 12:45:15.399000+00:00
x_mitre_data_sources[0]Azure activity logsUser Account: User Account Authentication
x_mitre_data_sources[1]Authentication logsLogon Session: Logon Session Creation
x_mitre_platforms[0]AWSAzure AD
x_mitre_platforms[1]GCPOffice 365
x_mitre_platforms[2]AzureSaaS
x_mitre_platforms[3]SaaSIaaS
x_mitre_platforms[4]Azure ADGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_data_sourcesStackdriver logs
x_mitre_platformsOffice 365

[T1069.003] Permission Groups Discovery: Cloud Groups

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may attempt to find cloud groups and permission t1Adversaries may attempt to find cloud groups and permission 
>settings. The knowledge of cloud permission groups can help >settings. The knowledge of cloud permission groups can help 
>adversaries determine the particular roles of users and grou>adversaries determine the particular roles of users and grou
>ps within an environment, as well as which users are associa>ps within an environment, as well as which users are associa
>ted with a particular group.  With authenticated access ther>ted with a particular group.  With authenticated access ther
>e are several tools that can be used to find permissions gro>e are several tools that can be used to find permissions gro
>ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be >ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be 
>used to obtain roles and permissions groups for Exchange and>used to obtain roles and permissions groups for Exchange and
> Office 365 accounts.(Citation: Microsoft Msolrole)(Citation> Office 365 accounts.(Citation: Microsoft Msolrole)(Citation
>: GitHub Raindance)  Azure CLI (AZ CLI) also provides an int>: GitHub Raindance)  Azure CLI (AZ CLI) and the Google Cloud
>erface to obtain permissions groups with authenticated acces> Identity Provider API also provide interfaces to obtain per
>s to a domain. The command <code>az ad user get-member-group>missions groups. The command <code>az ad user get-member-gro
>s</code> will list groups associated to a user account.(Cita>ups</code> will list groups associated to a user account for
>tion: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS> Azure while the API endpoint <code>GET https://cloudidentit
> AD Azure, 2018)>y.googleapis.com/v1/groups</code> lists group resources avai
 >lable to a user for Google.(Citation: Microsoft AZ CLI)(Cita
 >tion: Black Hills Red Teaming MS AD Azure, 2018)(Citation: G
 >oogle Cloud Identity API Documentation)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-08 17:34:39.077000+00:002021-03-30 12:42:46.315000+00:00
descriptionAdversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance) Azure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command az ad user get-member-groups will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group. With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance) Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)
x_mitre_data_sources[0]GCP audit logsProcess: Process Creation
x_mitre_data_sources[1]Stackdriver logsCommand: Command Execution
x_mitre_data_sources[2]AWS CloudTrail logsGroup: Group Enumeration
x_mitre_data_sources[3]Azure activity logsGroup: Group Metadata
x_mitre_data_sources[4]Office 365 account logsApplication Log: Application Log Content
x_mitre_platforms[3]AzureIaaS
x_mitre_platforms[4]AWSGoogle Workspace
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Google Cloud Identity API Documentation', 'description': 'Google. (n.d.). Retrieved March 16, 2021.', 'url': 'https://cloud.google.com/identity/docs/reference/rest'}
x_mitre_platformsAzure AD
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAPI monitoring
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesProcess command-line parameters
x_mitre_platformsAzure AD
x_mitre_platformsGCP

[T1580] Cloud Infrastructure Discovery

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-17 16:41:23.267000+00:002021-03-08 10:33:02.163000+00:00
x_mitre_data_sources[0]GCP audit logsInstance: Instance Metadata
x_mitre_data_sources[1]Stackdriver logsInstance: Instance Enumeration
x_mitre_data_sources[2]AWS CloudTrail logsSnapshot: Snapshot Metadata
x_mitre_data_sources[3]Azure activity logsSnapshot: Snapshot Enumeration
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesCloud Storage: Cloud Storage Metadata
x_mitre_data_sourcesCloud Storage: Cloud Storage Enumeration
x_mitre_data_sourcesVolume: Volume Metadata
x_mitre_data_sourcesVolume: Volume Enumeration
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsAzure
x_mitre_platformsGCP

[T1552.005] Unsecured Credentials: Cloud Instance Metadata API

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-15 19:39:34.817000+00:002021-03-31 19:41:06.948000+00:00
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_detectionMonitor access to the Instance Metadata API and look for anomalous queries. It may be possible to detect adversary use of credentials they have obtained. See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information. Monitor access to the Instance Metadata API and look for anomalous queries. It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078).
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_data_sourcesAzure activity logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1538] Cloud Service Dashboard

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-14 19:19:00.966000+00:002021-03-16 12:56:36.098000+00:00
x_mitre_data_sources[0]Office 365 audit logsUser Account: User Account Authentication
x_mitre_data_sources[1]Azure activity logsLogon Session: Logon Session Creation
x_mitre_platforms[0]AWSAzure AD
x_mitre_platforms[1]GCPOffice 365
x_mitre_platforms[2]AzureIaaS
x_mitre_platforms[3]Azure ADGoogle Workspace
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsOffice 365

[T1526] Cloud Service Discovery

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-06-23 14:31:41.758000+00:002021-03-16 12:57:03.837000+00:00
x_mitre_data_sources[0]Azure activity logsCloud Service: Cloud Service Metadata
x_mitre_data_sources[1]Stackdriver logsCloud Service: Cloud Service Enumeration
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsIaaS
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsAWS
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1136] Create Account

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-24 12:44:28.199000+00:002021-03-16 12:47:00.458000+00:00
x_mitre_data_sources[0]Office 365 account logsUser Account: User Account Creation
x_mitre_data_sources[1]Azure activity logsProcess: Process Creation
x_mitre_data_sources[2]AWS CloudTrail logsCommand: Command Execution
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSIaaS
x_mitre_platforms[4]GCPLinux
x_mitre_platforms[5]Azure ADmacOS
x_mitre_platforms[6]AzureGoogle Workspace
x_mitre_version2.12.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesProcess command-line parameters
x_mitre_data_sourcesAuthentication logs
x_mitre_data_sourcesWindows event logs
x_mitre_platformsOffice 365

[T1578.002] Modify Cloud Compute Infrastructure: Create Cloud Instance

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:48:08.299000+00:002021-03-08 10:33:02.034000+00:00
x_mitre_data_sources[0]GCP audit logsInstance: Instance Creation
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1578.001] Modify Cloud Compute Infrastructure: Create Snapshot

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1An adversary may create a snapshot or data backup within a ct1An adversary may create a snapshot or data backup within a c
>loud account to evade defenses. A snapshot is a point-in-tim>loud account to evade defenses. A snapshot is a point-in-tim
>e copy of an existing cloud compute component such as a virt>e copy of an existing cloud compute component such as a virt
>ual machine (VM), virtual hard drive, or volume. An adversar>ual machine (VM), virtual hard drive, or volume. An adversar
>y may leverage permissions to create a snapshot in order to >y may leverage permissions to create a snapshot in order to 
>bypass restrictions that prevent access to existing compute >bypass restrictions that prevent access to existing compute 
>service infrastructure, unlike in [Revert Cloud Instance](ht>service infrastructure, unlike in [Revert Cloud Instance](ht
>tps://attack.mitre.org/techniques/T1536) where an adversary >tps://attack.mitre.org/techniques/T1578/004) where an advers
>may revert to a snapshot to evade detection and remove evide>ary may revert to a snapshot to evade detection and remove e
>nce of their presence.  An adversary may [Create Cloud Insta>vidence of their presence.  An adversary may [Create Cloud I
>nce](https://attack.mitre.org/techniques/T1578/002), mount o>nstance](https://attack.mitre.org/techniques/T1578/002), mou
>ne or more created snapshots to that instance, and then appl>nt one or more created snapshots to that instance, and then 
>y a policy that allows the adversary access to the created i>apply a policy that allows the adversary access to the creat
>nstance, such as a firewall policy that allows them inbound >ed instance, such as a firewall policy that allows them inbo
>and outbound SSH access.(Citation: Mandiant M-Trends 2020)>und and outbound SSH access.(Citation: Mandiant M-Trends 202
 >0)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:48:08.293000+00:002021-03-08 10:33:02.060000+00:00
descriptionAn adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1536) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
x_mitre_data_sources[0]GCP audit logsSnapshot: Snapshot Creation
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1110.004] Brute Force: Credential Stuffing

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 22:43:45.475000+00:002021-04-06 12:31:06.695000+00:00
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_data_sources[1]Office 365 account logsApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_platforms[8]SaaSContainers
x_mitre_version1.11.2

[T1552.001] Unsecured Credentials: Credentials In Files

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may search local file systems and remote file sht1Adversaries may search local file systems and remote file sh
>ares for files containing insecurely stored credentials. The>ares for files containing insecurely stored credentials. The
>se can be files created by users to store their own credenti>se can be files created by users to store their own credenti
>als, shared credential stores for a group of individuals, co>als, shared credential stores for a group of individuals, co
>nfiguration files containing passwords for a system or servi>nfiguration files containing passwords for a system or servi
>ce, or source code/binary files containing embedded password>ce, or source code/binary files containing embedded password
>s.  It is possible to extract passwords from backups or save>s.  It is possible to extract passwords from backups or save
>d virtual machines through [OS Credential Dumping](https://a>d virtual machines through [OS Credential Dumping](https://a
>ttack.mitre.org/techniques/T1003). (Citation: CG 2014) Passw>ttack.mitre.org/techniques/T1003). (Citation: CG 2014) Passw
>ords may also be obtained from Group Policy Preferences stor>ords may also be obtained from Group Policy Preferences stor
>ed on the Windows Domain Controller. (Citation: SRD GPP)  In>ed on the Windows Domain Controller. (Citation: SRD GPP)  In
> cloud environments, authenticated user credentials are ofte> cloud and/or containerized environments, authenticated user
>n stored in local configuration and credential files. In som> and service account credentials are often stored in local c
>e cases, these files can be copied and reused on another mac>onfiguration and credential files.(Citation: Unit 42 Hildega
>hine or the contents can be read and then used to authentica>rd Malware) They may also be found as parameters to deployme
>te without needing to copy any files. (Citation: Specter Ops>nt commands in container logs.(Citation: Unit 42 Unsecured D
> - Cloud Credential Storage)>ocker Daemons) In some cases, these files can be copied and 
 >reused on another machine or the contents can be read and th
 >en used to authenticate without needing to copy any files.(C
 >itation: Specter Ops - Cloud Credential Storage)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 18:30:10.630000+00:002021-04-12 18:32:32.803000+00:00
descriptionAdversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP) In cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage)Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
external_references[4]['source_name']Specter Ops - Cloud Credential StorageUnit 42 Hildegard Malware
external_references[4]['description']Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019.Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.
external_references[4]['url']https://posts.specterops.io/head-in-the-clouds-bd038bb69e48https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/
x_mitre_data_sources[0]Process command-line parametersFile: File Access
x_mitre_data_sources[1]File monitoringCommand: Command Execution
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_platforms[4]GCPContainers
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Unit 42 Unsecured Docker Daemons', 'description': "Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.", 'url': 'https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/'}
external_references{'source_name': 'Specter Ops - Cloud Credential Storage', 'description': 'Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019.', 'url': 'https://posts.specterops.io/head-in-the-clouds-bd038bb69e48'}
x_mitre_contributorsRory McCune, Aqua Security
x_mitre_contributorsJay Chen, Palo Alto Networks
x_mitre_contributorsYossi Weizman, Azure Defender Research Team
x_mitre_contributorsVishwas Manral, McAfee
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsAzure

[T1555.003] Credentials from Password Stores: Credentials from Web Browsers

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may acquire credentials from web browsers by reat1Adversaries may acquire credentials from web browsers by rea
>ding files specific to the target browser.(Citation: Talos O>ding files specific to the target browser.(Citation: Talos O
>lympic Destroyer 2018) Web browsers commonly save credential>lympic Destroyer 2018) Web browsers commonly save credential
>s such as website usernames and passwords so that they do no>s such as website usernames and passwords so that they do no
>t need to be entered manually in the future. Web browsers ty>t need to be entered manually in the future. Web browsers ty
>pically store the credentials in an encrypted format within >pically store the credentials in an encrypted format within 
>a credential store; however, methods exist to extract plaint>a credential store; however, methods exist to extract plaint
>ext credentials from web browsers.  For example, on Windows >ext credentials from web browsers.  For example, on Windows 
>systems, encrypted credentials may be obtained from Google C>systems, encrypted credentials may be obtained from Google C
>hrome by reading a database file, <code>AppData\Local\Google>hrome by reading a database file, <code>AppData\Local\Google
>\Chrome\User Data\Default\Login Data</code> and executing a >\Chrome\User Data\Default\Login Data</code> and executing a 
>SQL query: <code>SELECT action_url, username_value, password>SQL query: <code>SELECT action_url, username_value, password
>_value FROM logins;</code>. The plaintext password can then >_value FROM logins;</code>. The plaintext password can then 
>be obtained by passing the encrypted credentials to the Wind>be obtained by passing the encrypted credentials to the Wind
>ows API function <code>CryptUnprotectData</code>, which uses>ows API function <code>CryptUnprotectData</code>, which uses
> the victim’s cached logon credentials as the decryption key> the victim’s cached logon credentials as the decryption key
>. (Citation: Microsoft CryptUnprotectData April 2018)   Adv>. (Citation: Microsoft CryptUnprotectData April 2018)   Adve
>ersaries have executed similar procedures for common web bro>rsaries have executed similar procedures for common web brow
>wsers such as FireFox, Safari, Edge, etc. (Citation: Proofpo>sers such as FireFox, Safari, Edge, etc.(Citation: Proofpoin
>int Vega Credential Stealer May 2018)(Citation: FireEye Hawk>t Vega Credential Stealer May 2018)(Citation: FireEye HawkEy
>Eye Malware July 2017)  Adversaries may also acquire credent>e Malware July 2017) Windows stores Internet Explorer and Mi
>ials by searching web browser process memory for patterns th>crosoft Edge credentials in Credential Lockers managed by th
>at commonly match credentials.(Citation: GitHub Mimikittenz >e [Windows Credential Manager](https://attack.mitre.org/tech
>July 2016)  After acquiring credentials from web browsers, a>niques/T1555/004).  Adversaries may also acquire credentials
>dversaries may attempt to recycle the credentials across dif> by searching web browser process memory for patterns that c
>ferent systems and/or accounts in order to expand access. Th>ommonly match credentials.(Citation: GitHub Mimikittenz July
>is can result in significantly furthering an adversary's obj> 2016)  After acquiring credentials from web browsers, adver
>ective in cases where credentials gained from web browsers o>saries may attempt to recycle the credentials across differe
>verlap with privileged accounts (e.g. domain administrator).>nt systems and/or accounts in order to expand access. This c
 >an result in significantly furthering an adversary's objecti
 >ve in cases where credentials gained from web browsers overl
 >ap with privileged accounts (e.g. domain administrator).
Details
values_changed
STIX FieldOld valueNew Value
modified2020-02-17 13:20:02.386000+00:002021-04-14 14:03:47.293000+00:00
descriptionAdversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData ‎April 2018) Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016) After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers. For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData April 2018) Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004). Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016) After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
external_references[2]['source_name']Microsoft CryptUnprotectData ‎April 2018Microsoft CryptUnprotectData April 2018
x_mitre_data_sources[0]File monitoringFile: File Access
x_mitre_data_sources[1]API monitoringCommand: Command Execution
x_mitre_data_sources[2]PowerShell logsProcess: OS API Execution
x_mitre_data_sources[3]Process monitoringProcess: Process Access
x_mitre_version1.01.1

[T1574.001] Hijack Execution Flow: DLL Search Order Hijacking

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may execute their own malicious payloads by hijat1Adversaries may execute their own malicious payloads by hija
>cking the search order used to load DLLs. Windows systems us>cking the search order used to load DLLs. Windows systems us
>e a common method to look for required DLLs to load into a p>e a common method to look for required DLLs to load into a p
>rogram. (Citation: Microsoft Dynamic Link Library Search Ord>rogram. (Citation: Microsoft Dynamic Link Library Search Ord
>er) Hijacking DLL loads may be for the purpose of establishi>er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa
>ng persistence as well as elevating privileges and/or evadin>ds may be for the purpose of establishing persistence as wel
>g restrictions on file execution.  There are many ways an ad>l as elevating privileges and/or evading restrictions on fil
>versary can hijack DLL loads. Adversaries may plant trojan d>e execution.  There are many ways an adversary can hijack DL
>ynamic-link library files (DLLs) in a directory that will be>L loads. Adversaries may plant trojan dynamic-link library f
> searched before the location of a legitimate library that w>iles (DLLs) in a directory that will be searched before the 
>ill be requested by a program, causing Windows to load their>location of a legitimate library that will be requested by a
> malicious library when it is called for by the victim progr> program, causing Windows to load their malicious library wh
>am. Adversaries may also perform DLL preloading, also called>en it is called for by the victim program. Adversaries may a
> binary planting attacks, (Citation: OWASP Binary Planting) >lso perform DLL preloading, also called binary planting atta
>by placing a malicious DLL with the same name as an ambiguou>cks, (Citation: OWASP Binary Planting) by placing a maliciou
>sly specified DLL in a location that Windows searches before>s DLL with the same name as an ambiguously specified DLL in 
> the legitimate DLL. Often this location is the current work>a location that Windows searches before the legitimate DLL. 
>ing directory of the program. Remote DLL preloading attacks >Often this location is the current working directory of the 
>occur when a program sets its current directory to a remote >program.(Citation: FireEye fxsst June 2011) Remote DLL prelo
>location such as a Web share before loading a DLL. (Citation>ading attacks occur when a program sets its current director
>: Microsoft Security Advisory 2269637)  Adversaries may also>y to a remote location such as a Web share before loading a 
> directly modify the way a program loads DLLs by replacing a>DLL. (Citation: Microsoft Security Advisory 2269637)  Advers
>n existing DLL or modifying a .manifest or .local redirectio>aries may also directly modify the search order via DLL redi
>n file, directory, or junction to cause the program to load >rection, which after being enabled (in the Registry and crea
>a different DLL. (Citation: Microsoft Dynamic-Link Library R>tion of a redirection file) may cause a program to load a di
>edirection) (Citation: Microsoft Manifests) (Citation: FireE>fferent DLL.(Citation: Microsoft Dynamic-Link Library Redire
>ye DLL Search Order Hijacking)  If a search order-vulnerable>ction)(Citation: Microsoft Manifests)(Citation: FireEye DLL 
> program is configured to run at a higher privilege level, t>Search Order Hijacking)  If a search order-vulnerable progra
>hen the adversary-controlled DLL that is loaded will also be>m is configured to run at a higher privilege level, then the
> executed at the higher level. In this case, the technique c> adversary-controlled DLL that is loaded will also be execut
>ould be used for privilege escalation from user to administr>ed at the higher level. In this case, the technique could be
>ator or SYSTEM or from administrator to SYSTEM, depending on> used for privilege escalation from user to administrator or
> the program. Programs that fall victim to path hijacking ma> SYSTEM or from administrator to SYSTEM, depending on the pr
>y appear to behave normally because malicious DLLs may be co>ogram. Programs that fall victim to path hijacking may appea
>nfigured to also load the legitimate DLLs they were meant to>r to behave normally because malicious DLLs may be configure
> replace.>d to also load the legitimate DLLs they were meant to replac
 >e.
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-26 16:13:58.862000+00:002021-04-26 18:37:03.748000+00:00
descriptionAdversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution. There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637) Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL. (Citation: Microsoft Dynamic-Link Library Redirection) (Citation: Microsoft Manifests) (Citation: FireEye DLL Search Order Hijacking) If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution. There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637) Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking) If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.
external_references[3]['source_name']OWASP Binary PlantingFireEye Hijacking July 2010
external_references[3]['description']OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.Harbour, N. (2010, July 15). Malware Persistence without the Windows Registry. Retrieved November 17, 2020.
external_references[3]['url']https://www.owasp.org/index.php/Binary_plantinghttps://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html
external_references[4]['source_name']Microsoft Security Advisory 2269637OWASP Binary Planting
external_references[4]['description']Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020.OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016.
external_references[4]['url']https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637https://www.owasp.org/index.php/Binary_planting
external_references[5]['source_name']Microsoft Dynamic-Link Library RedirectionFireEye fxsst June 2011
external_references[5]['description']Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020.Harbour, N. (2011, June 3). What the fxsst?. Retrieved November 17, 2020.
external_references[5]['url']https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDNhttps://www.fireeye.com/blog/threat-research/2011/06/fxsst.html
external_references[6]['source_name']Microsoft ManifestsMicrosoft Security Advisory 2269637
external_references[6]['description']Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020.
external_references[6]['url']https://msdn.microsoft.com/en-US/library/aa375365https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637
external_references[7]['source_name']FireEye DLL Search Order HijackingMicrosoft Dynamic-Link Library Redirection
external_references[7]['description']Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020.
external_references[7]['url']https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.htmlhttps://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN
x_mitre_data_sources[0]Process command-line parametersFile: File Creation
x_mitre_data_sources[1]Process monitoringFile: File Modification
x_mitre_data_sources[2]DLL monitoringModule: Module Load
x_mitre_detectionMonitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of `.manifest` and `.local` redirection files that do not correlate with software updates are suspicious.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft Manifests', 'description': 'Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.', 'url': 'https://msdn.microsoft.com/en-US/library/aa375365'}
external_references{'source_name': 'FireEye DLL Search Order Hijacking', 'description': 'Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.', 'url': 'https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html'}
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesFile monitoring

[T1485] Data Destruction

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may destroy data and files on specific systems ot1Adversaries may destroy data and files on specific systems o
>r in large numbers on a network to interrupt availability to>r in large numbers on a network to interrupt availability to
> systems, services, and network resources. Data destruction > systems, services, and network resources. Data destruction 
>is likely to render stored data irrecoverable by forensic te>is likely to render stored data irrecoverable by forensic te
>chniques through overwriting files or data on local and remo>chniques through overwriting files or data on local and remo
>te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy>te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy
>e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci>e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci
>tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon>tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon
>3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera>3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera
>ting system file deletion commands such as <code>del</code> >ting system file deletion commands such as <code>del</code> 
>and <code>rm</code> often only remove pointers to files with>and <code>rm</code> often only remove pointers to files with
>out wiping the contents of the files themselves, making the >out wiping the contents of the files themselves, making the 
>files recoverable by proper forensic methodology. This behav>files recoverable by proper forensic methodology. This behav
>ior is distinct from [Disk Content Wipe](https://attack.mitr>ior is distinct from [Disk Content Wipe](https://attack.mitr
>e.org/techniques/T1561/001) and [Disk Structure Wipe](https:>e.org/techniques/T1561/001) and [Disk Structure Wipe](https:
>//attack.mitre.org/techniques/T1561/002) because individual >//attack.mitre.org/techniques/T1561/002) because individual 
>files are destroyed rather than sections of a storage disk o>files are destroyed rather than sections of a storage disk o
>r the disk's logical structure.  Adversaries may attempt to >r the disk's logical structure.  Adversaries may attempt to 
>overwrite files and directories with randomly generated data>overwrite files and directories with randomly generated data
> to make it irrecoverable.(Citation: Kaspersky StoneDrill 20> to make it irrecoverable.(Citation: Kaspersky StoneDrill 20
>17)(Citation: Unit 42 Shamoon3 2018) In some cases political>17)(Citation: Unit 42 Shamoon3 2018) In some cases political
>ly oriented image files have been used to overwrite data.(Ci>ly oriented image files have been used to overwrite data.(Ci
>tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo>tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo
>n Nov 2016)(Citation: Kaspersky StoneDrill 2017)  To maximiz>n Nov 2016)(Citation: Kaspersky StoneDrill 2017)  To maximiz
>e impact on the target organization in operations where netw>e impact on the target organization in operations where netw
>ork-wide availability interruption is the goal, malware desi>ork-wide availability interruption is the goal, malware desi
>gned for destroying data may have worm-like features to prop>gned for destroying data may have worm-like features to prop
>agate across a network by leveraging additional techniques l>agate across a network by leveraging additional techniques l
>ike [Valid Accounts](https://attack.mitre.org/techniques/T10>ike [Valid Accounts](https://attack.mitre.org/techniques/T10
>78), [OS Credential Dumping](https://attack.mitre.org/techni>78), [OS Credential Dumping](https://attack.mitre.org/techni
>ques/T1003), and [SMB/Windows Admin Shares](https://attack.m>ques/T1003), and [SMB/Windows Admin Shares](https://attack.m
>itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2>itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2
>012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto>012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto
> Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita> Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita
>tion: Talos Olympic Destroyer 2018)>tion: Talos Olympic Destroyer 2018).  In cloud environments,
 > adversaries may leverage access to delete cloud storage, cl
 >oud storage accounts, machine images, and other infrastructu
 >re crucial to operations to damage an organization or their 
 >customers.(Citation: Data Destruction - Threat Post)(Citatio
 >n: DOJ  - Cisco Insider)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Brent Murphy, Elastic', 'David French, Elastic', 'Syed Ummar Farooqh, McAfee', 'Prasad Somasamudram, McAfee', 'Sekhar Sarukkai, McAfee ', 'Varonis Threat Labs']
values_changed
STIX FieldOld valueNew Value
modified2020-03-27 21:08:19.783000+00:002021-03-25 14:47:48.728000+00:00
descriptionAdversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure. Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018). In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider)
x_mitre_data_sources[0]File monitoringProcess: Process Creation
x_mitre_data_sources[1]Process command-line parametersCommand: Command Execution
x_mitre_data_sources[2]Process monitoringFile: File Modification
x_mitre_detectionUse process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\.Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\. In cloud environments, the occurrence of anomalous high-volume deletion events, such as the DeleteDBCluster and DeleteGlobalCluster events in AWS, or a high quantity of data deletion events, such as DeleteBucket, within a short period of time may indicate suspicious activity.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Data Destruction - Threat Post', 'description': 'Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.', 'url': 'https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/'}
external_references{'source_name': 'DOJ - Cisco Insider', 'description': 'DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.', 'url': 'https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network'}
x_mitre_data_sourcesFile: File Deletion
x_mitre_data_sourcesImage: Image Deletion
x_mitre_data_sourcesInstance: Instance Deletion
x_mitre_data_sourcesSnapshot: Snapshot Deletion
x_mitre_data_sourcesCloud Storage: Cloud Storage Deletion
x_mitre_data_sourcesVolume: Volume Deletion
x_mitre_platformsWindows
x_mitre_platformsIaaS
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsWindows

[T1486] Data Encrypted for Impact

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may encrypt data on target systems or on large nt1Adversaries may encrypt data on target systems or on large n
>umbers of systems in a network to interrupt availability to >umbers of systems in a network to interrupt availability to 
>system and network resources. They can attempt to render sto>system and network resources. They can attempt to render sto
>red data inaccessible by encrypting files or data on local a>red data inaccessible by encrypting files or data on local a
>nd remote drives and withholding access to a decryption key.>nd remote drives and withholding access to a decryption key.
> This may be done in order to extract monetary compensation > This may be done in order to extract monetary compensation 
>from a victim in exchange for decryption or a decryption key>from a victim in exchange for decryption or a decryption key
> (ransomware) or to render data permanently inaccessible in > (ransomware) or to render data permanently inaccessible in 
>cases where the key is not saved or transmitted.(Citation: U>cases where the key is not saved or transmitted.(Citation: U
>S-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Cit>S-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Cit
>ation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)>ation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)
> In the case of ransomware, it is typical that common user f> In the case of ransomware, it is typical that common user f
>iles like Office documents, PDFs, images, videos, audio, tex>iles like Office documents, PDFs, images, videos, audio, tex
>t, and source code files will be encrypted. In some cases, a>t, and source code files will be encrypted. In some cases, a
>dversaries may encrypt critical system files, disk partition>dversaries may encrypt critical system files, disk partition
>s, and the MBR.(Citation: US-CERT NotPetya 2017)  To maximiz>s, and the MBR.(Citation: US-CERT NotPetya 2017)  To maximiz
>e impact on the target organization, malware designed for en>e impact on the target organization, malware designed for en
>crypting data may have worm-like features to propagate acros>crypting data may have worm-like features to propagate acros
>s a network by leveraging other attack techniques like [Vali>s a network by leveraging other attack techniques like [Vali
>d Accounts](https://attack.mitre.org/techniques/T1078), [OS >d Accounts](https://attack.mitre.org/techniques/T1078), [OS 
>Credential Dumping](https://attack.mitre.org/techniques/T100>Credential Dumping](https://attack.mitre.org/techniques/T100
>3), and [SMB/Windows Admin Shares](https://attack.mitre.org/>3), and [SMB/Windows Admin Shares](https://attack.mitre.org/
>techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Cita>techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Cita
>tion: US-CERT NotPetya 2017)>tion: US-CERT NotPetya 2017)  In cloud environments, storage
 > objects within compromised accounts may also be encrypted.(
 >Citation: Rhino S3 Ransomware Part 1)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Oleg Kolesnikov, Securonix']
values_changed
STIX FieldOld valueNew Value
modified2020-10-14 14:52:11.708000+00:002021-04-20 16:39:06.594000+00:00
descriptionAdversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) In cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1)
x_mitre_data_sources[0]Kernel driversCloud Storage: Cloud Storage Metadata
x_mitre_data_sources[1]File monitoringCloud Storage: Cloud Storage Modification
x_mitre_data_sources[2]Process command-line parametersProcess: Process Creation
x_mitre_data_sources[3]Process monitoringCommand: Command Execution
x_mitre_detectionUse process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories. In some cases, monitoring for unusual kernel driver installation activity can aid in detection.Use process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories. In some cases, monitoring for unusual kernel driver installation activity can aid in detection. In cloud environments, monitor for events that indicate storage objects have been anomalously replaced by copies.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Rhino S3 Ransomware Part 1', 'description': 'Gietzen, S. (n.d.). S3 Ransomware Part 1: Attack Vector. Retrieved April 14, 2021.', 'url': 'https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/'}
x_mitre_data_sourcesFile: File Modification
x_mitre_data_sourcesFile: File Creation
x_mitre_platformsIaaS

[T1074] Data Staged

Current version: 1.3

Version changed from: 1.2 → 1.3

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:48:08.180000+00:002021-03-08 10:33:00.855000+00:00
x_mitre_data_sources[0]File monitoringFile: File Access
x_mitre_data_sources[1]Process monitoringFile: File Creation
x_mitre_data_sources[2]Process command-line parametersCommand: Command Execution
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_version1.21.3
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1530] Data from Cloud Storage Object

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-09 14:02:05.276000+00:002021-03-08 10:33:01.374000+00:00
x_mitre_data_sources[0]Stackdriver logsCloud Storage: Cloud Storage Access
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1213] Data from Information Repositories

Current version: 3.1

Version changed from: 3.0 → 3.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-12 12:16:55.085000+00:002021-04-14 14:16:12.151000+00:00
x_mitre_data_sources[0]OAuth audit logsLogon Session: Logon Session Creation
x_mitre_data_sources[1]Application logsApplication Log: Application Log Content
x_mitre_version3.03.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAuthentication logs
x_mitre_data_sourcesData loss prevention
x_mitre_data_sourcesThird-party application logs

[T1491] Defacement

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-04-22 15:19:31.682000+00:002021-03-08 10:33:01.150000+00:00
x_mitre_data_sources[0]Packet captureFile: File Modification
x_mitre_data_sources[1]Web application firewall logsFile: File Creation
x_mitre_data_sources[2]Web logsApplication Log: Application Log Content
x_mitre_data_sources[3]Packet captureNetwork Traffic: Network Traffic Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1078.001] Valid Accounts: Default Accounts

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may obtain and abuse credentials of a default act1Adversaries may obtain and abuse credentials of a default ac
>count as a means of gaining Initial Access, Persistence, Pri>count as a means of gaining Initial Access, Persistence, Pri
>vilege Escalation, or Defense Evasion. Default accounts are >vilege Escalation, or Defense Evasion. Default accounts are 
>those that are built-into an OS, such as the Guest or Admini>those that are built-into an OS, such as the Guest or Admini
>strator accounts on Windows systems or default factory/provi>strator accounts on Windows systems. Default accounts also i
>der set accounts on other types of systems, software, or dev>nclude default factory/provider set accounts on other types 
>ices.(Citation: Microsoft Local Accounts Feb 2019)  Default >of systems, software, or devices, including the root user ac
>accounts are not limited to client machines, rather also inc>count in AWS and the default service account in Kubernetes.(
>lude accounts that are preset for equipment such as network >Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS R
>devices and computer applications whether they are internal,>oot User)(Citation: Threat Matrix for Kubernetes)  Default a
> open source, or commercial. Appliances that come preset wit>ccounts are not limited to client machines, rather also incl
>h a username and password combination pose a serious threat >ude accounts that are preset for equipment such as network d
>to organizations that do not change it post installation, as>evices and computer applications whether they are internal, 
> they are easy targets for an adversary. Similarly, adversar>open source, or commercial. Appliances that come preset with
>ies may also utilize publicly disclosed or stolen [Private K> a username and password combination pose a serious threat t
>eys](https://attack.mitre.org/techniques/T1552/004) or crede>o organizations that do not change it post installation, as 
>ntial materials to legitimately connect to remote environmen>they are easy targets for an adversary. Similarly, adversari
>ts via [Remote Services](https://attack.mitre.org/techniques>es may also utilize publicly disclosed or stolen [Private Ke
>/T1021).(Citation: Metasploit SSH Module)>ys](https://attack.mitre.org/techniques/T1552/004) or creden
 >tial materials to legitimately connect to remote environment
 >s via [Remote Services](https://attack.mitre.org/techniques/
 >T1021).(Citation: Metasploit SSH Module)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 19:41:43.491000+00:002021-04-05 20:14:26.846000+00:00
descriptionAdversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices.(Citation: Microsoft Local Accounts Feb 2019) Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes) Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module)
external_references[3]['source_name']Metasploit SSH ModuleAWS Root User
external_references[3]['description']undefined. (n.d.). Retrieved April 12, 2019.Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021.
external_references[3]['url']https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/sshhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
x_mitre_data_sources[0]AWS CloudTrail logsUser Account: User Account Authentication
x_mitre_data_sources[1]Stackdriver logsLogon Session: Logon Session Creation
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_platforms[8]SaaSContainers
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Threat Matrix for Kubernetes', 'description': 'Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved March 30, 2021.', 'url': 'https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/'}
external_references{'source_name': 'Metasploit SSH Module', 'description': 'Metasploit. (n.d.). Retrieved April 12, 2019.', 'url': 'https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh'}
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAuthentication logs
x_mitre_data_sourcesProcess monitoring

[T1578.003] Modify Cloud Compute Infrastructure: Delete Cloud Instance

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:55:23.113000+00:002021-03-08 10:33:02.083000+00:00
x_mitre_data_sources[0]GCP audit logsInstance: Instance Deletion
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1588.004] Obtain Capabilities: Digital Certificates

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Before compromising a victim, adversaries may buy and/or stet1Adversaries may buy and/or steal SSL/TLS certificates that c
>al SSL/TLS certificates that can be used during targeting. S>an be used during targeting. SSL/TLS certificates are design
>SL/TLS certificates are designed to instill trust. They incl>ed to instill trust. They include information about the key,
>ude information about the key, information about its owner's> information about its owner's identity, and the digital sig
> identity, and the digital signature of an entity that has v>nature of an entity that has verified the certificate's cont
>erified the certificate's contents are correct. If the signa>ents are correct. If the signature is valid, and the person 
>ture is valid, and the person examining the certificate trus>examining the certificate trusts the signer, then they know 
>ts the signer, then they know they can use that key to commu>they can use that key to communicate with its owner.  Advers
>nicate with its owner.  Adversaries may purchase or steal SS>aries may purchase or steal SSL/TLS certificates to further 
>L/TLS certificates to further their operations, such as encr>their operations, such as encrypting C2 traffic (ex: [Asymme
>ypting C2 traffic (ex: [Web Protocols](https://attack.mitre.>tric Cryptography](https://attack.mitre.org/techniques/T1573
>org/techniques/T1071/001)) or even enabling [Man-in-the-Midd>/002) with [Web Protocols](https://attack.mitre.org/techniqu
>le](https://attack.mitre.org/techniques/T1557) if the certif>es/T1071/001)) or even enabling [Man-in-the-Middle](https://
>icate is trusted or otherwise added to the root of trust (i.>attack.mitre.org/techniques/T1557) if the certificate is tru
>e. [Install Root Certificate](https://attack.mitre.org/techn>sted or otherwise added to the root of trust (i.e. [Install 
>iques/T1553/004)). The purchase of digital certificates may >Root Certificate](https://attack.mitre.org/techniques/T1553/
>be done using a front organization or using information stol>004)). The purchase of digital certificates may be done usin
>en from a previously compromised entity that allows the adve>g a front organization or using information stolen from a pr
>rsary to validate to a certificate provider as that entity. >eviously compromised entity that allows the adversary to val
>Adversaries may also steal certificate materials directly fr>idate to a certificate provider as that entity. Adversaries 
>om a compromised third-party, including from certificate aut>may also steal certificate materials directly from a comprom
>horities.(Citation: DiginotarCompromise)  Certificate author>ised third-party, including from certificate authorities.(Ci
>ities exist that allow adversaries to acquire SSL/TLS certif>tation: DiginotarCompromise) Adversaries may register or hij
>icates, such as domain validation certificates, for free.(Ci>ack domains that they will later purchase an SSL/TLS certifi
>tation: Let's Encrypt FAQ)  Adversaries may register or hija>cate for.  Certificate authorities exist that allow adversar
>ck domains that they will later purchase an SSL/TLS certific>ies to acquire SSL/TLS certificates, such as domain validati
>ate for.>on certificates, for free.(Citation: Let's Encrypt FAQ)  Aft
 >er obtaining a digital certificate, an adversary may then in
 >stall that certificate (see [Install Digital Certificate](ht
 >tps://attack.mitre.org/techniques/T1608/003)) on infrastruct
 >ure under their control.
Details
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sources['SSL/TLS certificates']
values_changed
STIX FieldOld valueNew Value
modified2020-10-22 18:18:54.959000+00:002021-04-15 02:32:49.507000+00:00
descriptionBefore compromising a victim, adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ) After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
x_mitre_version1.01.1

[T1587.003] Develop Capabilities: Digital Certificates

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Before compromising a victim, adversaries may create self-sit1Adversaries may create self-signed SSL/TLS certificates that
>gned SSL/TLS certificates that can be used during targeting.> can be used during targeting. SSL/TLS certificates are desi
> SSL/TLS certificates are designed to instill trust. They in>gned to instill trust. They include information about the ke
>clude information about the key, information about its owner>y, information about its owner's identity, and the digital s
>'s identity, and the digital signature of an entity that has>ignature of an entity that has verified the certificate's co
> verified the certificate's contents are correct. If the sig>ntents are correct. If the signature is valid, and the perso
>nature is valid, and the person examining the certificate tr>n examining the certificate trusts the signer, then they kno
>usts the signer, then they know they can use that key to com>w they can use that key to communicate with its owner. In th
>municate with its owner. In the case of self-signing, digita>e case of self-signing, digital certificates will lack the e
>l certificates will lack the element of trust associated wit>lement of trust associated with the signature of a third-par
>h the signature of a third-party certificate authority (CA).>ty certificate authority (CA).  Adversaries may create self-
>  Adversaries may create self-signed SSL/TLS certificates th>signed SSL/TLS certificates that can be used to further thei
>at can be used to further their operations, such as encrypti>r operations, such as encrypting C2 traffic (ex: [Asymmetric
>ng C2 traffic (ex: [Web Protocols](https://attack.mitre.org/> Cryptography](https://attack.mitre.org/techniques/T1573/002
>techniques/T1071/001)) or even enabling [Man-in-the-Middle](>) with [Web Protocols](https://attack.mitre.org/techniques/T
>https://attack.mitre.org/techniques/T1557) if added to the r>1071/001)) or even enabling [Man-in-the-Middle](https://atta
>oot of trust (i.e. [Install Root Certificate](https://attack>ck.mitre.org/techniques/T1557) if added to the root of trust
>.mitre.org/techniques/T1553/004)).> (i.e. [Install Root Certificate](https://attack.mitre.org/t
 >echniques/T1553/004)).  After creating a digital certificate
 >, an adversary may then install that certificate (see [Insta
 >ll Digital Certificate](https://attack.mitre.org/techniques/
 >T1608/003)) on infrastructure under their control.
Details
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sources['SSL/TLS certificates']
values_changed
STIX FieldOld valueNew Value
modified2020-10-22 18:18:08.422000+00:002021-04-15 02:33:38.589000+00:00
descriptionBefore compromising a victim, adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA). Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.
x_mitre_version1.01.1

[T1498.001] Network Denial of Service: Direct Network Flood

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:57:12.410000+00:002021-03-29 16:11:56.727000+00:00
x_mitre_data_sources[0]Sensor health and statusSensor Health: Host Status
x_mitre_data_sources[1]Network protocol analysisNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]Azure ADLinux
x_mitre_platforms[6]SaaSmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetflow/Enclave netflow
x_mitre_data_sourcesNetwork intrusion detection system
x_mitre_data_sourcesNetwork device logs
x_mitre_platformsOffice 365

[T1562.008] Impair Defenses: Disable Cloud Logs

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 16:31:34.489000+00:002021-03-15 16:43:04.273000+00:00
x_mitre_contributors[4]AttackIQAlex Soler, AttackIQ
x_mitre_data_sources[0]AWS CloudTrail logsCloud Service: Cloud Service Modification
x_mitre_data_sources[1]Azure activity logsCloud Service: Cloud Service Disable
x_mitre_platforms[0]GCPIaaS
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsSyed Ummar Farooqh, McAfee
x_mitre_contributorsPrasad Somasamudram, McAfee
x_mitre_contributorsSekhar Sarukkai, McAfee
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_contributorsSekhar Sarukkai; Prasad Somasamudram; Syed Ummar Farooqh (McAfee)
x_mitre_data_sourcesGCP audit logs
x_mitre_platformsAzure
x_mitre_platformsAWS

[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 20:02:24.426000+00:002021-03-08 10:33:02.146000+00:00
x_mitre_data_sources[0]Stackdriver logsFirewall: Firewall Rule Modification
x_mitre_data_sources[1]GCP audit logsFirewall: Firewall Disable
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAzure activity logs
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1562.001] Impair Defenses: Disable or Modify Tools

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security', 'Nathaniel Quist, Palo Alto Networks', 'Gal Singer, @galsinger29, Team Nautilus Aqua Security']
values_changed
STIX FieldOld valueNew Value
modified2020-03-29 21:52:43.151000+00:002021-04-19 13:41:17.746000+00:00
x_mitre_data_sources[0]Process command-line parametersProcess: Process Termination
x_mitre_data_sources[1]Windows RegistryWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[2]ServicesWindows Registry: Windows Registry Key Deletion
x_mitre_data_sources[3]File monitoringCommand: Command Execution
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesService: Service Metadata
x_mitre_data_sourcesSensor Health: Host Status
x_mitre_platformsContainers
x_mitre_platformsIaaS

[T1087.003] Account Discovery: Email Account

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may attempt to get a listing of email addresses t1Adversaries may attempt to get a listing of email addresses 
>and accounts. Adversaries may try to dump Exchange address l>and accounts. Adversaries may try to dump Exchange address l
>ists such as global address lists (GALs).(Citation: Microsof>ists such as global address lists (GALs).(Citation: Microsof
>t Exchange Address Lists)  In on-premises Exchange and Excha>t Exchange Address Lists)  In on-premises Exchange and Excha
>nge Online, the<code>Get-GlobalAddressList</code> PowerShell>nge Online, the<code>Get-GlobalAddressList</code> PowerShell
> cmdlet can be used to obtain email addresses and accounts f> cmdlet can be used to obtain email addresses and accounts f
>rom a domain using an authenticated session.(Citation: Micro>rom a domain using an authenticated session.(Citation: Micro
>soft getglobaladdresslist)(Citation: Black Hills Attacking E>soft getglobaladdresslist)(Citation: Black Hills Attacking E
>xchange MailSniper, 2016)>xchange MailSniper, 2016)  In Google Workspace, the GAL is s
 >hared with Microsoft Outlook users through the Google Worksp
 >ace Sync for Microsoft Outlook (GWSMO) service. Additionally
 >, the Google Workspace Directory allows for users to get a l
 >isting of other users within the organization.(Citation: Goo
 >gle Workspace Global Access List)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-26 15:27:58.933000+00:002021-03-31 13:10:46.302000+00:00
descriptionAdversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
x_mitre_data_sources[0]Office 365 account logsUser Account: User Account Metadata
x_mitre_data_sources[1]Process monitoringCommand: Command Execution
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Google Workspace Global Access List', 'description': 'Google. (n.d.). Retrieved March 16, 2021.', 'url': 'https://support.google.com/a/answer/166870?hl=en'}
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess command-line parameters

[T1114] Email Collection

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-24 18:31:06.417000+00:002021-04-14 14:22:44.435000+00:00
x_mitre_data_sources[0]Office 365 trace logsFile: File Access
x_mitre_data_sources[1]Mail serverNetwork Traffic: Network Connection Creation
x_mitre_data_sources[2]Email gatewayLogon Session: Logon Session Creation
x_mitre_data_sources[3]Authentication logsCommand: Command Execution
x_mitre_data_sources[4]File monitoringApplication Log: Application Log Content
x_mitre_version2.12.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesProcess use of network

[T1114.003] Email Collection: Email Forwarding Rule

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may setup email forwarding rules to collect senst1Adversaries may setup email forwarding rules to collect sens
>itive information. Adversaries may abuse email-forwarding ru>itive information. Adversaries may abuse email-forwarding ru
>les to monitor the activities of a victim, steal information>les to monitor the activities of a victim, steal information
>, and further gain intelligence on the victim or the victim’>, and further gain intelligence on the victim or the victim’
>s organization to use as part of further exploits or operati>s organization to use as part of further exploits or operati
>ons.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook W>ons.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook W
>eb App (OWA) allow users to create inbox rules for various e>eb App (OWA) allow users to create inbox rules for various e
>mail functions, including forwarding to a different recipien>mail functions, including forwarding to a different recipien
>t. Messages can be forwarded to internal or external recipie>t. Similarly, Google Workspace users or administrators can s
>nts, and there are no restrictions limiting the extent of th>et up mail forwarding rules via the Google Workspace web int
>is rule. Administrators may also create forwarding rules for>erface. Messages can be forwarded to internal or external re
> user accounts with the same considerations and outcomes.(Ci>cipients, and there are no restrictions limiting the extent 
>tation: Microsoft Tim McMichael Exchange Mail Forwarding 2) >of this rule. Administrators may also create forwarding rule
>  Any user or administrator within the organization (or adve>s for user accounts with the same considerations and outcome
>rsary with valid credentials) can create rules to automatica>s.(Citation: Microsoft Tim McMichael Exchange Mail Forwardin
>lly forward all received messages to another recipient, forw>g 2)   Any user or administrator within the organization (or
>ard emails to different locations based on the sender, and m> adversary with valid credentials) can create rules to autom
>ore.>atically forward all received messages to another recipient,
 > forward emails to different locations based on the sender, 
 >and more.
Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 22:43:45.509000+00:002021-03-25 13:08:30.699000+00:00
descriptionAdversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Similarly, Google Workspace users or administrators can set up mail forwarding rules via the Google Workspace web interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.
x_mitre_data_sources[0]Process use of networkApplication Log: Application Log Content
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesEmail gateway
x_mitre_data_sourcesMail server
x_mitre_data_sourcesOffice 365 trace logs

[T1499] Endpoint Denial of Service

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Alfredo Oliveira, Trend Micro', 'David Fiser, @anu4is, Trend Micro', 'Magno Logan, @magnologan, Trend Micro', 'Vishwas Manral, McAfee', 'Yossi Weizman, Azure Defender Research Team']
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:56:03.459000+00:002021-04-14 12:05:31.985000+00:00
x_mitre_data_sources[0]SSL/TLS inspectionSensor Health: Host Status
x_mitre_data_sources[1]Web logsApplication Log: Application Log Content
x_mitre_data_sources[2]Web application firewall logsNetwork Traffic: Network Traffic Content
x_mitre_data_sources[3]Network intrusion detection systemNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_platforms[8]SaaSContainers
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetwork protocol analysis
x_mitre_data_sourcesNetwork device logs
x_mitre_data_sourcesNetflow/Enclave netflow

[T1585] Establish Accounts

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Before compromising a victim, adversaries may create and cult1Adversaries may create and cultivate accounts with services 
>tivate accounts with services that can be used during target>that can be used during targeting. Adversaries can create ac
>ing. Adversaries can create accounts that can be used to bui>counts that can be used to build a persona to further operat
>ld a persona to further operations. Persona development cons>ions. Persona development consists of the development of pub
>ists of the development of public information, presence, his>lic information, presence, history and appropriate affiliati
>tory and appropriate affiliations. This development could be>ons. This development could be applied to social media, webs
> applied to social media, website, or other publicly availab>ite, or other publicly available information that could be r
>le information that could be referenced and scrutinized for >eferenced and scrutinized for legitimacy over the course of 
>legitimacy over the course of an operation using that person>an operation using that persona or identity.(Citation: NEWSC
>a or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatR>ASTER2014)(Citation: BlackHatRobinSage)  For operations inco
>obinSage)  For operations incorporating social engineering, >rporating social engineering, the utilization of an online p
>the utilization of an online persona may be important. These>ersona may be important. These personas may be fictitious or
> personas may be fictitious or impersonate real people. The > impersonate real people. The persona may exist on a single 
>persona may exist on a single site or across multiple sites >site or across multiple sites (ex: Facebook, LinkedIn, Twitt
>(ex: Facebook, LinkedIn, Twitter, Google, etc.). Establishin>er, Google, GitHub, Docker Hub, etc.). Establishing a person
>g a persona may require development of additional documentat>a may require development of additional documentation to mak
>ion to make them seem real. This could include filling out p>e them seem real. This could include filling out profile inf
>rofile information, developing social networks, or incorpora>ormation, developing social networks, or incorporating photo
>ting photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRob>s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)  E
>inSage)  Establishing accounts can also include the creation>stablishing accounts can also include the creation of accoun
> of accounts with email providers, which may be directly lev>ts with email providers, which may be directly leveraged for
>eraged for [Phishing for Information](https://attack.mitre.o> [Phishing for Information](https://attack.mitre.org/techniq
>rg/techniques/T1598) or [Phishing](https://attack.mitre.org/>ues/T1598) or [Phishing](https://attack.mitre.org/techniques
>techniques/T1566).(Citation: Mandiant APT1)>/T1566).(Citation: Mandiant APT1)
Details
dictionary_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sources['Social media monitoring']
values_changed
STIX FieldOld valueNew Value
modified2020-10-22 18:20:40.675000+00:002021-04-15 03:10:35.877000+00:00
descriptionBefore compromising a victim, adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1)
x_mitre_version1.01.1

[T1190] Exploit Public-Facing Application

Current version: 2.3

Version changed from: 2.2 → 2.3


Old Description
New Description
t1Adversaries may attempt to take advantage of a weakness in at1Adversaries may attempt to take advantage of a weakness in a
>n Internet-facing computer or program using software, data, >n Internet-facing computer or program using software, data, 
>or commands in order to cause unintended or unanticipated be>or commands in order to cause unintended or unanticipated be
>havior. The weakness in the system can be a bug, a glitch, o>havior. The weakness in the system can be a bug, a glitch, o
>r a design vulnerability. These applications are often websi>r a design vulnerability. These applications are often websi
>tes, but can include databases (like SQL)(Citation: NVD CVE->tes, but can include databases (like SQL)(Citation: NVD CVE-
>2016-6662), standard services (like SMB(Citation: CIS Multip>2016-6662), standard services (like SMB(Citation: CIS Multip
>le SMB Vulnerabilities) or SSH), network device administrati>le SMB Vulnerabilities) or SSH), network device administrati
>on and management protocols (like SNMP and Smart Install(Cit>on and management protocols (like SNMP and Smart Install(Cit
>ation: US-CERT TA18-106A Network Infrastructure Devices 2018>ation: US-CERT TA18-106A Network Infrastructure Devices 2018
>)(Citation: Cisco Blog Legacy Device Attacks)), and any othe>)(Citation: Cisco Blog Legacy Device Attacks)), and any othe
>r applications with Internet accessible open sockets, such a>r applications with Internet accessible open sockets, such a
>s web servers and related services.(Citation: NVD CVE-2014-7>s web servers and related services.(Citation: NVD CVE-2014-7
>169) Depending on the flaw being exploited this may include >169) Depending on the flaw being exploited this may include 
>[Exploitation for Defense Evasion](https://attack.mitre.org/>[Exploitation for Defense Evasion](https://attack.mitre.org/
>techniques/T1211).   If an application is hosted on cloud-ba>techniques/T1211).   If an application is hosted on cloud-ba
>sed infrastructure, then exploiting it may lead to compromis>sed infrastructure and/or is containerized, then exploiting 
>e of the underlying instance. This can allow an adversary a >it may lead to compromise of the underlying instance or cont
>path to access the cloud APIs or to take advantage of weak i>ainer. This can allow an adversary a path to access the clou
>dentity and access management policies.  For websites and da>d or container APIs, exploit container host access via [Esca
>tabases, the OWASP top 10 and CWE top 25 highlight the most >pe to Host](https://attack.mitre.org/techniques/T1611), or t
>common web-based vulnerabilities.(Citation: OWASP Top 10)(Ci>ake advantage of weak identity and access management policie
>tation: CWE top 25)>s.  For websites and databases, the OWASP top 10 and CWE top
 > 25 highlight the most common web-based vulnerabilities.(Cit
 >ation: OWASP Top 10)(Citation: CWE top 25)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-21 01:10:54.358000+00:002021-04-12 18:25:16.409000+00:00
descriptionAdversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), network device administration and management protocols (like SNMP and Smart Install(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). If an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), network device administration and management protocols (like SNMP and Smart Install(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211). If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies. For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)
x_mitre_data_sources[0]Azure activity logsApplication Log: Application Log Content
x_mitre_data_sources[1]AWS CloudTrail logsNetwork Traffic: Network Traffic Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]WindowsIaaS
x_mitre_platforms[2]macOSNetwork
x_mitre_platforms[3]AWSLinux
x_mitre_platforms[4]GCPmacOS
x_mitre_platforms[5]AzureContainers
x_mitre_version2.22.3
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsYossi Weizman, Azure Defender Research Team
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesStackdriver logs
x_mitre_data_sourcesPacket capture
x_mitre_data_sourcesWeb logs
x_mitre_data_sourcesWeb application firewall logs
x_mitre_data_sourcesApplication logs
x_mitre_platformsNetwork

[T1068] Exploitation for Privilege Escalation

Current version: 1.3

Version changed from: 1.2 → 1.3


Old Description
New Description
t1Adversaries may exploit software vulnerabilities in an attemt1Adversaries may exploit software vulnerabilities in an attem
>pt to collect elevate privileges. Exploitation of a software>pt to elevate privileges. Exploitation of a software vulnera
> vulnerability occurs when an adversary takes advantage of a>bility occurs when an adversary takes advantage of a program
> programming error in a program, service, or within the oper>ming error in a program, service, or within the operating sy
>ating system software or kernel itself to execute adversary->stem software or kernel itself to execute adversary-controll
>controlled code. Security constructs such as permission leve>ed code. Security constructs such as permission levels will 
>ls will often hinder access to information and use of certai>often hinder access to information and use of certain techni
>n techniques, so adversaries will likely need to perform pri>ques, so adversaries will likely need to perform privilege e
>vilege escalation to include use of software exploitation to>scalation to include use of software exploitation to circumv
> circumvent those restrictions.  When initially gaining acce>ent those restrictions.  When initially gaining access to a 
>ss to a system, an adversary may be operating within a lower>system, an adversary may be operating within a lower privile
> privileged process which will prevent them from accessing c>ged process which will prevent them from accessing certain r
>ertain resources on the system. Vulnerabilities may exist, u>esources on the system. Vulnerabilities may exist, usually i
>sually in operating system components and software commonly >n operating system components and software commonly running 
>running at higher permissions, that can be exploited to gain>at higher permissions, that can be exploited to gain higher 
> higher levels of access on the system. This could enable so>levels of access on the system. This could enable someone to
>meone to move from unprivileged or user level permissions to> move from unprivileged or user level permissions to SYSTEM 
> SYSTEM or root permissions depending on the component that >or root permissions depending on the component that is vulne
>is vulnerable. This may be a necessary step for an adversary>rable. This could also enable an adversary to move from a vi
> compromising a endpoint system that has been properly confi>rtualized environment, such as within a virtual machine or c
>gured and limits other privilege escalation methods.>ontainer, onto the underlying host. This may be a necessary 
 >step for an adversary compromising an endpoint system that h
 >as been properly configured and limits other privilege escal
 >ation methods.  Adversaries may bring a signed vulnerable dr
 >iver onto a compromised machine so that they can exploit the
 > vulnerability to execute code in kernel mode. This process 
 >is sometimes referred to as Bring Your Own Vulnerable Driver
 > (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Uni
 >t42 AcidBox June 2020) Adversaries may include the vulnerabl
 >e driver with files delivered during Initial Access or downl
 >oad it to a compromised system via [Ingress Tool Transfer](h
 >ttps://attack.mitre.org/techniques/T1105) or [Lateral Tool T
 >ransfer](https://attack.mitre.org/techniques/T1570).

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics', 'Yaniv Agman, @AgmanYaniv, Team Nautilus Aqua Security', 'Idan Revivo, @idanr86, Team Nautilus Aqua Security']
values_changed
STIX FieldOld valueNew Value
modified2020-03-26 21:12:49.194000+00:002021-04-22 16:13:34.896000+00:00
descriptionAdversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods.Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods. Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570).
x_mitre_data_sources[0]Windows Error ReportingDriver: Driver Load
x_mitre_detectionDetecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery. Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges.Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery. Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.(Citation: Microsoft Driver Block Rules) Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges.
x_mitre_version1.21.3
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'ESET InvisiMole June 2020', 'description': 'Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.', 'url': 'https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf'}
external_references{'source_name': 'Unit42 AcidBox June 2020', 'description': 'Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.', 'url': 'https://unit42.paloaltonetworks.com/acidbox-rare-malware/'}
external_references{'source_name': 'Microsoft Driver Block Rules', 'description': 'Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules'}
x_mitre_platformsContainers
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesApplication logs

[T1491.002] Defacement: External Defacement

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-04-22 15:19:31.380000+00:002021-03-08 10:33:01.745000+00:00
x_mitre_data_sources[0]Web logsFile: File Modification
x_mitre_data_sources[1]Web application firewall logsFile: File Creation
x_mitre_data_sources[2]Packet captureApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetwork Traffic: Network Traffic Content
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1133] External Remote Services

Current version: 2.2

Version changed from: 2.1 → 2.2


Old Description
New Description
t1Adversaries may leverage external-facing remote services to t1Adversaries may leverage external-facing remote services to 
>initially access and/or persist within a network. Remote ser>initially access and/or persist within a network. Remote ser
>vices such as VPNs, Citrix, and other access mechanisms allo>vices such as VPNs, Citrix, and other access mechanisms allo
>w users to connect to internal enterprise network resources >w users to connect to internal enterprise network resources 
>from external locations. There are often remote service gate>from external locations. There are often remote service gate
>ways that manage connections and credential authentication f>ways that manage connections and credential authentication f
>or these services. Services such as [Windows Remote Manageme>or these services. Services such as [Windows Remote Manageme
>nt](https://attack.mitre.org/techniques/T1021/006) can also >nt](https://attack.mitre.org/techniques/T1021/006) can also 
>be used externally.  Access to [Valid Accounts](https://atta>be used externally.  Access to [Valid Accounts](https://atta
>ck.mitre.org/techniques/T1078) to use the service is often a>ck.mitre.org/techniques/T1078) to use the service is often a
> requirement, which could be obtained through credential pha> requirement, which could be obtained through credential pha
>rming or by obtaining the credentials from users after compr>rming or by obtaining the credentials from users after compr
>omising the enterprise network.(Citation: Volexity Virtual P>omising the enterprise network.(Citation: Volexity Virtual P
>rivate Keylogging) Access to remote services may be used as >rivate Keylogging) Access to remote services may be used as 
>a redundant or persistent access mechanism during an operati>a redundant or persistent access mechanism during an operati
>on.>on.  Access may also be gained through an exposed service th
 >at doesn’t require authentication. In containerized environm
 >ents, this may include an exposed Docker API, Kubernetes API
 > server, kubelet, or web application such as the Kubernetes 
 >dashboard.(Citation: Trend Micro Exposed Docker Server)(Cita
 >tion: Unit 42 Hildegard Malware)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-06-19 20:07:09.600000+00:002021-04-22 20:22:02.443000+00:00
descriptionAdversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally. Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally. Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)
x_mitre_data_sources[0]Authentication logsApplication Log: Application Log Content
x_mitre_detectionFollow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours. When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.
x_mitre_version2.12.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Trend Micro Exposed Docker Server', 'description': 'Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html'}
external_references{'source_name': 'Unit 42 Hildegard Malware', 'description': 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.', 'url': 'https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/'}
x_mitre_contributorsExtraHop
x_mitre_contributorsDavid Fiser, @anu4is, Trend Micro
x_mitre_contributorsAlfredo Oliveira, Trend Micro
x_mitre_contributorsIdan Frimark, Cisco
x_mitre_contributorsRory McCune, Aqua Security
x_mitre_contributorsYuval Avrahami, Palo Alto Networks
x_mitre_contributorsJay Chen, Palo Alto Networks
x_mitre_contributorsBrad Geesaman, @bradgeesaman
x_mitre_contributorsMagno Logan, @magnologan, Trend Micro
x_mitre_contributorsAriel Shuper, Cisco
x_mitre_contributorsYossi Weizman, Azure Defender Research Team
x_mitre_contributorsVishwas Manral, McAfee
x_mitre_data_sourcesLogon Session: Logon Session Metadata
x_mitre_data_sourcesNetwork Traffic: Network Traffic Flow
x_mitre_platformsContainers

[T1606] Forge Web Credentials

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2021-01-22 21:07:45.925000+00:002021-04-14 14:29:27.631000+00:00
x_mitre_data_sources[0]Web logsLogon Session: Logon Session Creation
x_mitre_data_sources[1]Authentication logsWeb Credential: Web Credential Creation
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesWeb Credential: Web Credential Usage
x_mitre_platformsGoogle Workspace

[T1558.001] Steal or Forge Kerberos Tickets: Golden Ticket

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Itamar Mizrahi, Cymptom']
values_changed
STIX FieldOld valueNew Value
modified2020-03-31 12:59:10.840000+00:002020-11-05 16:07:03.779000+00:00
x_mitre_data_sources[0]Authentication logsActive Directory: Active Directory Credential Request
x_mitre_data_sources[1]Windows event logsLogon Session: Logon Session Metadata
x_mitre_version1.01.1

[T1574] Hijack Execution Flow

Current version: 1.1

Version changed from: 1.0 → 1.1

New Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-17 15:15:28.288000+00:002021-04-27 19:55:20.290000+00:00
x_mitre_data_sources[0]Environment variableWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[1]Loaded DLLsProcess: Process Creation
x_mitre_data_sources[2]Process command-line parametersModule: Module Load
x_mitre_data_sources[3]Process monitoringCommand: Command Execution
x_mitre_data_sources[4]File monitoringService: Service Metadata
x_mitre_data_sources[5]DLL monitoringFile: File Creation
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesFile: File Modification

[T1562] Impair Defenses

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 16:31:35.249000+00:002021-04-24 13:59:13.144000+00:00
x_mitre_data_sources[0]GCP audit logsProcess: Process Termination
x_mitre_data_sources[1]Azure activity logsWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[2]AWS CloudTrail logsWindows Registry: Windows Registry Key Deletion
x_mitre_data_sources[3]Anti-virusCommand: Command Execution
x_mitre_data_sources[4]ServicesService: Service Metadata
x_mitre_data_sources[5]API monitoringSensor Health: Host Status
x_mitre_data_sources[6]Environment variableScript: Script Execution
x_mitre_data_sources[7]Authentication logsFirewall: Firewall Disable
x_mitre_data_sources[8]File monitoringFirewall: Firewall Rule Modification
x_mitre_data_sources[9]Process command-line parametersCloud Service: Cloud Service Modification
x_mitre_data_sources[10]Process monitoringCloud Service: Cloud Service Disable
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]WindowsOffice 365
x_mitre_platforms[2]macOSIaaS
x_mitre_platforms[3]AWSLinux
x_mitre_platforms[4]GCPmacOS
x_mitre_platforms[5]AzureContainers
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesWindows Registry

[T1070] Indicator Removal on Host

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may delete or alter generated artifacts on a host1Adversaries may delete or alter generated artifacts on a hos
>t system, including logs or captured files such as quarantin>t system, including logs or captured files such as quarantin
>ed malware. Locations and format of logs are platform or pro>ed malware. Locations and format of logs are platform or pro
>duct-specific, however standard operating system logs are ca>duct-specific, however standard operating system logs are ca
>ptured as Windows events or Linux/macOS files such as [Bash >ptured as Windows events or Linux/macOS files such as [Bash 
>History](https://attack.mitre.org/techniques/T1139) and /var>History](https://attack.mitre.org/techniques/T1552/003) and 
>/log/*.  These actions may interfere with event collection, >/var/log/*.  These actions may interfere with event collecti
>reporting, or other notifications used to detect intrusion a>on, reporting, or other notifications used to detect intrusi
>ctivity. This that may compromise the integrity of security >on activity. This that may compromise the integrity of secur
>solutions by causing notable events to go unreported. This a>ity solutions by causing notable events to go unreported. Th
>ctivity may also impede forensic analysis and incident respo>is activity may also impede forensic analysis and incident r
>nse, due to lack of sufficient data to determine what occurr>esponse, due to lack of sufficient data to determine what oc
>ed.>curred.
Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-16 18:09:49.074000+00:002021-04-24 13:35:09.065000+00:00
descriptionAdversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/*. These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*. These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
x_mitre_data_sources[0]File monitoringProcess: Process Creation
x_mitre_data_sources[1]Process monitoringFile: File Deletion
x_mitre_data_sources[2]Process command-line parametersFile: File Modification
x_mitre_data_sources[3]API monitoringWindows Registry: Windows Registry Key Modification
x_mitre_data_sources[4]Windows event logsWindows Registry: Windows Registry Key Deletion
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsBrad Geesaman, @bradgeesaman
x_mitre_data_sourcesProcess: OS API Execution
x_mitre_data_sourcesCommand: Command Execution
x_mitre_data_sourcesNetwork Traffic: Network Traffic Content
x_mitre_data_sourcesUser Account: User Account Authentication
x_mitre_data_sourcesFile: File Metadata
x_mitre_platformsContainers

[T1534] Internal Spearphishing

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-17 18:26:41.796000+00:002021-04-14 14:32:14.273000+00:00
x_mitre_data_sources[0]SSL/TLS inspectionApplication Log: Application Log Content
x_mitre_data_sources[1]DNS recordsNetwork Traffic: Network Traffic Flow
x_mitre_data_sources[2]Anti-virusNetwork Traffic: Network Traffic Content
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesWeb proxy
x_mitre_data_sourcesFile monitoring
x_mitre_data_sourcesMail server
x_mitre_data_sourcesOffice 365 trace logs

[T1547.006] Boot or Logon Autostart Execution: Kernel Modules and Extensions

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may modify the kernel to automatically execute pt1Adversaries may modify the kernel to automatically execute p
>rograms on system boot. Loadable Kernel Modules (LKMs) are p>rograms on system boot. Loadable Kernel Modules (LKMs) are p
>ieces of code that can be loaded and unloaded into the kerne>ieces of code that can be loaded and unloaded into the kerne
>l upon demand. They extend the functionality of the kernel w>l upon demand. They extend the functionality of the kernel w
>ithout the need to reboot the system. For example, one type >ithout the need to reboot the system. For example, one type 
>of module is the device driver, which allows the kernel to a>of module is the device driver, which allows the kernel to a
>ccess hardware connected to the system. (Citation: Linux Ker>ccess hardware connected to the system. (Citation: Linux Ker
>nel Programming)   When used maliciously, LKMs can be a type>nel Programming)   When used maliciously, LKMs can be a type
> of kernel-mode [Rootkit](https://attack.mitre.org/technique> of kernel-mode [Rootkit](https://attack.mitre.org/technique
>s/T1014) that run with the highest operating system privileg>s/T1014) that run with the highest operating system privileg
>e (Ring 0). (Citation: Linux Kernel Module Programming Guide>e (Ring 0). (Citation: Linux Kernel Module Programming Guide
>) Common features of LKM based rootkits include: hiding itse>) Common features of LKM based rootkits include: hiding itse
>lf, selective hiding of files, processes and network activit>lf, selective hiding of files, processes and network activit
>y, as well as log tampering, providing authenticated backdoo>y, as well as log tampering, providing authenticated backdoo
>rs and enabling root access to non-privileged users. (Citati>rs and enabling root access to non-privileged users. (Citati
>on: iDefense Rootkit Overview)  Kernel extensions, also call>on: iDefense Rootkit Overview)  Kernel extensions, also call
>ed kext, are used for macOS to load functionality onto a sys>ed kext, are used for macOS to load functionality onto a sys
>tem similar to LKMs for Linux. They are loaded and unloaded >tem similar to LKMs for Linux. They are loaded and unloaded 
>through <code>kextload</code> and <code>kextunload</code> co>through <code>kextload</code> and <code>kextunload</code> co
>mmands.  Adversaries can use LKMs and kexts to covertly pers>mmands. Since macOS Catalina 10.15, kernel extensions have b
>ist on a system and elevate privileges. Examples have been f>een deprecated on macOS systems.(Citation: Apple Kernel Exte
>ound in the wild and there are some open source projects. (C>nsion Deprecation)  Adversaries can use LKMs and kexts to co
>itation: Volatility Phalanx2) (Citation: CrowdStrike Linux R>vertly persist on a system and elevate privileges. Examples 
>ootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorp>have been found in the wild and there are some open source p
>hine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Cit>rojects. (Citation: Volatility Phalanx2) (Citation: CrowdStr
>ation: Synack Secure Kernel Extension Broken)(Citation: Secu>ike Linux Rootkit) (Citation: GitHub Reptile) (Citation: Git
>relist Ventir) (Citation: Trend Micro Skidmap)>Hub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick W
 >ardle) (Citation: Synack Secure Kernel Extension Broken)(Cit
 >ation: Securelist Ventir) (Citation: Trend Micro Skidmap)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-06-30 21:23:15.188000+00:002021-03-30 00:59:53.716000+00:00
descriptionAdversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming)  When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview) Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming)  When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview) Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.(Citation: Apple Kernel Extension Deprecation) Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)
external_references[4]['source_name']Volatility Phalanx2Apple Kernel Extension Deprecation
external_references[4]['description']Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.Apple. (n.d.). Deprecated Kernel Extensions and System Extension Alternatives. Retrieved November 4, 2020.
external_references[4]['url']https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.htmlhttps://developer.apple.com/support/kernel-extensions/
external_references[5]['source_name']CrowdStrike Linux RootkitVolatility Phalanx2
external_references[5]['description']Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.
external_references[5]['url']https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html
external_references[6]['source_name']GitHub ReptileCrowdStrike Linux Rootkit
external_references[6]['description']Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018.Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.
external_references[6]['url']https://github.com/f0rb1dd3n/Reptilehttps://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
external_references[7]['source_name']GitHub DiamorphineGitHub Reptile
external_references[7]['description']Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018.
external_references[7]['url']https://github.com/m0nad/Diamorphinehttps://github.com/f0rb1dd3n/Reptile
external_references[8]['source_name']RSAC 2015 San Francisco Patrick WardleGitHub Diamorphine
external_references[8]['description']Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018.Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.
external_references[8]['url']https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdfhttps://github.com/m0nad/Diamorphine
external_references[9]['source_name']Synack Secure Kernel Extension BrokenRSAC 2015 San Francisco Patrick Wardle
external_references[9]['description']Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018.Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018.
external_references[9]['url']https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf
external_references[10]['source_name']Securelist VentirSynack Secure Kernel Extension Broken
external_references[10]['description']Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018.Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018.
external_references[10]['url']https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/
external_references[11]['source_name']Trend Micro SkidmapSecurelist Ventir
external_references[11]['description']Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018.
external_references[11]['url']https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/
external_references[12]['source_name']Linux Loadable Kernel Module Insert and Remove LKMsTrend Micro Skidmap
external_references[12]['description']Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018.Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.
external_references[12]['url']http://tldp.org/HOWTO/Module-HOWTO/x197.htmlhttps://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/
external_references[13]['source_name']Wikipedia Loadable Kernel ModuleLinux Loadable Kernel Module Insert and Remove LKMs
external_references[13]['description']Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018.
external_references[13]['url']https://en.wikipedia.org/wiki/Loadable_kernel_module#Linuxhttp://tldp.org/HOWTO/Module-HOWTO/x197.html
x_mitre_data_sources[0]Process monitoringCommand: Command Execution
x_mitre_data_sources[1]Process command-line parametersFile: File Creation
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Wikipedia Loadable Kernel Module', 'description': 'Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.', 'url': 'https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux'}
x_mitre_contributorsWayne Silva, F-Secure Countercept
x_mitre_data_sourcesKernel: Kernel Module Load

[T1087.001] Account Discovery: Local Account

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Daniel Stepanic, Elastic']
values_changed
STIX FieldOld valueNew Value
modified2020-03-20 19:39:59.544000+00:002021-04-13 21:39:08.728000+00:00
x_mitre_data_sources[0]API monitoringProcess: Process Creation
x_mitre_data_sources[1]Process monitoringCommand: Command Execution
x_mitre_data_sources[2]Process command-line parametersFile: File Access
x_mitre_detectionSystem and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'}

[T1078.003] Valid Accounts: Local Accounts

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-23 21:48:41.083000+00:002021-04-05 12:51:00.663000+00:00
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesLogon Session: Logon Session Creation
x_mitre_platformsContainers

[T1127.001] Trusted Developer Utilities Proxy Execution: MSBuild

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may use MSBuild to proxy execution of code throut1Adversaries may use MSBuild to proxy execution of code throu
>gh a trusted Windows utility. MSBuild.exe (Microsoft Build E>gh a trusted Windows utility. MSBuild.exe (Microsoft Build E
>ngine) is a software build platform used by Visual Studio. I>ngine) is a software build platform used by Visual Studio. I
>t handles XML formatted project files that define requiremen>t handles XML formatted project files that define requiremen
>ts for loading and building various platforms and configurat>ts for loading and building various platforms and configurat
>ions.(Citation: MSDN MSBuild)  Adversaries can abuse MSBuild>ions.(Citation: MSDN MSBuild)  Adversaries can abuse MSBuild
> to proxy execution of malicious code. The inline task capab> to proxy execution of malicious code. The inline task capab
>ility of MSBuild that was introduced in .NET version 4 allow>ility of MSBuild that was introduced in .NET version 4 allow
>s for C# code to be inserted into an XML project file.(Citat>s for C# or Visual Basic code to be inserted into an XML pro
>ion: MSDN MSBuild) MSBuild will compile and execute the inli>ject file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBui
>ne task. MSBuild.exe is a signed Microsoft binary, so when i>ld Inline Tasks 2017) MSBuild will compile and execute the i
>t is used this way it can execute arbitrary code and bypass >nline task. MSBuild.exe is a signed Microsoft binary, so whe
>application control defenses that are configured to allow MS>n it is used this way it can execute arbitrary code and bypa
>Build.exe execution.(Citation: LOLBAS Msbuild)>ss application control defenses that are configured to allow
 > MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Carrie Roberts, @OrOneEqualsOne']
values_changed
STIX FieldOld valueNew Value
modified2020-06-08 23:29:28.074000+00:002021-03-05 22:25:48.777000+00:00
descriptionAdversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file.(Citation: MSDN MSBuild) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
external_references[2]['source_name']LOLBAS MsbuildMicrosoft MSBuild Inline Tasks 2017
external_references[2]['description']LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.Microsoft. (2017, September 21). MSBuild inline tasks. Retrieved March 5, 2021.
external_references[2]['url']https://lolbas-project.github.io/lolbas/Binaries/Msbuild/https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-inline-tasks?view=vs-2019#code-element
x_mitre_data_sources[0]Process monitoringProcess: Process Creation
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'LOLBAS Msbuild', 'description': 'LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.', 'url': 'https://lolbas-project.github.io/lolbas/Binaries/Msbuild/'}
x_mitre_data_sourcesCommand: Command Execution

[T1587.001] Develop Capabilities: Malware

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Before compromising a victim, adversaries may develop malwart1Adversaries may develop malware and malware components that 
>and malware components that can be used during targeting. >can be used during targeting. Building malicious software ca
>Building malicious software can include the development of p>n include the development of payloads, droppers, post-compro
>ayloads, droppers, post-compromise tools, backdoors, packers>mise tools, backdoors (including backdoored images), packers
>, C2 protocols, and the creation of infected removable media>, C2 protocols, and the creation of infected removable media
>. Adversaries may develop malware to support their operation>. Adversaries may develop malware to support their operation
>s, creating a means for maintaining control of remote machin>s, creating a means for maintaining control of remote machin
>es, evading defenses, and executing post-compromise behavior>es, evading defenses, and executing post-compromise behavior
>s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita>s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita
>tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)  As>tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)  As
> with legitimate development efforts, different skill sets m> with legitimate development efforts, different skill sets m
>ay be required for developing malware. The skills needed may>ay be required for developing malware. The skills needed may
> be located in-house, or may need to be contracted out. Use > be located in-house, or may need to be contracted out. Use 
>of a contractor may be considered an extension of that adver>of a contractor may be considered an extension of that adver
>sary's malware development capabilities, provided the advers>sary's malware development capabilities, provided the advers
>ary plays a role in shaping requirements and maintains a deg>ary plays a role in shaping requirements and maintains a deg
>ree of exclusivity to the malware.  Some aspects of malware >ree of exclusivity to the malware.  Some aspects of malware 
>development, such as C2 protocol development, may require ad>development, such as C2 protocol development, may require ad
>versaries to obtain additional infrastructure. For example, >versaries to obtain additional infrastructure. For example, 
>malware developed that will communicate with Twitter for C2,>malware developed that will communicate with Twitter for C2,
> may require use of [Web Services](https://attack.mitre.org/> may require use of [Web Services](https://attack.mitre.org/
>techniques/T1583/006).(Citation: FireEye APT29)>techniques/T1583/006).(Citation: FireEye APT29)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-22 13:05:43.492000+00:002021-04-15 03:08:33.165000+00:00
descriptionBefore compromising a victim, adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors, packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
x_mitre_version1.01.1

[T1036] Masquerading

Current version: 1.4

Version changed from: 1.3 → 1.4

Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-09 13:54:28.727000+00:002021-04-24 13:24:45.840000+00:00
external_references[3]['source_name']Endgame Masquerade BallElastic Masquerade Ball
x_mitre_data_sources[0]Process command-line parametersImage: Image Metadata
x_mitre_data_sources[1]File monitoringCommand: Command Execution
x_mitre_data_sources[2]Process monitoringService: Service Metadata
x_mitre_data_sources[3]Binary file metadataService: Service Creation
x_mitre_detectionCollect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”.Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”.
x_mitre_version1.31.4
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesScheduled Job: Scheduled Job Metadata
x_mitre_data_sourcesScheduled Job: Scheduled Job Modification
x_mitre_data_sourcesFile: File Metadata
x_mitre_data_sourcesProcess: Process Metadata
x_mitre_data_sourcesFile: File Modification
x_mitre_platformsContainers

[T1036.005] Masquerading: Match Legitimate Name or Location

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may match or approximate the name or location oft1Adversaries may match or approximate the name or location of
> legitimate files when naming/placing their files. This is d> legitimate files or resources when naming/placing them. Thi
>one for the sake of evading defenses and observation. This m>s is done for the sake of evading defenses and observation. 
>ay be done by placing an executable in a commonly trusted di>This may be done by placing an executable in a commonly trus
>rectory (ex: under System32) or giving it the name of a legi>ted directory (ex: under System32) or giving it the name of 
>timate, trusted program (ex: svchost.exe). Alternatively, th>a legitimate, trusted program (ex: svchost.exe). In containe
>e filename given may be a close approximation of legitimate >rized environments, this may also be done by creating a reso
>programs or something innocuous.  Adversaries may also use t>urce in a namespace that matches the naming convention of a 
>he same icon of the file they are trying to mimic.>container pod or cluster. Alternatively, a file or container
 > image name given may be a close approximation to legitimate
 > programs/images or something innocuous.  Adversaries may al
 >so use the same icon of the file they are trying to mimic.
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Yossi Weizman, Azure Defender Research Team', 'Vishwas Manral, McAfee']
values_changed
STIX FieldOld valueNew Value
modified2020-06-20 22:11:45.970000+00:002021-04-20 19:23:37.762000+00:00
descriptionAdversaries may match or approximate the name or location of legitimate files when naming/placing their files. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous. Adversaries may also use the same icon of the file they are trying to mimic.Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous. Adversaries may also use the same icon of the file they are trying to mimic.
external_references[2]['source_name']Endgame Masquerade BallElastic Masquerade Ball
x_mitre_data_sources[0]File monitoringImage: Image Metadata
x_mitre_data_sources[1]Process monitoringFile: File Metadata
x_mitre_data_sources[2]Process command-line parametersProcess: Process Metadata
x_mitre_detectionCollect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect. If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Docker Images', 'description': 'Docker. (n.d.). Docker Images. Retrieved April 6, 2021.', 'url': 'https://docs.docker.com/engine/reference/commandline/images/'}
x_mitre_platformsContainers
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesBinary file metadata

[T1578] Modify Cloud Compute Infrastructure

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:55:23.798000+00:002021-04-20 14:51:01.759000+00:00
x_mitre_data_sources[0]Stackdriver logsInstance: Instance Stop
x_mitre_data_sources[1]GCP audit logsInstance: Instance Start
x_mitre_data_sources[2]Azure activity logsInstance: Instance Creation
x_mitre_data_sources[3]AWS CloudTrail logsInstance: Instance Modification
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesInstance: Instance Deletion
x_mitre_data_sourcesSnapshot: Snapshot Creation
x_mitre_data_sourcesSnapshot: Snapshot Modification
x_mitre_data_sourcesSnapshot: Snapshot Deletion
x_mitre_data_sourcesVolume: Volume Creation
x_mitre_data_sourcesVolume: Volume Modification
x_mitre_data_sourcesVolume: Volume Deletion
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1218.007] Signed Binary Proxy Execution: Msiexec

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may abuse msiexec.exe to proxy execution of malit1Adversaries may abuse msiexec.exe to proxy execution of mali
>cious payloads. Msiexec.exe is the command-line utility for >cious payloads. Msiexec.exe is the command-line utility for 
>the Windows Installer and is thus commonly associated with e>the Windows Installer and is thus commonly associated with e
>xecuting installation packages (.msi).(Citation: Microsoft m>xecuting installation packages (.msi).(Citation: Microsoft m
>siexec) Msiexec.exe is digitally signed by Microsoft.  Adver>siexec) Msiexec.exe is digitally signed by Microsoft.  Adver
>saries may abuse msiexec.exe to launch local or network acce>saries may abuse msiexec.exe to launch local or network acce
>ssible MSI files. Msiexec.exe can also execute DLLs.(Citatio>ssible MSI files. Msiexec.exe can also execute DLLs.(Citatio
>n: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Si>n: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Si
>nce it is signed and native on Windows systems, msiexec.exe >nce it is signed and native on Windows systems, msiexec.exe 
>can be used to bypass application control solutions that do >can be used to bypass application control solutions that do 
>not account for its potential abuse.>not account for its potential abuse. Msiexec.exe execution m
 >ay also be elevated to SYSTEM privileges if the <code>Always
 >InstallElevated</code> policy is enabled.(Citation: Microsof
 >t AlwaysInstallElevated 2018)

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Alexandros Pappas']
values_changed
STIX FieldOld valueNew Value
modified2020-06-20 22:38:14.154000+00:002020-12-14 18:40:45.170000+00:00
descriptionAdversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018)
x_mitre_data_sources[0]DLL monitoringProcess: Process Creation
x_mitre_data_sources[1]Process command-line parametersModule: Module Load
x_mitre_data_sources[2]Process monitoringCommand: Command Execution
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft AlwaysInstallElevated 2018', 'description': 'Microsoft. (2018, May 31). AlwaysInstallElevated. Retrieved December 14, 2020.', 'url': 'https://docs.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated'}
x_mitre_data_sourcesNetwork Traffic: Network Connection Creation

[T1498] Network Denial of Service

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Yossi Weizman, Azure Defender Research Team', 'Vishwas Manral, McAfee']
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:58:18.788000+00:002021-04-12 18:34:06.995000+00:00
x_mitre_data_sources[0]Sensor health and statusSensor Health: Host Status
x_mitre_data_sources[1]Network protocol analysisNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]Azure ADLinux
x_mitre_platforms[6]SaaSmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_platforms[8]Office 365Containers
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetflow/Enclave netflow
x_mitre_data_sourcesNetwork intrusion detection system
x_mitre_data_sourcesNetwork device logs

[T1046] Network Service Scanning

Current version: 2.2

Version changed from: 2.1 → 2.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-11 19:55:53.828000+00:002021-04-09 14:56:26.562000+00:00
x_mitre_data_sources[0]Netflow/Enclave netflowCommand: Command Execution
x_mitre_data_sources[1]Network protocol analysisCloud Service: Cloud Service Enumeration
x_mitre_data_sources[2]Packet captureNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]WindowsIaaS
x_mitre_platforms[2]macOSLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_platforms[4]GCPContainers
x_mitre_version2.12.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess command-line parameters
x_mitre_data_sourcesProcess use of network
x_mitre_platformsAzure

[T1040] Network Sniffing

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 21:03:49.610000+00:002021-04-02 17:51:59.236000+00:00
x_mitre_data_sources[0]Network device logsProcess: Process Creation
x_mitre_data_sources[1]Host network interfaceCommand: Command Execution
x_mitre_detectionDetecting the events leading up to sniffing network traffic may be the best method of detection. From the host level, an adversary would likely need to perform a man-in-the-middle attack against other devices on a wired network in order to capture traffic that was not to or from the current compromised system. This change in the flow of information is detectable at the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network devices is a bit more challenging. Auditing administrator logins, configuration changes, and device images is required to detect malicious changes.Detecting the events leading up to sniffing network traffic may be the best method of detection. From the host level, an adversary would likely need to perform a [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) attack against other devices on a wired network in order to capture traffic that was not to or from the current compromised system. This change in the flow of information is detectable at the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network devices is a bit more challenging. Auditing administrator logins, configuration changes, and device images is required to detect malicious changes.
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsNetwork
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetflow/Enclave netflow
x_mitre_data_sourcesProcess monitoring

[T1550.002] Use Alternate Authentication Material: Pass the Hash

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may “pass the hash” using stolen password hashest1Adversaries may “pass the hash” using stolen password hashes
> to move laterally within an environment, bypassing normal s> to move laterally within an environment, bypassing normal s
>ystem access controls. Pass the hash (PtH) is a method of au>ystem access controls. Pass the hash (PtH) is a method of au
>thenticating as a user without having access to the user's c>thenticating as a user without having access to the user's c
>leartext password. This method bypasses standard authenticat>leartext password. This method bypasses standard authenticat
>ion steps that require a cleartext password, moving directly>ion steps that require a cleartext password, moving directly
> into the portion of the authentication that uses the passwo> into the portion of the authentication that uses the passwo
>rd hash. In this technique, valid password hashes for the ac>rd hash.  When performing PtH, valid password hashes for the
>count being used are captured using a Credential Access tech> account being used are captured using a [Credential Access]
>nique. Captured hashes are used with PtH to authenticate as >(https://attack.mitre.org/tactics/TA0006) technique. Capture
>that user. Once authenticated, PtH may be used to perform ac>d hashes are used with PtH to authenticate as that user. Onc
>tions on local or remote systems.  Windows 7 and higher with>e authenticated, PtH may be used to perform actions on local
> KB2871997 require valid domain user credentials or RID 500 > or remote systems.  Adversaries may also use stolen passwor
>administrator hashes.(Citation: NSA Spotting)>d hashes to "overpass the hash." Similar to PtH, this involv
 >es using a password hash to authenticate as a user but also 
 >uses the password hash to create a valid Kerberos ticket. Th
 >is ticket can then be used to perform [Pass the Ticket](http
 >s://attack.mitre.org/techniques/T1550/003) attacks.(Citation
 >: Stealthbits Overpass-the-Hash)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-23 16:24:34.766000+00:002021-03-15 21:04:33.228000+00:00
descriptionAdversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems. Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.(Citation: NSA Spotting)Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems. Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks.(Citation: Stealthbits Overpass-the-Hash)
external_references[2]['source_name']NSA SpottingStealthbits Overpass-the-Hash
external_references[2]['description']National Security Agency/Central Security Service Information Assurance Directorate. (2015, August 7). Spotting the Adversary with Windows Event Log Monitoring. Retrieved September 6, 2018.Warren, J. (2019, February 26). How to Detect Overpass-the-Hash Attacks. Retrieved February 4, 2021.
external_references[2]['url']https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfmhttps://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_detectionAudit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious.Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious. Event ID 4768 and 4769 will also be generated on the Domain Controller when a user requests a new ticket granting ticket or service ticket. These events combined with the above activity may be indicative of an overpass the hash attempt.(Citation: Stealthbits Overpass-the-Hash)
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsBlake Strom, Microsoft 365 Defender
x_mitre_data_sourcesLogon Session: Logon Session Creation
x_mitre_data_sourcesActive Directory: Active Directory Credential Request

[T1550.003] Use Alternate Authentication Material: Pass the Ticket

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may “pass the ticket” using stolen Kerberos tickt1Adversaries may “pass the ticket” using stolen Kerberos tick
>ets to move laterally within an environment, bypassing norma>ets to move laterally within an environment, bypassing norma
>l system access controls. Pass the ticket (PtT) is a method >l system access controls. Pass the ticket (PtT) is a method 
>of authenticating to a system using Kerberos tickets without>of authenticating to a system using Kerberos tickets without
> having access to an account's password. Kerberos authentica> having access to an account's password. Kerberos authentica
>tion can be used as the first step to lateral movement to a >tion can be used as the first step to lateral movement to a 
>remote system.  In this technique, valid Kerberos tickets fo>remote system.  When preforming PtT, valid Kerberos tickets 
>r [Valid Accounts](https://attack.mitre.org/techniques/T1078>for [Valid Accounts](https://attack.mitre.org/techniques/T10
>) are captured by [OS Credential Dumping](https://attack.mit>78) are captured by [OS Credential Dumping](https://attack.m
>re.org/techniques/T1003). A user's service tickets or ticket>itre.org/techniques/T1003). A user's service tickets or tick
> granting ticket (TGT) may be obtained, depending on the lev>et granting ticket (TGT) may be obtained, depending on the l
>el of access. A service ticket allows for access to a partic>evel of access. A service ticket allows for access to a part
>ular resource, whereas a TGT can be used to request service >icular resource, whereas a TGT can be used to request servic
>tickets from the Ticket Granting Service (TGS) to access any>e tickets from the Ticket Granting Service (TGS) to access a
> resource the user has privileges to access.(Citation: ADSec>ny resource the user has privileges to access.(Citation: ADS
>urity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Tic>ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T
>ket)  [Silver Ticket](https://attack.mitre.org/techniques/T1>icket)  A [Silver Ticket](https://attack.mitre.org/technique
>558/002) can be obtained for services that use Kerberos as a>s/T1558/002) can be obtained for services that use Kerberos 
>n authentication mechanism and are used to generate tickets >as an authentication mechanism and are used to generate tick
>to access that particular resource and the system that hosts>ets to access that particular resource and the system that h
> the resource (e.g., SharePoint).(Citation: ADSecurity AD Ke>osts the resource (e.g., SharePoint).(Citation: ADSecurity A
>rberos Attacks)  [Golden Ticket](https://attack.mitre.org/te>D Kerberos Attacks)  A [Golden Ticket](https://attack.mitre.
>chniques/T1558/001) can be obtained for the domain using the>org/techniques/T1558/001) can be obtained for the domain usi
> Key Distribution Service account KRBTGT account NTLM hash, >ng the Key Distribution Service account KRBTGT account NTLM 
>which enables generation of TGTs for any account in Active D>hash, which enables generation of TGTs for any account in Ac
>irectory.(Citation: Campbell 2014)>tive Directory.(Citation: Campbell 2014)  Adversaries may al
 >so create a valid Kerberos ticket using other user informati
 >on, such as stolen password hashes or AES keys. For example,
 > "overpassing the hash" involves using a NTLM password hash 
 >to authenticate as a user (i.e. [Pass the Hash](https://atta
 >ck.mitre.org/techniques/T1550/002)) while also using the pas
 >sword hash to create a valid Kerberos ticket.(Citation: Stea
 >lthbits Overpass-the-Hash)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-12 17:03:16.122000+00:002021-03-15 21:42:11.839000+00:00
descriptionAdversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014)Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket) A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks) A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014) Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash)
external_references[5]['source_name']CERT-EU Golden Ticket ProtectionStealthbits Overpass-the-Hash
external_references[5]['description']Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.Warren, J. (2019, February 26). How to Detect Overpass-the-Hash Attacks. Retrieved February 4, 2021.
external_references[5]['url']https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdfhttps://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'CERT-EU Golden Ticket Protection', 'description': 'Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.', 'url': 'https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf'}
x_mitre_data_sourcesLogon Session: Logon Session Creation
x_mitre_data_sourcesActive Directory: Active Directory Credential Request

[T1110.001] Brute Force: Password Guessing

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 22:43:45.126000+00:002021-04-21 16:41:35.269000+00:00
external_references[2]['url']https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdfhttps://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_data_sources[1]Office 365 account logsApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]Office 365SaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]Azure ADLinux
x_mitre_platforms[6]AWSmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_platforms[8]SaaSContainers
x_mitre_version1.11.2

[T1110.003] Brute Force: Password Spraying

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-19 22:43:45.579000+00:002021-04-06 12:32:47.678000+00:00
x_mitre_data_sources[0]Authentication logsUser Account: User Account Authentication
x_mitre_data_sources[1]Office 365 account logsApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_platforms[8]SaaSContainers
x_mitre_version1.11.2

[T1069] Permission Groups Discovery

Current version: 2.3

Version changed from: 2.2 → 2.3

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-08 17:36:01.675000+00:002021-03-30 12:29:56.512000+00:00
x_mitre_data_sources[0]Stackdriver logsProcess: Process Creation
x_mitre_data_sources[1]GCP audit logsCommand: Command Execution
x_mitre_data_sources[2]AWS CloudTrail logsGroup: Group Enumeration
x_mitre_data_sources[3]Azure activity logsGroup: Group Metadata
x_mitre_data_sources[4]Office 365 account logsApplication Log: Application Log Content
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]Office 365SaaS
x_mitre_platforms[4]Azure ADIaaS
x_mitre_platforms[5]AWSLinux
x_mitre_platforms[6]GCPmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_version2.22.3
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAPI monitoring
x_mitre_data_sourcesProcess monitoring
x_mitre_data_sourcesProcess command-line parameters
x_mitre_platformsSaaS

[T1566] Phishing

Current version: 2.1

Version changed from: 2.0 → 2.1


Old Description
New Description
t1Adversaries may send phishing messages to gain access to vict1Adversaries may send phishing messages to gain access to vic
>tim systems. All forms of phishing are electronically delive>tim systems. All forms of phishing are electronically delive
>red social engineering. Phishing can be targeted, known as s>red social engineering. Phishing can be targeted, known as s
>pearphishing. In spearphishing, a specific individual, compa>pearphishing. In spearphishing, a specific individual, compa
>ny, or industry will be targeted by the adversary. More gene>ny, or industry will be targeted by the adversary. More gene
>rally, adversaries can conduct non-targeted phishing, such a>rally, adversaries can conduct non-targeted phishing, such a
>s in mass malware spam campaigns.  Adversaries may send vict>s in mass malware spam campaigns.  Adversaries may send vict
>ims emails containing malicious attachments or links, typica>ims emails containing malicious attachments or links, typica
>lly to execute malicious code on victim systems or to gather>lly to execute malicious code on victim systems. Phishing ma
> credentials for use of [Valid Accounts](https://attack.mitr>y also be conducted via third-party services, like social me
>e.org/techniques/T1078). Phishing may also be conducted via >dia platforms. Phishing may also involve social engineering 
>third-party services, like social media platforms.>techniques, such as posing as a trusted source.

New Mitigations:

Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['Philip Winther']
values_changed
STIX FieldOld valueNew Value
modified2020-10-18 01:55:03.337000+00:002021-04-14 14:38:43.211000+00:00
descriptionAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems or to gather credentials for use of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Phishing may also be conducted via third-party services, like social media platforms.Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source.
x_mitre_data_sources[0]File monitoringApplication Log: Application Log Content
x_mitre_data_sources[1]Packet captureNetwork Traffic: Network Traffic Flow
x_mitre_data_sources[2]Web proxyNetwork Traffic: Network Traffic Content
x_mitre_detectionNetwork intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems. URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware. Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.Network intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware. Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs.
x_mitre_version2.02.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Microsoft Anti Spoofing', 'description': 'Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.', 'url': 'https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide'}
external_references{'source_name': 'ACSC Email Spoofing', 'description': 'Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.', 'url': 'https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf'}
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesEmail gateway
x_mitre_data_sourcesMail server
x_mitre_data_sourcesNetwork intrusion detection system
x_mitre_data_sourcesDetonation chamber
x_mitre_data_sourcesSSL/TLS inspection
x_mitre_data_sourcesAnti-virus

[T1598] Phishing for Information

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Before compromising a victimadversaries masend phishing t1Adversaries may send phishing messages to elicit sensitive i
>messages to elicit sensitive information that can be used du>nformation that can be used during targeting. Phishing for i
>ring targeting. Phishing for information is an attempt to tr>nformation is an attempt to trick targets into divulging inf
>ick targets into divulging information, frequently credentia>ormationfrequentlcredentials or other actionable informa
>ls or other actionable information. Phishing for information>tion. Phishing for information is different from [Phishing](
> is different from [Phishing](https://attack.mitre.org/techn>https://attack.mitre.org/techniques/T1566) in that the objec
>iques/T1566) in that the objective is gathering data from th>tive is gathering data from the victim rather than executing
>e victim rather than executing malicious code.  All forms of> malicious code.  All forms of phishing are electronically d
> phishing are electronically delivered social engineering. P>elivered social engineering. Phishing can be targeted, known
>hishing can be targeted, known as spearphishing. In spearphi> as spearphishing. In spearphishing, a specific individual, 
>shing, a specific individual, company, or industry will be t>company, or industry will be targeted by the adversary. More
>argeted by the adversary. More generally, adversaries can co> generally, adversaries can conduct non-targeted phishing, s
>nduct non-targeted phishing, such as in mass credential harv>uch as in mass credential harvesting campaigns.  Adversaries
>esting campaigns.  Adversaries may also try to obtain inform> may also try to obtain information directly through the exc
>ation directly through the exchange of emails, instant messa>hange of emails, instant messages, or other electronic conve
>ges, or other electronic conversation means.(Citation: Threa>rsation means.(Citation: ThreatPost Social Media Phishing)(C
>tPost Social Media Phishing)(Citation: TrendMictro Phishing)>itation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Ci
>(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Cit>tation: Sophos Attachment)(Citation: GitHub Phishery) Phishi
>ation: GitHub Phishery) Phishing for information frequently >ng for information frequently involves social engineering te
>involves social engineering techniques, such as posing as a >chniques, such as posing as a source with a reason to collec
>source with a reason to collect information (ex: [Establish >t information (ex: [Establish Accounts](https://attack.mitre
>Accounts](https://attack.mitre.org/techniques/T1585) or [Com>.org/techniques/T1585) or [Compromise Accounts](https://atta
>promise Accounts](https://attack.mitre.org/techniques/T1586)>ck.mitre.org/techniques/T1586)) and/or sending multiple, see
>) and/or sending multiple, seemingly urgent messages.>mingly urgent messages.

New Mitigations:

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-25 19:44:58.292000+00:002021-04-15 03:43:13.134000+00:00
descriptionBefore compromising a victim, adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns. Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
x_mitre_data_sources[0]Social media monitoringApplication Log: Application Log Content
x_mitre_data_sources[1]Mail serverNetwork Traffic: Network Traffic Flow
x_mitre_data_sources[2]Email gatewayNetwork Traffic: Network Traffic Content
x_mitre_detectionDepending on the specific method of spearphishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Also consider enabling DMARC to verify the sender of emails.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites. Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing) When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites. Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_contributorsPhilip Winther

[T1498.002] Network Denial of Service: Reflection Amplification

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:58:18.490000+00:002021-03-29 16:13:53.747000+00:00
x_mitre_data_sources[0]Sensor health and statusSensor Health: Host Status
x_mitre_data_sources[1]Network protocol analysisNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]macOSWindows
x_mitre_platforms[1]WindowsAzure AD
x_mitre_platforms[2]LinuxOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]Office 365IaaS
x_mitre_platforms[5]Azure ADLinux
x_mitre_platforms[6]GCPmacOS
x_mitre_platforms[7]AzureGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetflow/Enclave netflow
x_mitre_data_sourcesNetwork intrusion detection system
x_mitre_data_sourcesNetwork device logs
x_mitre_platformsSaaS

[T1074.002] Data Staged: Remote Data Staging

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-14 19:48:07.491000+00:002021-03-08 10:33:02.019000+00:00
x_mitre_data_sources[0]Process command-line parametersFile: File Access
x_mitre_data_sources[1]Process monitoringFile: File Creation
x_mitre_data_sources[2]File monitoringCommand: Command Execution
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1114.002] Email Collection: Remote Email Collection

Current version: 1.1

Version changed from: 1.0 → 1.1


Old Description
New Description
t1Adversaries may target an Exchange server or Office 365 to ct1Adversaries may target an Exchange server, Office 365, or Go
>ollect sensitive information. Adversaries may leverage a use>ogle Workspace to collect sensitive information. Adversaries
>r's credentials and interact directly with the Exchange serv> may leverage a user's credentials and interact directly wit
>er to acquire information from within a network. Adversaries>h the Exchange server to acquire information from within a n
> may also access externally facing Exchange services or Offi>etwork. Adversaries may also access externally facing Exchan
>ce 365 to access email using credentials or access tokens. T>ge services, Office 365, or Google Workspace to access email
>ools such as [MailSniper](https://attack.mitre.org/software/> using credentials or access tokens. Tools such as [MailSnip
>S0413) can be used to automate searches for specific keyword>er](https://attack.mitre.org/software/S0413) can be used to 
>s.>automate searches for specific keywords.
Details
values_changed
STIX FieldOld valueNew Value
modified2020-02-19 20:53:50.908000+00:002021-03-25 13:12:56.909000+00:00
descriptionAdversaries may target an Exchange server or Office 365 to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services or Office 365 to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
x_mitre_data_sources[0]Authentication logsNetwork Traffic: Network Connection Creation
x_mitre_data_sources[1]Email gatewayLogon Session: Logon Session Creation
x_mitre_data_sources[2]Mail serverCommand: Command Execution
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_platformsGoogle Workspace
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesOffice 365 trace logs

[T1018] Remote System Discovery

Current version: 3.1

Version changed from: 3.0 → 3.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-17 12:26:53.669000+00:002021-04-13 21:40:23.368000+00:00
x_mitre_data_sources[0]Network protocol analysisProcess: Process Creation
x_mitre_data_sources[1]Process monitoringCommand: Command Execution
x_mitre_data_sources[2]Process use of networkNetwork Traffic: Network Connection Creation
x_mitre_data_sources[3]Process command-line parametersFile: File Access
x_mitre_detectionSystem and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained. Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). Monitor for processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL)
x_mitre_version3.03.1
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'}
x_mitre_contributorsDaniel Stepanic, Elastic

[T1496] Resource Hijacking

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may leverage the resources of co-opted systems it1Adversaries may leverage the resources of co-opted systems i
>n order to solve resource intensive problems which may impac>n order to solve resource intensive problems which may impac
>t system and/or hosted service availability.   One common pu>t system and/or hosted service availability.   One common pu
>rpose for Resource Hijacking is to validate transactions of >rpose for Resource Hijacking is to validate transactions of 
>cryptocurrency networks and earn virtual currency. Adversari>cryptocurrency networks and earn virtual currency. Adversari
>es may consume enough system resources to negatively impact >es may consume enough system resources to negatively impact 
>and/or cause affected machines to become unresponsive.(Citat>and/or cause affected machines to become unresponsive.(Citat
>ion: Kaspersky Lazarus Under The Hood Blog 2017) Servers and>ion: Kaspersky Lazarus Under The Hood Blog 2017) Servers and
> cloud-based(Citation: CloudSploit - Unused AWS Regions) sys> cloud-based(Citation: CloudSploit - Unused AWS Regions) sys
>tems are common targets because of the high potential for av>tems are common targets because of the high potential for av
>ailable resources, but user endpoint systems may also be com>ailable resources, but user endpoint systems may also be com
>promised and used for Resource Hijacking and cryptocurrency >promised and used for Resource Hijacking and cryptocurrency 
>mining.>mining. Containerized environments may also be targeted due 
 >to the ease of deployment via exposed APIs and the potential
 > for scaling mining activities by deploying or compromising 
 >multiple containers within an environment or cluster.(Citati
 >on: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed
 > Docker APIs)  Additionally, some cryptocurrency mining malw
 >are kills off processes for competing malware to ensure it’s
 > not competing for resources.(Citation: Trend Micro War of C
 >rypto Miners)
Details
dictionary_item_added
STIX FieldOld valueNew Value
x_mitre_contributors['David Fiser, @anu4is, Trend Micro', 'Alfredo Oliveira, Trend Micro', 'Jay Chen, Palo Alto Networks', 'Magno Logan, @magnologan, Trend Micro', 'Vishwas Manral, McAfee', 'Yossi Weizman, Azure Defender Research Team']
values_changed
STIX FieldOld valueNew Value
modified2020-07-14 19:29:17.574000+00:002021-04-14 12:06:32.187000+00:00
descriptionAdversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit - Unused AWS Regions) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit - Unused AWS Regions) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware kills off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
x_mitre_data_sources[0]Azure activity logsProcess: Process Creation
x_mitre_data_sources[1]Stackdriver logsCommand: Command Execution
x_mitre_data_sources[2]AWS CloudTrail logsFile: File Creation
x_mitre_data_sources[3]Process use of networkNetwork Traffic: Network Connection Creation
x_mitre_data_sources[4]Process monitoringNetwork Traffic: Network Traffic Flow
x_mitre_data_sources[5]Network protocol analysisSensor Health: Host Status
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSIaaS
x_mitre_platforms[2]WindowsLinux
x_mitre_platforms[3]AWSmacOS
x_mitre_platforms[4]GCPContainers
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
external_references{'source_name': 'Unit 42 Hildegard Malware', 'description': 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.', 'url': 'https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/'}
external_references{'source_name': 'Trend Micro Exposed Docker APIs', 'description': 'Oliveira, A. (2019, May 30). Infected Containers Target Docker via Exposed APIs. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html'}
external_references{'source_name': 'Trend Micro War of Crypto Miners', 'description': 'Oliveira, A., Fiser, D. (2020, September 10). War of Linux Cryptocurrency Miners: A Battle for Resources. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html'}
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesNetwork device logs
x_mitre_platformsAzure

[T1578.004] Modify Cloud Compute Infrastructure: Revert Cloud Instance

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-06-17 17:36:24.531000+00:002021-03-08 10:33:02.128000+00:00
x_mitre_data_sources[0]Stackdriver logsInstance: Instance Modification
x_mitre_data_sources[1]GCP audit logsInstance: Instance Start
x_mitre_data_sources[2]Azure activity logsInstance: Instance Stop
x_mitre_platforms[0]AWSIaaS
x_mitre_version1.01.1
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesAWS CloudTrail logs
x_mitre_platformsGCP
x_mitre_platformsAzure

[T1606.002] Forge Web Credentials: SAML Tokens

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2021-01-22 21:07:42.451000+00:002021-04-14 14:29:27.290000+00:00
x_mitre_data_sources[0]Windows event logsLogon Session: Logon Session Creation
x_mitre_data_sources[1]Authentication logsWeb Credential: Web Credential Creation
x_mitre_version1.01.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesWeb Credential: Web Credential Usage
x_mitre_platformsGoogle Workspace

[T1053] Scheduled Task/Job

Current version: 2.1

Version changed from: 2.0 → 2.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-10-14 15:20:01.069000+00:002021-04-20 16:31:11.405000+00:00
x_mitre_data_sources[0]File monitoringFile: File Creation
x_mitre_data_sources[1]Process monitoringContainer: Container Creation
x_mitre_data_sources[2]Process command-line parametersScheduled Job: Scheduled Job Creation
x_mitre_data_sources[3]Windows event logsCommand: Command Execution
x_mitre_version2.02.1
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesFile: File Modification
x_mitre_data_sourcesProcess: Process Creation
x_mitre_platformsContainers

[T1518.001] Software Discovery: Security Software Discovery

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 19:36:16.978000+00:002021-03-29 16:05:00.198000+00:00
x_mitre_data_sources[0]Stackdriver logsFirewall: Firewall Metadata
x_mitre_data_sources[1]Azure activity logsFirewall: Firewall Enumeration
x_mitre_data_sources[2]AWS CloudTrail logsProcess: Process Creation
x_mitre_data_sources[3]File monitoringCommand: Command Execution
x_mitre_data_sources[4]Process monitoringProcess: OS API Execution
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesProcess command-line parameters
x_mitre_platformsSaaS

[T1499.002] Endpoint Denial of Service: Service Exhaustion Flood

Current version: 1.2

Version changed from: 1.1 → 1.2

Details
values_changed
STIX FieldOld valueNew Value
modified2020-09-16 15:56:03.131000+00:002021-03-29 16:11:12.815000+00:00
x_mitre_data_sources[0]Netflow/Enclave netflowSensor Health: Host Status
x_mitre_data_sources[1]Network device logsApplication Log: Application Log Content
x_mitre_data_sources[2]Network intrusion detection systemNetwork Traffic: Network Traffic Content
x_mitre_data_sources[3]Web application firewall logsNetwork Traffic: Network Traffic Flow
x_mitre_platforms[0]LinuxWindows
x_mitre_platforms[1]macOSAzure AD
x_mitre_platforms[2]WindowsOffice 365
x_mitre_platforms[3]AWSSaaS
x_mitre_platforms[4]GCPIaaS
x_mitre_platforms[5]AzureLinux
x_mitre_platforms[6]Office 365macOS
x_mitre_platforms[7]Azure ADGoogle Workspace
x_mitre_version1.11.2
iterable_item_removed
STIX FieldOld valueNew Value
x_mitre_data_sourcesWeb logs
x_mitre_data_sourcesSSL/TLS inspection
x_mitre_platformsSaaS

[T1489] Service Stop

Current version: 1.2

Version changed from: 1.1 → 1.2


Old Description
New Description
t1Adversaries may stop or disable services on a system to rendt1Adversaries may stop or disable services on a system to rend
>er those services unavailable to legitimate users. Stopping >er those services unavailable to legitimate users. Stopping 
>critical services can inhibit or stop response to an inciden>critical services or processes can inhibit or stop response 
>t or aid in the adversary's overall objectives to cause dama>to an incident or aid in the adversary's overall objectives 
>ge to the environment.(Citation: Talos Olympic Destroyer 201>to cause damage to the environment.(Citation: Talos Olympic 
>8)(Citation: Novetta Blockbuster)   Adversaries may accompli>Destroyer 2018)(Citation: Novetta Blockbuster)   Adversaries
>sh this by disabling individual services of high importance > may accomplish this by disabling individual services of hig
>to an organization, such as <code>MSExchangeIS</code>, which>h importance to an organization, such as <code>MSExchangeIS<
> will make Exchange content inaccessible (Citation: Novetta >/code>, which will make Exchange content inaccessible (Citat
>Blockbuster). In some cases, adversaries may stop or disable>ion: Novetta Blockbuster). In some cases, adversaries may st
> many or all services to render systems unusable.(Citation: >op or disable many or all services to render systems unusabl
>Talos Olympic Destroyer 2018) Services may not allow for mod>e.(Citation: Talos Olympic Destroyer 2018) Services or proce
>ification of their data stores while running. Adversaries ma>sses may not allow for modification of their data stores whi
>y stop services in order to conduct [Data Destruction](https>le running. Adversaries may stop services or processes in or
>://attack.mitre.org/techniques/T1485) or [Data Encrypted for>der to conduct [Data Destruction](https://attack.mitre.org/t
> Impact](https://attack.mitre.org/techniques/T1486) on the d>echniques/T1485) or [Data Encrypted for Impact](https://atta
>ata stores of services like Exchange and SQL Server.(Citatio>ck.mitre.org/techniques/T1486) on the data stores of service
>n: SecureWorks WannaCry Analysis)>s like Exchange and SQL Server.(Citation: SecureWorks WannaC
 >ry Analysis)
Details
values_changed
STIX FieldOld valueNew Value
modified2020-07-24 15:36:08.042000+00:002021-03-02 22:11:32.017000+00:00
descriptionAdversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis)
x_mitre_data_sources[0]File monitoringProcess: Process Creation
x_mitre_data_sources[1]Process command-line parametersCommand: Command Execution
x_mitre_data_sources[2]Process monitoringProcess: OS API Execution
x_mitre_data_sources[3]Windows RegistryService: Service Metadata
x_mitre_data_sources[4]API monitoringWindows Registry: Windows Registry Key Modification
x_mitre_version1.11.2
iterable_item_added
STIX FieldOld valueNew Value
x_mitre_data_sourcesFile: File Modification
x_mitre_data_sourcesProcess: Process Termination

[T1547.009] Boot or Logon Autostart Execution: Shortcut Modification

Current version: 1.1

Version changed from: 1.0 → 1.1

Details
values_changed
STIX FieldOld valueNew Value
modified2020-03-25 17:21:27.487000+00:002021-04-13 21:30:24.555000+00:00
x_mitre_data_sources[0]File monitoringFile: File Creation
x_mitre_d