These ATT&CK Navigator layer files can be uploaded to ATT&CK Navigator manually.
New Techniques
[T1547.014] Boot or Logon Autostart Execution: Active Setup
Current version: 1.0
Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.
Adversaries may abuse Active Setup by creating a key under HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016)
Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
[T1612] Build Image on Host
Current version: 1.0
Description: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)
An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.
[T1553.006] Subvert Trust Controls: Code Signing Policy Modification
Current version: 1.0
Description: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.
Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.(Citation: Microsoft DSE June 2017)(Citation: Apple Disable SIP) Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system. Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.(Citation: Microsoft Unsigned Driver Apr 2017)(Citation: Apple Disable SIP)
Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, [Modify Registry](https://attack.mitre.org/techniques/T1112), rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP)(Citation: FireEye HIKIT Rootkit Part 2)(Citation: GitHub Turla Driver Loader) Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS.(Citation: Microsoft TESTSIGNING Feb 2021)(Citation: Apple Disable SIP) Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system. Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the system is in Test Mode). Adversaries may attempt to remove such artifacts.(Citation: F-Secure BlackEnergy 2014)
To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) using a signed, but vulnerable driver.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)
[T1552.007] Unsecured Credentials: Container API
Current version: 1.0
Description: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)
An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
[T1609] Container Administration Command
Current version: 1.0
Description: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.(Citation: Kubectl Exec Get Shell)
[T1053.007] Scheduled Task/Job: Container Orchestration Job
Current version: 1.0
Description: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)
[T1613] Container and Resource Discovery
Current version: 1.0
Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
[T1610] Deploy Container
Current version: 1.0
Description: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
[T1608.004] Stage Capabilities: Drive-by Target
Current version: 1.0
Description: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).
Adversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts. Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers. In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox)
Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted attack is referred to a strategic web compromise or watering hole attack.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).
[T1611] Escape to Host
Current version: 1.0
Description: Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
There are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, and utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.
[T1608.003] Stage Capabilities: Install Digital Certificate
Current version: 1.0
Description: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)
Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers.
Adversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).
[T1016.001] System Network Configuration Discovery: Internet Connection Discovery
Current version: 1.0
Description: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.
Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
[T1608.005] Stage Capabilities: Link Target
Current version: 1.0
Description: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
Typically, the resources for a link target will be an HTML page that may include some client-side script such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) to decide what content to serve to the user. Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003).(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019) Adversaries may also [Upload Malware](https://attack.mitre.org/techniques/T1608/001) and have the link target point to malware for download/execution by the user.
Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Link shortening services can also be employed.
[T1204.003] User Execution: Malicious Image
Current version: 1.0
Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)
Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).
[T1553.005] Subvert Trust Controls: Mark-of-the-Web Bypass
Current version: 1.0
Description: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)
Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted. MOTW is a NTFS feature and many container files do not support NTFS alternative data streams. After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)
[T1555.005] Credentials from Password Stores: Password Managers
Current version: 1.0
Description: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)
Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610)
Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)
[T1608] Stage Capabilities
Current version: 1.0
Description: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)
Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):
* Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)
* Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)
* Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)
* Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert)
[T1614] System Location Discovery
Current version: 1.0
Description:
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021)
Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
[T1608.001] Stage Capabilities: Upload Malware
Current version: 1.0
Description: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
Malware may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Malware can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)
Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via [User Execution](https://attack.mitre.org/techniques/T1204). [Masquerading](https://attack.mitre.org/techniques/T1036) may increase the chance of users mistakenly executing these files.
[T1608.002] Stage Capabilities: Upload Tool
Current version: 1.0
Description: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
Tools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo.
Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.
[T1555.004] Credentials from Password Stores: Windows Credential Manager
Current version: 1.0
Description: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
The Windows Credential Manager separates website credentials from application or network credentials in two lockers. As part of [Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003), Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker. Application and network credentials are stored in the Windows Credentials locker.
Credential Lockers store credentials in encrypted .vcrd files, located under %Systemdrive%\Users\\[Username]\AppData\Local\Microsoft\\[Vault/Credentials]\. The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.(Citation: passcape Windows Vault)(Citation: Malwarebytes The Windows Vault)
Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms. vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface. Adversaries may gather credentials by reading files located inside of the Credential Lockers. Adversaries may also abuse Windows APIs such as CredEnumerateA to list credentials managed by the Credential Manager.(Citation: Microsoft CredEnumerate)(Citation: Delpy Mimikatz Crendential Manager)
Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.(Citation: Malwarebytes The Windows Vault)
[T1547.013] Boot or Logon Autostart Execution: XDG Autostart Entries
Current version: 1.0
Description: Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.(Citation: Free Desktop Application Autostart Feb 2006)
Within an XDG autostart entry file, the Type key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The Name key indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.(Citation: Free Desktop Entry Keys)
Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make XDG autostart entries look as if they are associated with legitimate programs.
Minor Version Changes
[T1087] Account Discovery
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:10:18.260000+00:00 | 2021-04-14 12:26:11.595000+00:00 |
| x_mitre_data_sources[0] | Azure activity logs | User Account: User Account Metadata |
| x_mitre_data_sources[1] | Office 365 account logs | Command: Command Execution |
| x_mitre_data_sources[2] | API monitoring | Process: Process Creation |
| x_mitre_data_sources[3] | Process monitoring | File: File Access |
| x_mitre_detection | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
Monitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL) |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | Office 365 | SaaS |
| x_mitre_platforms[4] | Azure AD | IaaS |
| x_mitre_platforms[5] | AWS | Linux |
| x_mitre_platforms[6] | GCP | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'} |
| x_mitre_contributors | | Daniel Stepanic, Elastic |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_platforms | SaaS | |
[T1098] Account Manipulation
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-05 16:43:29.473000+00:00 | 2021-04-20 16:21:28.502000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | File: File Modification |
| x_mitre_data_sources[1] | Windows event logs | Command: Command Execution |
| x_mitre_platforms[3] | Azure | IaaS |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_data_sources | | Group: Group Modification |
| x_mitre_data_sources | | User Account: User Account Modification |
| x_mitre_data_sources | | Active Directory: Active Directory Object Modification |
| x_mitre_platforms | | Azure AD |
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | AWS | |
[T1098.001] Account Manipulation: Additional Cloud Credentials
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-12-18 14:57:07.625000+00:00 | 2021-03-08 10:33:01.582000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | User Account: User Account Modification |
| x_mitre_data_sources[1] | GCP audit logs | Active Directory: Active Directory Object Modification |
| x_mitre_platforms[0] | Azure AD | IaaS |
| x_mitre_platforms[1] | Azure | Azure AD |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_platforms | AWS | |
| x_mitre_platforms | GCP | |
[T1550.001] Use Alternate Authentication Material: Application Access Token
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 19:40:02.024000+00:00 | 2021-04-14 18:09:45.539000+00:00 |
| x_mitre_data_sources[0] | Office 365 audit logs | Web Credential: Web Credential Usage |
| x_mitre_data_sources[1] | OAuth audit logs | Application Log: Application Log Content |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
[T1499.003] Endpoint Denial of Service: Application Exhaustion Flood
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 02:01:10.832000+00:00 | 2021-03-29 16:08:52.118000+00:00 |
| x_mitre_data_sources[0] | Network device logs | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network device logs | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Network intrusion detection system | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[3] | Web application firewall logs | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Web logs | |
| x_mitre_data_sources | SSL/TLS inspection | |
| x_mitre_platforms | SaaS | |
[T1499.004] Endpoint Denial of Service: Application or System Exploitation
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 02:07:27.508000+00:00 | 2021-03-29 16:09:41.559000+00:00 |
| x_mitre_data_sources[0] | Network device logs | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network intrusion detection system | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Web application firewall logs | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[3] | Web logs | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | SSL/TLS inspection | |
| x_mitre_platforms | SaaS | |
[T1197] BITS Jobs
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may abuse BITS jobs to persistently execute or c | t | Adversaries may abuse BITS jobs to persistently execute or c |
| lean up after malicious payloads. Windows Background Intelli | | lean up after malicious payloads. Windows Background Intelli |
| gent Transfer Service (BITS) is a low-bandwidth, asynchronou | | gent Transfer Service (BITS) is a low-bandwidth, asynchronou |
| s file transfer mechanism exposed through [Component Object | | s file transfer mechanism exposed through [Component Object |
| Model](https://attack.mitre.org/techniques/T1559/001) (COM). | | Model](https://attack.mitre.org/techniques/T1559/001) (COM). |
| (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS i | | (Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is |
| s commonly used by updaters, messengers, and other applicati | | commonly used by updaters, messengers, and other application |
| ons preferred to operate in the background (using available | | s preferred to operate in the background (using available id |
| idle bandwidth) without interrupting other networked applica | | le bandwidth) without interrupting other networked applicati |
| tions. File transfer tasks are implemented as BITS jobs, whi | | ons. File transfer tasks are implemented as BITS jobs, which |
| ch contain a queue of one or more file operations. The inte | | contain a queue of one or more file operations. The interf |
| rface to create and manage BITS jobs is accessible through [ | | ace to create and manage BITS jobs is accessible through [Po |
| PowerShell](https://attack.mitre.org/techniques/T1059/001) | | werShell](https://attack.mitre.org/techniques/T1059/001) and |
| (Citation: Microsoft BITS) and the [BITSAdmin](https://attac | | the [BITSAdmin](https://attack.mitre.org/software/S0190) to |
| k.mitre.org/software/S0190) tool. (Citation: Microsoft BITSA | | ol.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin) |
| dmin) Adversaries may abuse BITS to download, execute, and | | Adversaries may abuse BITS to download, execute, and even |
| even clean up after running malicious code. BITS tasks are s | | clean up after running malicious code. BITS tasks are self-c |
| elf-contained in the BITS job database, without new files or | | ontained in the BITS job database, without new files or regi |
| registry modifications, and often permitted by host firewal | | stry modifications, and often permitted by host firewalls.(C |
| ls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok | | itation: CTU BITS Malware June 2016)(Citation: Mondok Window |
| Windows PiggyBack BITS May 2007) (Citation: Symantec BITS M | | s PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) |
| ay 2007) BITS enabled execution may also enable persistence | | BITS enabled execution may also enable persistence by creat |
| by creating long-standing jobs (the default maximum lifetime | | ing long-standing jobs (the default maximum lifetime is 90 d |
| is 90 days and extendable) or invoking an arbitrary program | | ays and extendable) or invoking an arbitrary program when a |
| when a job completes or errors (including after system rebo | | job completes or errors (including after system reboots).(Ci |
| ots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU | | tation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malwa |
| BITS Malware June 2016) BITS upload functionalities can als | | re June 2016) BITS upload functionalities can also be used |
| o be used to perform [Exfiltration Over Alternative Protocol | | to perform [Exfiltration Over Alternative Protocol](https:// |
| ](https://attack.mitre.org/techniques/T1048). (Citation: CTU | | attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malwa |
| BITS Malware June 2016) | | re June 2016) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 23:28:10.049000+00:00 | 2021-04-13 21:36:04.956000+00:00 |
| description | Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM). (Citation: Microsoft COM) (Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) (Citation: Microsoft BITS) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool. (Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. (Citation: CTU BITS Malware June 2016) (Citation: Mondok Windows PiggyBack BITS May 2007) (Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). (Citation: PaloAlto UBoatRAT Nov 2017) (Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048). (Citation: CTU BITS Malware June 2016) | Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
The interface to create and manage BITS jobs is accessible through [PowerShell](https://attack.mitre.org/techniques/T1059/001) and the [BITSAdmin](https://attack.mitre.org/software/S0190) tool.(Citation: Microsoft BITS)(Citation: Microsoft BITSAdmin)
Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.(Citation: CTU BITS Malware June 2016)(Citation: Mondok Windows PiggyBack BITS May 2007)(Citation: Symantec BITS May 2007) BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).(Citation: PaloAlto UBoatRAT Nov 2017)(Citation: CTU BITS Malware June 2016)
BITS upload functionalities can also be used to perform [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048).(Citation: CTU BITS Malware June 2016) |
| x_mitre_data_sources[0] | Process monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process command-line parameters | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[2] | Packet capture | Service: Service Metadata |
| x_mitre_data_sources[3] | Windows event logs | Command: Command Execution |
| x_mitre_detection | BITS runs as a service and its status can be checked with the Sc query utility (sc query bits). (Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose). (Citation: Microsoft BITS)
Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) (Citation: Microsoft BITS)Admin and the Windows Event log for BITS activity. Also consider investigating more detailed information about jobs by parsing the BITS job database. (Citation: CTU BITS Malware June 2016)
Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account). (Citation: Microsoft BITS) | BITS runs as a service and its status can be checked with the Sc query utility (sc query bits).(Citation: Microsoft Issues with BITS July 2011) Active BITS tasks can be enumerated using the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (bitsadmin /list /allusers /verbose).(Citation: Microsoft BITS)
Monitor usage of the [BITSAdmin](https://attack.mitre.org/software/S0190) tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options)(Citation: Microsoft BITS) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.(Citation: Elastic - Hunting for Persistence Part 1) Also consider investigating more detailed information about jobs by parsing the BITS job database.(Citation: CTU BITS Malware June 2016)
Monitor and analyze network activity generated by BITS. BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).(Citation: Microsoft BITS) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Elastic - Hunting for Persistence Part 1', 'description': 'French, D., Murphy, B. (2020, March 24). Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 1). Retrieved December 21, 2020.', 'url': 'https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-1'} |
| x_mitre_contributors | | Brent Murphy, Elastic |
| x_mitre_contributors | | David French, Elastic |
[T1176] Browser Extensions
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may abuse Internet browser extensions to establi | t | Adversaries may abuse Internet browser extensions to establi |
| sh persistence access to victim systems. Browser extensions | | sh persistent access to victim systems. Browser extensions o |
| or plugins are small programs that can add functionality and | | r plugins are small programs that can add functionality and |
| customize aspects of Internet browsers. They can be install | | customize aspects of Internet browsers. They can be installe |
| ed directly or through a browser's app store and generally h | | d directly or through a browser's app store and generally ha |
| ave access and permissions to everything that the browser ca | | ve access and permissions to everything that the browser can |
| n access. (Citation: Wikipedia Browser Extension) (Citation: | | access.(Citation: Wikipedia Browser Extension)(Citation: Ch |
| Chrome Extensions Definition) Malicious extensions can be | | rome Extensions Definition) Malicious extensions can be ins |
| installed into a browser through malicious app store downloa | | talled into a browser through malicious app store downloads |
| ds masquerading as legitimate extensions, through social eng | | masquerading as legitimate extensions, through social engine |
| ineering, or by an adversary that has already compromised a | | ering, or by an adversary that has already compromised a sys |
| system. Security can be limited on browser app stores so it | | tem. Security can be limited on browser app stores so it may |
| may not be difficult for malicious extensions to defeat auto | | not be difficult for malicious extensions to defeat automat |
| mated scanners. (Citation: Malicious Chrome Extension Number | | ed scanners.(Citation: Malicious Chrome Extension Numbers) D |
| s) Once the extension is installed, it can browse to website | | epending on the browser, adversaries may also manipulate an |
| s in the background, (Citation: Chrome Extension Crypto Mine | | extension's update url to install updates from an adversary |
| r) (Citation: ICEBRG Chrome Extensions) steal all informatio | | controlled server or manipulate the mobile configuration fil |
| n that a user enters into a browser (including credentials) | | e to silently install additional extensions. Previous to ma |
| (Citation: Banker Google Chrome Extension Steals Creds) (Cit | | cOS 11, adversaries could silently install browser extension |
| ation: Catch All Chrome Extension) and be used as an install | | s via the command line using the <code>profiles</code> tool |
| er for a RAT for persistence. There have also been instance | | to install malicious <code>.mobileconfig</code> files. In ma |
| s of botnets using a persistent backdoor through malicious C | | cOS 11+, the use of the <code>profiles</code> tool can no lo |
| hrome extensions. (Citation: Stantinko Botnet) There have al | | nger install configuration profiles, however <code>.mobileco |
| so been similar examples of extensions being used for comman | | nfig</code> files can be planted and installed with user int |
| d & control (Citation: Chrome Extension C2 Malware). | | eraction.(Citation: xorrior chrome extensions macOS) Once t |
| | | he extension is installed, it can browse to websites in the |
| | | background,(Citation: Chrome Extension Crypto Miner)(Citatio |
| | | n: ICEBRG Chrome Extensions) steal all information that a us |
| | | er enters into a browser (including credentials)(Citation: B |
| | | anker Google Chrome Extension Steals Creds)(Citation: Catch |
| | | All Chrome Extension) and be used as an installer for a RAT |
| | | for persistence. There have also been instances of botnets |
| | | using a persistent backdoor through malicious Chrome extensi |
| | | ons.(Citation: Stantinko Botnet) There have also been simila |
| | | r examples of extensions being used for command & control.(C |
| | | itation: Chrome Extension C2 Malware) |
New Mitigations:
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 23:36:30.565000+00:00 | 2021-04-27 19:56:54.161000+00:00 |
| description | Adversaries may abuse Internet browser extensions to establish persistence access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access. (Citation: Wikipedia Browser Extension) (Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners. (Citation: Malicious Chrome Extension Numbers) Once the extension is installed, it can browse to websites in the background, (Citation: Chrome Extension Crypto Miner) (Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials) (Citation: Banker Google Chrome Extension Steals Creds) (Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions. (Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control (Citation: Chrome Extension C2 Malware). | Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)
Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.
Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)
Once the extension is installed, it can browse to websites in the background,(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.
There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware) |
| external_references[4]['source_name'] | Chrome Extension Crypto Miner | xorrior chrome extensions macOS |
| external_references[4]['description'] | Brinkmann, M. (2017, September 19). First Chrome extension with JavaScript Crypto Miner detected. Retrieved November 16, 2017. | Chris Ross. (2019, February 8). No Place Like Chrome. Retrieved April 27, 2021. |
| external_references[4]['url'] | https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/ | https://www.xorrior.com/No-Place-Like-Chrome/ |
| external_references[5]['source_name'] | ICEBRG Chrome Extensions | Chrome Extension Crypto Miner |
| external_references[5]['description'] | De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018. | Brinkmann, M. (2017, September 19). First Chrome extension with JavaScript Crypto Miner detected. Retrieved November 16, 2017. |
| external_references[5]['url'] | https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses | https://www.ghacks.net/2017/09/19/first-chrome-extension-with-javascript-crypto-miner-detected/ |
| external_references[6]['source_name'] | Banker Google Chrome Extension Steals Creds | ICEBRG Chrome Extensions |
| external_references[6]['description'] | Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. Retrieved November 18, 2017. | De Tore, M., Warner, J. (2018, January 15). MALICIOUS CHROME EXTENSIONS ENABLE CRIMINALS TO IMPACT OVER HALF A MILLION USERS AND GLOBAL BUSINESSES. Retrieved January 17, 2018. |
| external_references[6]['url'] | https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/ | https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses |
| external_references[7]['source_name'] | Catch All Chrome Extension | Banker Google Chrome Extension Steals Creds |
| external_references[7]['description'] | Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension Steals All Posted Data. Retrieved November 16, 2017. | Marinho, R. (n.d.). (Banker(GoogleChromeExtension)).targeting. Retrieved November 18, 2017. |
| external_references[7]['url'] | https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/) | https://isc.sans.edu/forums/diary/BankerGoogleChromeExtensiontargetingBrazil/22722/ |
| external_references[8]['source_name'] | Stantinko Botnet | Catch All Chrome Extension |
| external_references[8]['description'] | Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware campaign operating covertly since 2012. Retrieved November 16, 2017. | Marinho, R. (n.d.). "Catch-All" Google Chrome Malicious Extension Steals All Posted Data. Retrieved November 16, 2017. |
| external_references[8]['url'] | https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/ | https://isc.sans.edu/forums/diary/CatchAll+Google+Chrome+Malicious+Extension+Steals+All+Posted+Data/22976/https:/threatpost.com/malicious-chrome-extension-steals-data-posted-to-any-website/128680/) |
| external_references[9]['source_name'] | Chrome Extension C2 Malware | Stantinko Botnet |
| external_references[9]['description'] | Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017. | Vachon, F., Faou, M. (2017, July 20). Stantinko: A massive adware campaign operating covertly since 2012. Retrieved November 16, 2017. |
| external_references[9]['url'] | https://kjaer.io/extension-malware/ | https://www.welivesecurity.com/2017/07/20/stantinko-massive-adware-campaign-operating-covertly-since-2012/ |
| x_mitre_data_sources[0] | Windows Registry | Command: Command Execution |
| x_mitre_data_sources[1] | File monitoring | Process: Process Creation |
| x_mitre_data_sources[2] | Process use of network | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[3] | Process monitoring | Windows Registry: Windows Registry Key Creation |
| x_mitre_data_sources[4] | Browser extensions | File: File Creation |
| x_mitre_detection | Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates.
Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation. | Inventory and monitor browser extension installations that deviate from normal, expected, and benign extensions. Process and network monitoring can be used to detect browsers communicating with a C2 server. However, this may prove to be a difficult way of initially detecting a malicious extension depending on the nature and volume of the traffic it generates.
Monitor for any new items written to the Registry or PE files written to disk. That may correlate with browser extension installation.
On macOS, monitor the command line for usage of the profiles tool, such as profiles install -type=configuration. Additionally, all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory. Ensure all listed files are in alignment with approved extensions.(Citation: xorrior chrome extensions macOS) |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Chrome Extension C2 Malware', 'description': 'Kjaer, M. (2016, July 18). Malware in the browser: how you might get hacked by a Chrome extension. Retrieved November 22, 2017.', 'url': 'https://kjaer.io/extension-malware/'} |
| x_mitre_contributors | | Chris Ross @xorrior |
[T1110] Brute Force
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 16:38:27.781000+00:00 | 2021-04-14 12:04:36.243000+00:00 |
| x_mitre_data_sources[0] | Office 365 account logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Authentication logs | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | Office 365 | SaaS |
| x_mitre_platforms[4] | Azure AD | IaaS |
| x_mitre_platforms[5] | SaaS | Linux |
| x_mitre_platforms[6] | GCP | macOS |
| x_mitre_platforms[7] | AWS | Google Workspace |
| x_mitre_platforms[8] | Azure | Containers |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | David Fiser, @anu4is, Trend Micro |
| x_mitre_contributors | | Alfredo Oliveira, Trend Micro |
| x_mitre_contributors | | Magno Logan, @magnologan, Trend Micro |
| x_mitre_contributors | | Yossi Weizman, Azure Defender Research Team |
[T1087.004] Account Discovery: Cloud Account
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-08-13 16:53:55.390000+00:00 | 2021-03-16 12:54:41.133000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | User Account: User Account Metadata |
| x_mitre_data_sources[1] | AWS CloudTrail logs | Command: Command Execution |
| x_mitre_platforms[0] | AWS | Azure AD |
| x_mitre_platforms[1] | GCP | Office 365 |
| x_mitre_platforms[2] | Azure | SaaS |
| x_mitre_platforms[3] | Office 365 | IaaS |
| x_mitre_platforms[4] | Azure AD | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | Office 365 account logs | |
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_platforms | SaaS | |
[T1136.003] Create Account: Cloud Account
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-24 12:44:27.995000+00:00 | 2021-03-16 12:47:00.192000+00:00 |
| x_mitre_data_sources[0] | Office 365 audit logs | User Account: User Account Creation |
| x_mitre_platforms[0] | AWS | Azure AD |
| x_mitre_platforms[1] | GCP | Office 365 |
| x_mitre_platforms[2] | Azure | IaaS |
| x_mitre_platforms[3] | Office 365 | Google Workspace |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | Azure AD | |
[T1078.004] Valid Accounts: Cloud Accounts
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 16:01:22.090000+00:00 | 2021-03-16 12:45:15.399000+00:00 |
| x_mitre_data_sources[0] | Azure activity logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Authentication logs | Logon Session: Logon Session Creation |
| x_mitre_platforms[0] | AWS | Azure AD |
| x_mitre_platforms[1] | GCP | Office 365 |
| x_mitre_platforms[2] | Azure | SaaS |
| x_mitre_platforms[3] | SaaS | IaaS |
| x_mitre_platforms[4] | Azure AD | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_platforms | Office 365 | |
[T1069.003] Permission Groups Discovery: Cloud Groups
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may attempt to find cloud groups and permission | t | Adversaries may attempt to find cloud groups and permission |
| settings. The knowledge of cloud permission groups can help | | settings. The knowledge of cloud permission groups can help |
| adversaries determine the particular roles of users and grou | | adversaries determine the particular roles of users and grou |
| ps within an environment, as well as which users are associa | | ps within an environment, as well as which users are associa |
| ted with a particular group. With authenticated access ther | | ted with a particular group. With authenticated access ther |
| e are several tools that can be used to find permissions gro | | e are several tools that can be used to find permissions gro |
| ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be | | ups. The <code>Get-MsolRole</code> PowerShell cmdlet can be |
| used to obtain roles and permissions groups for Exchange and | | used to obtain roles and permissions groups for Exchange and |
| Office 365 accounts.(Citation: Microsoft Msolrole)(Citation | | Office 365 accounts.(Citation: Microsoft Msolrole)(Citation |
| : GitHub Raindance) Azure CLI (AZ CLI) also provides an int | | : GitHub Raindance) Azure CLI (AZ CLI) and the Google Cloud |
| erface to obtain permissions groups with authenticated acces | | Identity Provider API also provide interfaces to obtain per |
| s to a domain. The command <code>az ad user get-member-group | | missions groups. The command <code>az ad user get-member-gro |
| s</code> will list groups associated to a user account.(Cita | | ups</code> will list groups associated to a user account for |
| tion: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS | | Azure while the API endpoint <code>GET https://cloudidentit |
| AD Azure, 2018) | | y.googleapis.com/v1/groups</code> lists group resources avai |
| | | lable to a user for Google.(Citation: Microsoft AZ CLI)(Cita |
| | | tion: Black Hills Red Teaming MS AD Azure, 2018)(Citation: G |
| | | oogle Cloud Identity API Documentation) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-08 17:34:39.077000+00:00 | 2021-03-30 12:42:46.315000+00:00 |
| description | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)
Azure CLI (AZ CLI) also provides an interface to obtain permissions groups with authenticated access to a domain. The command az ad user get-member-groups will list groups associated to a user account.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
With authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)
Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation) |
| x_mitre_data_sources[0] | GCP audit logs | Process: Process Creation |
| x_mitre_data_sources[1] | Stackdriver logs | Command: Command Execution |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Group: Group Enumeration |
| x_mitre_data_sources[3] | Azure activity logs | Group: Group Metadata |
| x_mitre_data_sources[4] | Office 365 account logs | Application Log: Application Log Content |
| x_mitre_platforms[3] | Azure | IaaS |
| x_mitre_platforms[4] | AWS | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Google Cloud Identity API Documentation', 'description': 'Google. (n.d.). Retrieved March 16, 2021.', 'url': 'https://cloud.google.com/identity/docs/reference/rest'} |
| x_mitre_platforms | | Azure AD |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | API monitoring | |
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_platforms | Azure AD | |
| x_mitre_platforms | GCP | |
[T1580] Cloud Infrastructure Discovery
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-17 16:41:23.267000+00:00 | 2021-03-08 10:33:02.163000+00:00 |
| x_mitre_data_sources[0] | GCP audit logs | Instance: Instance Metadata |
| x_mitre_data_sources[1] | Stackdriver logs | Instance: Instance Enumeration |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Snapshot: Snapshot Metadata |
| x_mitre_data_sources[3] | Azure activity logs | Snapshot: Snapshot Enumeration |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Cloud Storage: Cloud Storage Metadata |
| x_mitre_data_sources | | Cloud Storage: Cloud Storage Enumeration |
| x_mitre_data_sources | | Volume: Volume Metadata |
| x_mitre_data_sources | | Volume: Volume Enumeration |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure | |
| x_mitre_platforms | GCP | |
[T1552.005] Unsecured Credentials: Cloud Instance Metadata API
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-15 19:39:34.817000+00:00 | 2021-03-31 19:41:06.948000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_detection | Monitor access to the Instance Metadata API and look for anomalous queries.
It may be possible to detect adversary use of credentials they have obtained. See [Valid Accounts](https://attack.mitre.org/techniques/T1078) for more information.
| Monitor access to the Instance Metadata API and look for anomalous queries.
It may be possible to detect adversary use of credentials they have obtained such as in [Valid Accounts](https://attack.mitre.org/techniques/T1078). |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1538] Cloud Service Dashboard
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-14 19:19:00.966000+00:00 | 2021-03-16 12:56:36.098000+00:00 |
| x_mitre_data_sources[0] | Office 365 audit logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Azure activity logs | Logon Session: Logon Session Creation |
| x_mitre_platforms[0] | AWS | Azure AD |
| x_mitre_platforms[1] | GCP | Office 365 |
| x_mitre_platforms[2] | Azure | IaaS |
| x_mitre_platforms[3] | Azure AD | Google Workspace |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | Office 365 | |
[T1526] Cloud Service Discovery
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-23 14:31:41.758000+00:00 | 2021-03-16 12:57:03.837000+00:00 |
| x_mitre_data_sources[0] | Azure activity logs | Cloud Service: Cloud Service Metadata |
| x_mitre_data_sources[1] | Stackdriver logs | Cloud Service: Cloud Service Enumeration |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | IaaS |
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | AWS | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1136] Create Account
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-24 12:44:28.199000+00:00 | 2021-03-16 12:47:00.458000+00:00 |
| x_mitre_data_sources[0] | Office 365 account logs | User Account: User Account Creation |
| x_mitre_data_sources[1] | Azure activity logs | Process: Process Creation |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Command: Command Execution |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | IaaS |
| x_mitre_platforms[4] | GCP | Linux |
| x_mitre_platforms[5] | Azure AD | macOS |
| x_mitre_platforms[6] | Azure | Google Workspace |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_data_sources | Authentication logs | |
| x_mitre_data_sources | Windows event logs | |
| x_mitre_platforms | Office 365 | |
[T1578.002] Modify Cloud Compute Infrastructure: Create Cloud Instance
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:48:08.299000+00:00 | 2021-03-08 10:33:02.034000+00:00 |
| x_mitre_data_sources[0] | GCP audit logs | Instance: Instance Creation |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1578.001] Modify Cloud Compute Infrastructure: Create Snapshot
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | An adversary may create a snapshot or data backup within a c | t | An adversary may create a snapshot or data backup within a c |
| loud account to evade defenses. A snapshot is a point-in-tim | | loud account to evade defenses. A snapshot is a point-in-tim |
| e copy of an existing cloud compute component such as a virt | | e copy of an existing cloud compute component such as a virt |
| ual machine (VM), virtual hard drive, or volume. An adversar | | ual machine (VM), virtual hard drive, or volume. An adversar |
| y may leverage permissions to create a snapshot in order to | | y may leverage permissions to create a snapshot in order to |
| bypass restrictions that prevent access to existing compute | | bypass restrictions that prevent access to existing compute |
| service infrastructure, unlike in [Revert Cloud Instance](ht | | service infrastructure, unlike in [Revert Cloud Instance](ht |
| tps://attack.mitre.org/techniques/T1536) where an adversary | | tps://attack.mitre.org/techniques/T1578/004) where an advers |
| may revert to a snapshot to evade detection and remove evide | | ary may revert to a snapshot to evade detection and remove e |
| nce of their presence. An adversary may [Create Cloud Insta | | vidence of their presence. An adversary may [Create Cloud I |
| nce](https://attack.mitre.org/techniques/T1578/002), mount o | | nstance](https://attack.mitre.org/techniques/T1578/002), mou |
| ne or more created snapshots to that instance, and then appl | | nt one or more created snapshots to that instance, and then |
| y a policy that allows the adversary access to the created i | | apply a policy that allows the adversary access to the creat |
| nstance, such as a firewall policy that allows them inbound | | ed instance, such as a firewall policy that allows them inbo |
| and outbound SSH access.(Citation: Mandiant M-Trends 2020) | | und and outbound SSH access.(Citation: Mandiant M-Trends 202 |
| | | 0) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:48:08.293000+00:00 | 2021-03-08 10:33:02.060000+00:00 |
| description | An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1536) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.
An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020) | An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.
An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020) |
| x_mitre_data_sources[0] | GCP audit logs | Snapshot: Snapshot Creation |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1110.004] Brute Force: Credential Stuffing
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 22:43:45.475000+00:00 | 2021-04-06 12:31:06.695000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Office 365 account logs | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_platforms[8] | SaaS | Containers |
| x_mitre_version | 1.1 | 1.2 |
[T1552.001] Unsecured Credentials: Credentials In Files
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may search local file systems and remote file sh | t | Adversaries may search local file systems and remote file sh |
| ares for files containing insecurely stored credentials. The | | ares for files containing insecurely stored credentials. The |
| se can be files created by users to store their own credenti | | se can be files created by users to store their own credenti |
| als, shared credential stores for a group of individuals, co | | als, shared credential stores for a group of individuals, co |
| nfiguration files containing passwords for a system or servi | | nfiguration files containing passwords for a system or servi |
| ce, or source code/binary files containing embedded password | | ce, or source code/binary files containing embedded password |
| s. It is possible to extract passwords from backups or save | | s. It is possible to extract passwords from backups or save |
| d virtual machines through [OS Credential Dumping](https://a | | d virtual machines through [OS Credential Dumping](https://a |
| ttack.mitre.org/techniques/T1003). (Citation: CG 2014) Passw | | ttack.mitre.org/techniques/T1003). (Citation: CG 2014) Passw |
| ords may also be obtained from Group Policy Preferences stor | | ords may also be obtained from Group Policy Preferences stor |
| ed on the Windows Domain Controller. (Citation: SRD GPP) In | | ed on the Windows Domain Controller. (Citation: SRD GPP) In |
| cloud environments, authenticated user credentials are ofte | | cloud and/or containerized environments, authenticated user |
| n stored in local configuration and credential files. In som | | and service account credentials are often stored in local c |
| e cases, these files can be copied and reused on another mac | | onfiguration and credential files.(Citation: Unit 42 Hildega |
| hine or the contents can be read and then used to authentica | | rd Malware) They may also be found as parameters to deployme |
| te without needing to copy any files. (Citation: Specter Ops | | nt commands in container logs.(Citation: Unit 42 Unsecured D |
| - Cloud Credential Storage) | | ocker Daemons) In some cases, these files can be copied and |
| | | reused on another machine or the contents can be read and th |
| | | en used to authenticate without needing to copy any files.(C |
| | | itation: Specter Ops - Cloud Credential Storage) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 18:30:10.630000+00:00 | 2021-04-12 18:32:32.803000+00:00 |
| description | Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)
In cloud environments, authenticated user credentials are often stored in local configuration and credential files. In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files. (Citation: Specter Ops - Cloud Credential Storage) | Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). (Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller. (Citation: SRD GPP)
In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage) |
| external_references[4]['source_name'] | Specter Ops - Cloud Credential Storage | Unit 42 Hildegard Malware |
| external_references[4]['description'] | Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019. | Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021. |
| external_references[4]['url'] | https://posts.specterops.io/head-in-the-clouds-bd038bb69e48 | https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/ |
| x_mitre_data_sources[0] | Process command-line parameters | File: File Access |
| x_mitre_data_sources[1] | File monitoring | Command: Command Execution |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_platforms[4] | GCP | Containers |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Unit 42 Unsecured Docker Daemons', 'description': "Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.", 'url': 'https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/'} |
| external_references | | {'source_name': 'Specter Ops - Cloud Credential Storage', 'description': 'Maddalena, C.. (2018, September 12). Head in the Clouds. Retrieved October 4, 2019.', 'url': 'https://posts.specterops.io/head-in-the-clouds-bd038bb69e48'} |
| x_mitre_contributors | | Rory McCune, Aqua Security |
| x_mitre_contributors | | Jay Chen, Palo Alto Networks |
| x_mitre_contributors | | Yossi Weizman, Azure Defender Research Team |
| x_mitre_contributors | | Vishwas Manral, McAfee |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Azure | |
[T1555.003] Credentials from Password Stores: Credentials from Web Browsers
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may acquire credentials from web browsers by rea | t | Adversaries may acquire credentials from web browsers by rea |
| ding files specific to the target browser.(Citation: Talos O | | ding files specific to the target browser.(Citation: Talos O |
| lympic Destroyer 2018) Web browsers commonly save credential | | lympic Destroyer 2018) Web browsers commonly save credential |
| s such as website usernames and passwords so that they do no | | s such as website usernames and passwords so that they do no |
| t need to be entered manually in the future. Web browsers ty | | t need to be entered manually in the future. Web browsers ty |
| pically store the credentials in an encrypted format within | | pically store the credentials in an encrypted format within |
| a credential store; however, methods exist to extract plaint | | a credential store; however, methods exist to extract plaint |
| ext credentials from web browsers. For example, on Windows | | ext credentials from web browsers. For example, on Windows |
| systems, encrypted credentials may be obtained from Google C | | systems, encrypted credentials may be obtained from Google C |
| hrome by reading a database file, <code>AppData\Local\Google | | hrome by reading a database file, <code>AppData\Local\Google |
| \Chrome\User Data\Default\Login Data</code> and executing a | | \Chrome\User Data\Default\Login Data</code> and executing a |
| SQL query: <code>SELECT action_url, username_value, password | | SQL query: <code>SELECT action_url, username_value, password |
| _value FROM logins;</code>. The plaintext password can then | | _value FROM logins;</code>. The plaintext password can then |
| be obtained by passing the encrypted credentials to the Wind | | be obtained by passing the encrypted credentials to the Wind |
| ows API function <code>CryptUnprotectData</code>, which uses | | ows API function <code>CryptUnprotectData</code>, which uses |
| the victim’s cached logon credentials as the decryption key | | the victim’s cached logon credentials as the decryption key |
| . (Citation: Microsoft CryptUnprotectData April 2018) Adv | | . (Citation: Microsoft CryptUnprotectData April 2018) Adve |
| ersaries have executed similar procedures for common web bro | | rsaries have executed similar procedures for common web brow |
| wsers such as FireFox, Safari, Edge, etc. (Citation: Proofpo | | sers such as FireFox, Safari, Edge, etc.(Citation: Proofpoin |
| int Vega Credential Stealer May 2018)(Citation: FireEye Hawk | | t Vega Credential Stealer May 2018)(Citation: FireEye HawkEy |
| Eye Malware July 2017) Adversaries may also acquire credent | | e Malware July 2017) Windows stores Internet Explorer and Mi |
| ials by searching web browser process memory for patterns th | | crosoft Edge credentials in Credential Lockers managed by th |
| at commonly match credentials.(Citation: GitHub Mimikittenz | | e [Windows Credential Manager](https://attack.mitre.org/tech |
| July 2016) After acquiring credentials from web browsers, a | | niques/T1555/004). Adversaries may also acquire credentials |
| dversaries may attempt to recycle the credentials across dif | | by searching web browser process memory for patterns that c |
| ferent systems and/or accounts in order to expand access. Th | | ommonly match credentials.(Citation: GitHub Mimikittenz July |
| is can result in significantly furthering an adversary's obj | | 2016) After acquiring credentials from web browsers, adver |
| ective in cases where credentials gained from web browsers o | | saries may attempt to recycle the credentials across differe |
| verlap with privileged accounts (e.g. domain administrator). | | nt systems and/or accounts in order to expand access. This c |
| | | an result in significantly furthering an adversary's objecti |
| | | ve in cases where credentials gained from web browsers overl |
| | | ap with privileged accounts (e.g. domain administrator). |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-02-17 13:20:02.386000+00:00 | 2021-04-14 14:03:47.293000+00:00 |
| description | Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData April 2018)
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. (Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017)
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator). | Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key. (Citation: Microsoft CryptUnprotectData April 2018)
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the [Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004).
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator). |
| external_references[2]['source_name'] | Microsoft CryptUnprotectData April 2018 | Microsoft CryptUnprotectData April 2018 |
| x_mitre_data_sources[0] | File monitoring | File: File Access |
| x_mitre_data_sources[1] | API monitoring | Command: Command Execution |
| x_mitre_data_sources[2] | PowerShell logs | Process: OS API Execution |
| x_mitre_data_sources[3] | Process monitoring | Process: Process Access |
| x_mitre_version | 1.0 | 1.1 |
[T1574.001] Hijack Execution Flow: DLL Search Order Hijacking
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may execute their own malicious payloads by hija | t | Adversaries may execute their own malicious payloads by hija |
| cking the search order used to load DLLs. Windows systems us | | cking the search order used to load DLLs. Windows systems us |
| e a common method to look for required DLLs to load into a p | | e a common method to look for required DLLs to load into a p |
| rogram. (Citation: Microsoft Dynamic Link Library Search Ord | | rogram. (Citation: Microsoft Dynamic Link Library Search Ord |
| er) Hijacking DLL loads may be for the purpose of establishi | | er)(Citation: FireEye Hijacking July 2010) Hijacking DLL loa |
| ng persistence as well as elevating privileges and/or evadin | | ds may be for the purpose of establishing persistence as wel |
| g restrictions on file execution. There are many ways an ad | | l as elevating privileges and/or evading restrictions on fil |
| versary can hijack DLL loads. Adversaries may plant trojan d | | e execution. There are many ways an adversary can hijack DL |
| ynamic-link library files (DLLs) in a directory that will be | | L loads. Adversaries may plant trojan dynamic-link library f |
| searched before the location of a legitimate library that w | | iles (DLLs) in a directory that will be searched before the |
| ill be requested by a program, causing Windows to load their | | location of a legitimate library that will be requested by a |
| malicious library when it is called for by the victim progr | | program, causing Windows to load their malicious library wh |
| am. Adversaries may also perform DLL preloading, also called | | en it is called for by the victim program. Adversaries may a |
| binary planting attacks, (Citation: OWASP Binary Planting) | | lso perform DLL preloading, also called binary planting atta |
| by placing a malicious DLL with the same name as an ambiguou | | cks, (Citation: OWASP Binary Planting) by placing a maliciou |
| sly specified DLL in a location that Windows searches before | | s DLL with the same name as an ambiguously specified DLL in |
| the legitimate DLL. Often this location is the current work | | a location that Windows searches before the legitimate DLL. |
| ing directory of the program. Remote DLL preloading attacks | | Often this location is the current working directory of the |
| occur when a program sets its current directory to a remote | | program.(Citation: FireEye fxsst June 2011) Remote DLL prelo |
| location such as a Web share before loading a DLL. (Citation | | ading attacks occur when a program sets its current director |
| : Microsoft Security Advisory 2269637) Adversaries may also | | y to a remote location such as a Web share before loading a |
| directly modify the way a program loads DLLs by replacing a | | DLL. (Citation: Microsoft Security Advisory 2269637) Advers |
| n existing DLL or modifying a .manifest or .local redirectio | | aries may also directly modify the search order via DLL redi |
| n file, directory, or junction to cause the program to load | | rection, which after being enabled (in the Registry and crea |
| a different DLL. (Citation: Microsoft Dynamic-Link Library R | | tion of a redirection file) may cause a program to load a di |
| edirection) (Citation: Microsoft Manifests) (Citation: FireE | | fferent DLL.(Citation: Microsoft Dynamic-Link Library Redire |
| ye DLL Search Order Hijacking) If a search order-vulnerable | | ction)(Citation: Microsoft Manifests)(Citation: FireEye DLL |
| program is configured to run at a higher privilege level, t | | Search Order Hijacking) If a search order-vulnerable progra |
| hen the adversary-controlled DLL that is loaded will also be | | m is configured to run at a higher privilege level, then the |
| executed at the higher level. In this case, the technique c | | adversary-controlled DLL that is loaded will also be execut |
| ould be used for privilege escalation from user to administr | | ed at the higher level. In this case, the technique could be |
| ator or SYSTEM or from administrator to SYSTEM, depending on | | used for privilege escalation from user to administrator or |
| the program. Programs that fall victim to path hijacking ma | | SYSTEM or from administrator to SYSTEM, depending on the pr |
| y appear to behave normally because malicious DLLs may be co | | ogram. Programs that fall victim to path hijacking may appea |
| nfigured to also load the legitimate DLLs they were meant to | | r to behave normally because malicious DLLs may be configure |
| replace. | | d to also load the legitimate DLLs they were meant to replac |
| | | e. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 16:13:58.862000+00:00 | 2021-04-26 18:37:03.748000+00:00 |
| description | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program. Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Adversaries may also directly modify the way a program loads DLLs by replacing an existing DLL or modifying a .manifest or .local redirection file, directory, or junction to cause the program to load a different DLL. (Citation: Microsoft Dynamic-Link Library Redirection) (Citation: Microsoft Manifests) (Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.
Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. | Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
There are many ways an adversary can hijack DLL loads. Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program. Adversaries may also perform DLL preloading, also called binary planting attacks, (Citation: OWASP Binary Planting) by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL. Often this location is the current working directory of the program.(Citation: FireEye fxsst June 2011) Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL. (Citation: Microsoft Security Advisory 2269637)
Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.(Citation: Microsoft Dynamic-Link Library Redirection)(Citation: Microsoft Manifests)(Citation: FireEye DLL Search Order Hijacking)
If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level. In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program. Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace. |
| external_references[3]['source_name'] | OWASP Binary Planting | FireEye Hijacking July 2010 |
| external_references[3]['description'] | OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016. | Harbour, N. (2010, July 15). Malware Persistence without the Windows Registry. Retrieved November 17, 2020. |
| external_references[3]['url'] | https://www.owasp.org/index.php/Binary_planting | https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html |
| external_references[4]['source_name'] | Microsoft Security Advisory 2269637 | OWASP Binary Planting |
| external_references[4]['description'] | Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020. | OWASP. (2013, January 30). Binary planting. Retrieved June 7, 2016. |
| external_references[4]['url'] | https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637 | https://www.owasp.org/index.php/Binary_planting |
| external_references[5]['source_name'] | Microsoft Dynamic-Link Library Redirection | FireEye fxsst June 2011 |
| external_references[5]['description'] | Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020. | Harbour, N. (2011, June 3). What the fxsst?. Retrieved November 17, 2020. |
| external_references[5]['url'] | https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN | https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html |
| external_references[6]['source_name'] | Microsoft Manifests | Microsoft Security Advisory 2269637 |
| external_references[6]['description'] | Microsoft. (n.d.). Manifests. Retrieved December 5, 2014. | Microsoft. (, May 23). Microsoft Security Advisory 2269637. Retrieved March 13, 2020. |
| external_references[6]['url'] | https://msdn.microsoft.com/en-US/library/aa375365 | https://docs.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637 |
| external_references[7]['source_name'] | FireEye DLL Search Order Hijacking | Microsoft Dynamic-Link Library Redirection |
| external_references[7]['description'] | Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020. | Microsoft. (2018, May 31). Dynamic-Link Library Redirection. Retrieved March 13, 2020. |
| external_references[7]['url'] | https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html | https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN |
| x_mitre_data_sources[0] | Process command-line parameters | File: File Creation |
| x_mitre_data_sources[1] | Process monitoring | File: File Modification |
| x_mitre_data_sources[2] | DLL monitoring | Module: Module Load |
| x_mitre_detection | Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious. | Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious. Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths. Modifications to or creation of `.manifest` and `.local` redirection files that do not correlate with software updates are suspicious. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Manifests', 'description': 'Microsoft. (n.d.). Manifests. Retrieved December 5, 2014.', 'url': 'https://msdn.microsoft.com/en-US/library/aa375365'} |
| external_references | | {'source_name': 'FireEye DLL Search Order Hijacking', 'description': 'Nick Harbour. (2010, September 1). DLL Search Order Hijacking Revisited. Retrieved March 13, 2020.', 'url': 'https://www.fireeye.com/blog/threat-research/2010/08/dll-search-order-hijacking-revisited.html'} |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | File monitoring | |
[T1485] Data Destruction
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may destroy data and files on specific systems o | t | Adversaries may destroy data and files on specific systems o |
| r in large numbers on a network to interrupt availability to | | r in large numbers on a network to interrupt availability to |
| systems, services, and network resources. Data destruction | | systems, services, and network resources. Data destruction |
| is likely to render stored data irrecoverable by forensic te | | is likely to render stored data irrecoverable by forensic te |
| chniques through overwriting files or data on local and remo | | chniques through overwriting files or data on local and remo |
| te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy | | te drives.(Citation: Symantec Shamoon 2012)(Citation: FireEy |
| e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci | | e Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Ci |
| tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon | | tation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon |
| 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera | | 3 2018)(Citation: Talos Olympic Destroyer 2018) Common opera |
| ting system file deletion commands such as <code>del</code> | | ting system file deletion commands such as <code>del</code> |
| and <code>rm</code> often only remove pointers to files with | | and <code>rm</code> often only remove pointers to files with |
| out wiping the contents of the files themselves, making the | | out wiping the contents of the files themselves, making the |
| files recoverable by proper forensic methodology. This behav | | files recoverable by proper forensic methodology. This behav |
| ior is distinct from [Disk Content Wipe](https://attack.mitr | | ior is distinct from [Disk Content Wipe](https://attack.mitr |
| e.org/techniques/T1561/001) and [Disk Structure Wipe](https: | | e.org/techniques/T1561/001) and [Disk Structure Wipe](https: |
| //attack.mitre.org/techniques/T1561/002) because individual | | //attack.mitre.org/techniques/T1561/002) because individual |
| files are destroyed rather than sections of a storage disk o | | files are destroyed rather than sections of a storage disk o |
| r the disk's logical structure. Adversaries may attempt to | | r the disk's logical structure. Adversaries may attempt to |
| overwrite files and directories with randomly generated data | | overwrite files and directories with randomly generated data |
| to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 | | to make it irrecoverable.(Citation: Kaspersky StoneDrill 20 |
| 17)(Citation: Unit 42 Shamoon3 2018) In some cases political | | 17)(Citation: Unit 42 Shamoon3 2018) In some cases political |
| ly oriented image files have been used to overwrite data.(Ci | | ly oriented image files have been used to overwrite data.(Ci |
| tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo | | tation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoo |
| n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz | | n Nov 2016)(Citation: Kaspersky StoneDrill 2017) To maximiz |
| e impact on the target organization in operations where netw | | e impact on the target organization in operations where netw |
| ork-wide availability interruption is the goal, malware desi | | ork-wide availability interruption is the goal, malware desi |
| gned for destroying data may have worm-like features to prop | | gned for destroying data may have worm-like features to prop |
| agate across a network by leveraging additional techniques l | | agate across a network by leveraging additional techniques l |
| ike [Valid Accounts](https://attack.mitre.org/techniques/T10 | | ike [Valid Accounts](https://attack.mitre.org/techniques/T10 |
| 78), [OS Credential Dumping](https://attack.mitre.org/techni | | 78), [OS Credential Dumping](https://attack.mitre.org/techni |
| ques/T1003), and [SMB/Windows Admin Shares](https://attack.m | | ques/T1003), and [SMB/Windows Admin Shares](https://attack.m |
| itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 | | itre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2 |
| 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto | | 012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto |
| Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita | | Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Cita |
| tion: Talos Olympic Destroyer 2018) | | tion: Talos Olympic Destroyer 2018). In cloud environments, |
| | | adversaries may leverage access to delete cloud storage, cl |
| | | oud storage accounts, machine images, and other infrastructu |
| | | re crucial to operations to damage an organization or their |
| | | customers.(Citation: Data Destruction - Threat Post)(Citatio |
| | | n: DOJ - Cisco Insider) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Brent Murphy, Elastic', 'David French, Elastic', 'Syed Ummar Farooqh, McAfee', 'Prasad Somasamudram, McAfee', 'Sekhar Sarukkai, McAfee ', 'Varonis Threat Labs'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-27 21:08:19.783000+00:00 | 2021-03-25 14:47:48.728000+00:00 |
| description | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018) | Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)
To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018).
In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.(Citation: Data Destruction - Threat Post)(Citation: DOJ - Cisco Insider) |
| x_mitre_data_sources[0] | File monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process command-line parameters | Command: Command Execution |
| x_mitre_data_sources[2] | Process monitoring | File: File Modification |
| x_mitre_detection | Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\. | Use process monitoring to monitor the execution and command-line parameters of binaries that could be involved in data destruction activity, such as [SDelete](https://attack.mitre.org/software/S0195). Monitor for the creation of suspicious files as well as high unusual file modification activity. In particular, look for large quantities of file modifications in user directories and under C:\Windows\System32\.
In cloud environments, the occurrence of anomalous high-volume deletion events, such as the DeleteDBCluster and DeleteGlobalCluster events in AWS, or a high quantity of data deletion events, such as DeleteBucket, within a short period of time may indicate suspicious activity. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Data Destruction - Threat Post', 'description': 'Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020.', 'url': 'https://threatpost.com/hacker-puts-hosting-service-code-spaces-out-of-business/106761/'} |
| external_references | | {'source_name': 'DOJ - Cisco Insider', 'description': 'DOJ. (2020, August 26). San Jose Man Pleads Guilty To Damaging Cisco’s Network. Retrieved December 15, 2020.', 'url': 'https://www.justice.gov/usao-ndca/pr/san-jose-man-pleads-guilty-damaging-cisco-s-network'} |
| x_mitre_data_sources | | File: File Deletion |
| x_mitre_data_sources | | Image: Image Deletion |
| x_mitre_data_sources | | Instance: Instance Deletion |
| x_mitre_data_sources | | Snapshot: Snapshot Deletion |
| x_mitre_data_sources | | Cloud Storage: Cloud Storage Deletion |
| x_mitre_data_sources | | Volume: Volume Deletion |
| x_mitre_platforms | | Windows |
| x_mitre_platforms | | IaaS |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | Windows | |
[T1486] Data Encrypted for Impact
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may encrypt data on target systems or on large n | t | Adversaries may encrypt data on target systems or on large n |
| umbers of systems in a network to interrupt availability to | | umbers of systems in a network to interrupt availability to |
| system and network resources. They can attempt to render sto | | system and network resources. They can attempt to render sto |
| red data inaccessible by encrypting files or data on local a | | red data inaccessible by encrypting files or data on local a |
| nd remote drives and withholding access to a decryption key. | | nd remote drives and withholding access to a decryption key. |
| This may be done in order to extract monetary compensation | | This may be done in order to extract monetary compensation |
| from a victim in exchange for decryption or a decryption key | | from a victim in exchange for decryption or a decryption key |
| (ransomware) or to render data permanently inaccessible in | | (ransomware) or to render data permanently inaccessible in |
| cases where the key is not saved or transmitted.(Citation: U | | cases where the key is not saved or transmitted.(Citation: U |
| S-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Cit | | S-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Cit |
| ation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) | | ation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) |
| In the case of ransomware, it is typical that common user f | | In the case of ransomware, it is typical that common user f |
| iles like Office documents, PDFs, images, videos, audio, tex | | iles like Office documents, PDFs, images, videos, audio, tex |
| t, and source code files will be encrypted. In some cases, a | | t, and source code files will be encrypted. In some cases, a |
| dversaries may encrypt critical system files, disk partition | | dversaries may encrypt critical system files, disk partition |
| s, and the MBR.(Citation: US-CERT NotPetya 2017) To maximiz | | s, and the MBR.(Citation: US-CERT NotPetya 2017) To maximiz |
| e impact on the target organization, malware designed for en | | e impact on the target organization, malware designed for en |
| crypting data may have worm-like features to propagate acros | | crypting data may have worm-like features to propagate acros |
| s a network by leveraging other attack techniques like [Vali | | s a network by leveraging other attack techniques like [Vali |
| d Accounts](https://attack.mitre.org/techniques/T1078), [OS | | d Accounts](https://attack.mitre.org/techniques/T1078), [OS |
| Credential Dumping](https://attack.mitre.org/techniques/T100 | | Credential Dumping](https://attack.mitre.org/techniques/T100 |
| 3), and [SMB/Windows Admin Shares](https://attack.mitre.org/ | | 3), and [SMB/Windows Admin Shares](https://attack.mitre.org/ |
| techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Cita | | techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Cita |
| tion: US-CERT NotPetya 2017) | | tion: US-CERT NotPetya 2017) In cloud environments, storage |
| | | objects within compromised accounts may also be encrypted.( |
| | | Citation: Rhino S3 Ransomware Part 1) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Oleg Kolesnikov, Securonix'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-14 14:52:11.708000+00:00 | 2021-04-20 16:39:06.594000+00:00 |
| description | Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) | Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017)
To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)
In cloud environments, storage objects within compromised accounts may also be encrypted.(Citation: Rhino S3 Ransomware Part 1) |
| x_mitre_data_sources[0] | Kernel drivers | Cloud Storage: Cloud Storage Metadata |
| x_mitre_data_sources[1] | File monitoring | Cloud Storage: Cloud Storage Modification |
| x_mitre_data_sources[2] | Process command-line parameters | Process: Process Creation |
| x_mitre_data_sources[3] | Process monitoring | Command: Command Execution |
| x_mitre_detection | Use process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories.
In some cases, monitoring for unusual kernel driver installation activity can aid in detection. | Use process monitoring to monitor the execution and command line parameters of binaries involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit. Monitor for the creation of suspicious files as well as unusual file modification activity. In particular, look for large quantities of file modifications in user directories.
In some cases, monitoring for unusual kernel driver installation activity can aid in detection.
In cloud environments, monitor for events that indicate storage objects have been anomalously replaced by copies. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Rhino S3 Ransomware Part 1', 'description': 'Gietzen, S. (n.d.). S3 Ransomware Part 1: Attack Vector. Retrieved April 14, 2021.', 'url': 'https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/'} |
| x_mitre_data_sources | | File: File Modification |
| x_mitre_data_sources | | File: File Creation |
| x_mitre_platforms | | IaaS |
[T1074] Data Staged
Current version: 1.3
Version changed from: 1.2 → 1.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:48:08.180000+00:00 | 2021-03-08 10:33:00.855000+00:00 |
| x_mitre_data_sources[0] | File monitoring | File: File Access |
| x_mitre_data_sources[1] | Process monitoring | File: File Creation |
| x_mitre_data_sources[2] | Process command-line parameters | Command: Command Execution |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1530] Data from Cloud Storage Object
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-09 14:02:05.276000+00:00 | 2021-03-08 10:33:01.374000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Cloud Storage: Cloud Storage Access |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1213] Data from Information Repositories
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-12 12:16:55.085000+00:00 | 2021-04-14 14:16:12.151000+00:00 |
| x_mitre_data_sources[0] | OAuth audit logs | Logon Session: Logon Session Creation |
| x_mitre_data_sources[1] | Application logs | Application Log: Application Log Content |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Authentication logs | |
| x_mitre_data_sources | Data loss prevention | |
| x_mitre_data_sources | Third-party application logs | |
[T1491] Defacement
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-04-22 15:19:31.682000+00:00 | 2021-03-08 10:33:01.150000+00:00 |
| x_mitre_data_sources[0] | Packet capture | File: File Modification |
| x_mitre_data_sources[1] | Web application firewall logs | File: File Creation |
| x_mitre_data_sources[2] | Web logs | Application Log: Application Log Content |
| x_mitre_data_sources[3] | Packet capture | Network Traffic: Network Traffic Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1078.001] Valid Accounts: Default Accounts
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may obtain and abuse credentials of a default ac | t | Adversaries may obtain and abuse credentials of a default ac |
| count as a means of gaining Initial Access, Persistence, Pri | | count as a means of gaining Initial Access, Persistence, Pri |
| vilege Escalation, or Defense Evasion. Default accounts are | | vilege Escalation, or Defense Evasion. Default accounts are |
| those that are built-into an OS, such as the Guest or Admini | | those that are built-into an OS, such as the Guest or Admini |
| strator accounts on Windows systems or default factory/provi | | strator accounts on Windows systems. Default accounts also i |
| der set accounts on other types of systems, software, or dev | | nclude default factory/provider set accounts on other types |
| ices.(Citation: Microsoft Local Accounts Feb 2019) Default | | of systems, software, or devices, including the root user ac |
| accounts are not limited to client machines, rather also inc | | count in AWS and the default service account in Kubernetes.( |
| lude accounts that are preset for equipment such as network | | Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS R |
| devices and computer applications whether they are internal, | | oot User)(Citation: Threat Matrix for Kubernetes) Default a |
| open source, or commercial. Appliances that come preset wit | | ccounts are not limited to client machines, rather also incl |
| h a username and password combination pose a serious threat | | ude accounts that are preset for equipment such as network d |
| to organizations that do not change it post installation, as | | evices and computer applications whether they are internal, |
| they are easy targets for an adversary. Similarly, adversar | | open source, or commercial. Appliances that come preset with |
| ies may also utilize publicly disclosed or stolen [Private K | | a username and password combination pose a serious threat t |
| eys](https://attack.mitre.org/techniques/T1552/004) or crede | | o organizations that do not change it post installation, as |
| ntial materials to legitimately connect to remote environmen | | they are easy targets for an adversary. Similarly, adversari |
| ts via [Remote Services](https://attack.mitre.org/techniques | | es may also utilize publicly disclosed or stolen [Private Ke |
| /T1021).(Citation: Metasploit SSH Module) | | ys](https://attack.mitre.org/techniques/T1552/004) or creden |
| | | tial materials to legitimately connect to remote environment |
| | | s via [Remote Services](https://attack.mitre.org/techniques/ |
| | | T1021).(Citation: Metasploit SSH Module) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 19:41:43.491000+00:00 | 2021-04-05 20:14:26.846000+00:00 |
| description | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems or default factory/provider set accounts on other types of systems, software, or devices.(Citation: Microsoft Local Accounts Feb 2019)
Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module) | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)
Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen [Private Keys](https://attack.mitre.org/techniques/T1552/004) or credential materials to legitimately connect to remote environments via [Remote Services](https://attack.mitre.org/techniques/T1021).(Citation: Metasploit SSH Module) |
| external_references[3]['source_name'] | Metasploit SSH Module | AWS Root User |
| external_references[3]['description'] | undefined. (n.d.). Retrieved April 12, 2019. | Amazon. (n.d.). AWS Account Root User. Retrieved April 5, 2021. |
| external_references[3]['url'] | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh | https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html |
| x_mitre_data_sources[0] | AWS CloudTrail logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Stackdriver logs | Logon Session: Logon Session Creation |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_platforms[8] | SaaS | Containers |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Threat Matrix for Kubernetes', 'description': 'Weizman, Y. (2020, April 2). Threat Matrix for Kubernetes. Retrieved March 30, 2021.', 'url': 'https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/'} |
| external_references | | {'source_name': 'Metasploit SSH Module', 'description': 'Metasploit. (n.d.). Retrieved April 12, 2019.', 'url': 'https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh'} |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Authentication logs | |
| x_mitre_data_sources | Process monitoring | |
[T1578.003] Modify Cloud Compute Infrastructure: Delete Cloud Instance
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:55:23.113000+00:00 | 2021-03-08 10:33:02.083000+00:00 |
| x_mitre_data_sources[0] | GCP audit logs | Instance: Instance Deletion |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1588.004] Obtain Capabilities: Digital Certificates
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Before compromising a victim, adversaries may buy and/or ste | t | Adversaries may buy and/or steal SSL/TLS certificates that c |
| al SSL/TLS certificates that can be used during targeting. S | | an be used during targeting. SSL/TLS certificates are design |
| SL/TLS certificates are designed to instill trust. They incl | | ed to instill trust. They include information about the key, |
| ude information about the key, information about its owner's | | information about its owner's identity, and the digital sig |
| identity, and the digital signature of an entity that has v | | nature of an entity that has verified the certificate's cont |
| erified the certificate's contents are correct. If the signa | | ents are correct. If the signature is valid, and the person |
| ture is valid, and the person examining the certificate trus | | examining the certificate trusts the signer, then they know |
| ts the signer, then they know they can use that key to commu | | they can use that key to communicate with its owner. Advers |
| nicate with its owner. Adversaries may purchase or steal SS | | aries may purchase or steal SSL/TLS certificates to further |
| L/TLS certificates to further their operations, such as encr | | their operations, such as encrypting C2 traffic (ex: [Asymme |
| ypting C2 traffic (ex: [Web Protocols](https://attack.mitre. | | tric Cryptography](https://attack.mitre.org/techniques/T1573 |
| org/techniques/T1071/001)) or even enabling [Man-in-the-Midd | | /002) with [Web Protocols](https://attack.mitre.org/techniqu |
| le](https://attack.mitre.org/techniques/T1557) if the certif | | es/T1071/001)) or even enabling [Man-in-the-Middle](https:// |
| icate is trusted or otherwise added to the root of trust (i. | | attack.mitre.org/techniques/T1557) if the certificate is tru |
| e. [Install Root Certificate](https://attack.mitre.org/techn | | sted or otherwise added to the root of trust (i.e. [Install |
| iques/T1553/004)). The purchase of digital certificates may | | Root Certificate](https://attack.mitre.org/techniques/T1553/ |
| be done using a front organization or using information stol | | 004)). The purchase of digital certificates may be done usin |
| en from a previously compromised entity that allows the adve | | g a front organization or using information stolen from a pr |
| rsary to validate to a certificate provider as that entity. | | eviously compromised entity that allows the adversary to val |
| Adversaries may also steal certificate materials directly fr | | idate to a certificate provider as that entity. Adversaries |
| om a compromised third-party, including from certificate aut | | may also steal certificate materials directly from a comprom |
| horities.(Citation: DiginotarCompromise) Certificate author | | ised third-party, including from certificate authorities.(Ci |
| ities exist that allow adversaries to acquire SSL/TLS certif | | tation: DiginotarCompromise) Adversaries may register or hij |
| icates, such as domain validation certificates, for free.(Ci | | ack domains that they will later purchase an SSL/TLS certifi |
| tation: Let's Encrypt FAQ) Adversaries may register or hija | | cate for. Certificate authorities exist that allow adversar |
| ck domains that they will later purchase an SSL/TLS certific | | ies to acquire SSL/TLS certificates, such as domain validati |
| ate for. | | on certificates, for free.(Citation: Let's Encrypt FAQ) Aft |
| | | er obtaining a digital certificate, an adversary may then in |
| | | stall that certificate (see [Install Digital Certificate](ht |
| | | tps://attack.mitre.org/techniques/T1608/003)) on infrastruct |
| | | ure under their control. |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | ['SSL/TLS certificates'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-22 18:18:54.959000+00:00 | 2021-04-15 02:32:49.507000+00:00 |
| description | Before compromising a victim, adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise)
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)
Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for. | Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)
After obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control. |
| x_mitre_version | 1.0 | 1.1 |
[T1587.003] Develop Capabilities: Digital Certificates
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Before compromising a victim, adversaries may create self-si | t | Adversaries may create self-signed SSL/TLS certificates that |
| gned SSL/TLS certificates that can be used during targeting. | | can be used during targeting. SSL/TLS certificates are desi |
| SSL/TLS certificates are designed to instill trust. They in | | gned to instill trust. They include information about the ke |
| clude information about the key, information about its owner | | y, information about its owner's identity, and the digital s |
| 's identity, and the digital signature of an entity that has | | ignature of an entity that has verified the certificate's co |
| verified the certificate's contents are correct. If the sig | | ntents are correct. If the signature is valid, and the perso |
| nature is valid, and the person examining the certificate tr | | n examining the certificate trusts the signer, then they kno |
| usts the signer, then they know they can use that key to com | | w they can use that key to communicate with its owner. In th |
| municate with its owner. In the case of self-signing, digita | | e case of self-signing, digital certificates will lack the e |
| l certificates will lack the element of trust associated wit | | lement of trust associated with the signature of a third-par |
| h the signature of a third-party certificate authority (CA). | | ty certificate authority (CA). Adversaries may create self- |
| Adversaries may create self-signed SSL/TLS certificates th | | signed SSL/TLS certificates that can be used to further thei |
| at can be used to further their operations, such as encrypti | | r operations, such as encrypting C2 traffic (ex: [Asymmetric |
| ng C2 traffic (ex: [Web Protocols](https://attack.mitre.org/ | | Cryptography](https://attack.mitre.org/techniques/T1573/002 |
| techniques/T1071/001)) or even enabling [Man-in-the-Middle]( | | ) with [Web Protocols](https://attack.mitre.org/techniques/T |
| https://attack.mitre.org/techniques/T1557) if added to the r | | 1071/001)) or even enabling [Man-in-the-Middle](https://atta |
| oot of trust (i.e. [Install Root Certificate](https://attack | | ck.mitre.org/techniques/T1557) if added to the root of trust |
| .mitre.org/techniques/T1553/004)). | | (i.e. [Install Root Certificate](https://attack.mitre.org/t |
| | | echniques/T1553/004)). After creating a digital certificate |
| | | , an adversary may then install that certificate (see [Insta |
| | | ll Digital Certificate](https://attack.mitre.org/techniques/ |
| | | T1608/003)) on infrastructure under their control. |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | ['SSL/TLS certificates'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-22 18:18:08.422000+00:00 | 2021-04-15 02:33:38.589000+00:00 |
| description | Before compromising a victim, adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).
Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). | Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).
Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).
After creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control. |
| x_mitre_version | 1.0 | 1.1 |
[T1498.001] Network Denial of Service: Direct Network Flood
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:57:12.410000+00:00 | 2021-03-29 16:11:56.727000+00:00 |
| x_mitre_data_sources[0] | Sensor health and status | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network protocol analysis | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure AD | Linux |
| x_mitre_platforms[6] | SaaS | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Netflow/Enclave netflow | |
| x_mitre_data_sources | Network intrusion detection system | |
| x_mitre_data_sources | Network device logs | |
| x_mitre_platforms | Office 365 | |
[T1562.008] Impair Defenses: Disable Cloud Logs
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 16:31:34.489000+00:00 | 2021-03-15 16:43:04.273000+00:00 |
| x_mitre_contributors[4] | AttackIQ | Alex Soler, AttackIQ |
| x_mitre_data_sources[0] | AWS CloudTrail logs | Cloud Service: Cloud Service Modification |
| x_mitre_data_sources[1] | Azure activity logs | Cloud Service: Cloud Service Disable |
| x_mitre_platforms[0] | GCP | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Syed Ummar Farooqh, McAfee |
| x_mitre_contributors | | Prasad Somasamudram, McAfee |
| x_mitre_contributors | | Sekhar Sarukkai, McAfee |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | Sekhar Sarukkai; Prasad Somasamudram; Syed Ummar Farooqh (McAfee) | |
| x_mitre_data_sources | GCP audit logs | |
| x_mitre_platforms | Azure | |
| x_mitre_platforms | AWS | |
[T1562.007] Impair Defenses: Disable or Modify Cloud Firewall
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 20:02:24.426000+00:00 | 2021-03-08 10:33:02.146000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Firewall: Firewall Rule Modification |
| x_mitre_data_sources[1] | GCP audit logs | Firewall: Firewall Disable |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Azure activity logs | |
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1562.001] Impair Defenses: Disable or Modify Tools
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Ziv Karliner, @ziv_kr, Team Nautilus Aqua Security', 'Nathaniel Quist, Palo Alto Networks', 'Gal Singer, @galsinger29, Team Nautilus Aqua Security'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-29 21:52:43.151000+00:00 | 2021-04-19 13:41:17.746000+00:00 |
| x_mitre_data_sources[0] | Process command-line parameters | Process: Process Termination |
| x_mitre_data_sources[1] | Windows Registry | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[2] | Services | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[3] | File monitoring | Command: Command Execution |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Service: Service Metadata |
| x_mitre_data_sources | | Sensor Health: Host Status |
| x_mitre_platforms | | Containers |
| x_mitre_platforms | | IaaS |
[T1087.003] Account Discovery: Email Account
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may attempt to get a listing of email addresses | t | Adversaries may attempt to get a listing of email addresses |
| and accounts. Adversaries may try to dump Exchange address l | | and accounts. Adversaries may try to dump Exchange address l |
| ists such as global address lists (GALs).(Citation: Microsof | | ists such as global address lists (GALs).(Citation: Microsof |
| t Exchange Address Lists) In on-premises Exchange and Excha | | t Exchange Address Lists) In on-premises Exchange and Excha |
| nge Online, the<code>Get-GlobalAddressList</code> PowerShell | | nge Online, the<code>Get-GlobalAddressList</code> PowerShell |
| cmdlet can be used to obtain email addresses and accounts f | | cmdlet can be used to obtain email addresses and accounts f |
| rom a domain using an authenticated session.(Citation: Micro | | rom a domain using an authenticated session.(Citation: Micro |
| soft getglobaladdresslist)(Citation: Black Hills Attacking E | | soft getglobaladdresslist)(Citation: Black Hills Attacking E |
| xchange MailSniper, 2016) | | xchange MailSniper, 2016) In Google Workspace, the GAL is s |
| | | hared with Microsoft Outlook users through the Google Worksp |
| | | ace Sync for Microsoft Outlook (GWSMO) service. Additionally |
| | | , the Google Workspace Directory allows for users to get a l |
| | | isting of other users within the organization.(Citation: Goo |
| | | gle Workspace Global Access List) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 15:27:58.933000+00:00 | 2021-03-31 13:10:46.302000+00:00 |
| description | Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)
In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) | Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)
In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016)
In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List) |
| x_mitre_data_sources[0] | Office 365 account logs | User Account: User Account Metadata |
| x_mitre_data_sources[1] | Process monitoring | Command: Command Execution |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Google Workspace Global Access List', 'description': 'Google. (n.d.). Retrieved March 16, 2021.', 'url': 'https://support.google.com/a/answer/166870?hl=en'} |
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process command-line parameters | |
[T1114] Email Collection
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-24 18:31:06.417000+00:00 | 2021-04-14 14:22:44.435000+00:00 |
| x_mitre_data_sources[0] | Office 365 trace logs | File: File Access |
| x_mitre_data_sources[1] | Mail server | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[2] | Email gateway | Logon Session: Logon Session Creation |
| x_mitre_data_sources[3] | Authentication logs | Command: Command Execution |
| x_mitre_data_sources[4] | File monitoring | Application Log: Application Log Content |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Process use of network | |
[T1114.003] Email Collection: Email Forwarding Rule
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may setup email forwarding rules to collect sens | t | Adversaries may setup email forwarding rules to collect sens |
| itive information. Adversaries may abuse email-forwarding ru | | itive information. Adversaries may abuse email-forwarding ru |
| les to monitor the activities of a victim, steal information | | les to monitor the activities of a victim, steal information |
| , and further gain intelligence on the victim or the victim’ | | , and further gain intelligence on the victim or the victim’ |
| s organization to use as part of further exploits or operati | | s organization to use as part of further exploits or operati |
| ons.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook W | | ons.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook W |
| eb App (OWA) allow users to create inbox rules for various e | | eb App (OWA) allow users to create inbox rules for various e |
| mail functions, including forwarding to a different recipien | | mail functions, including forwarding to a different recipien |
| t. Messages can be forwarded to internal or external recipie | | t. Similarly, Google Workspace users or administrators can s |
| nts, and there are no restrictions limiting the extent of th | | et up mail forwarding rules via the Google Workspace web int |
| is rule. Administrators may also create forwarding rules for | | erface. Messages can be forwarded to internal or external re |
| user accounts with the same considerations and outcomes.(Ci | | cipients, and there are no restrictions limiting the extent |
| tation: Microsoft Tim McMichael Exchange Mail Forwarding 2) | | of this rule. Administrators may also create forwarding rule |
| Any user or administrator within the organization (or adve | | s for user accounts with the same considerations and outcome |
| rsary with valid credentials) can create rules to automatica | | s.(Citation: Microsoft Tim McMichael Exchange Mail Forwardin |
| lly forward all received messages to another recipient, forw | | g 2) Any user or administrator within the organization (or |
| ard emails to different locations based on the sender, and m | | adversary with valid credentials) can create rules to autom |
| ore. | | atically forward all received messages to another recipient, |
| | | forward emails to different locations based on the sender, |
| | | and more. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 22:43:45.509000+00:00 | 2021-03-25 13:08:30.699000+00:00 |
| description | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Similarly, Google Workspace users or administrators can set up mail forwarding rules via the Google Workspace web interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)
Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. |
| x_mitre_data_sources[0] | Process use of network | Application Log: Application Log Content |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Email gateway | |
| x_mitre_data_sources | Mail server | |
| x_mitre_data_sources | Office 365 trace logs | |
[T1499] Endpoint Denial of Service
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Alfredo Oliveira, Trend Micro', 'David Fiser, @anu4is, Trend Micro', 'Magno Logan, @magnologan, Trend Micro', 'Vishwas Manral, McAfee', 'Yossi Weizman, Azure Defender Research Team'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:56:03.459000+00:00 | 2021-04-14 12:05:31.985000+00:00 |
| x_mitre_data_sources[0] | SSL/TLS inspection | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Web logs | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Web application firewall logs | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[3] | Network intrusion detection system | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_platforms[8] | SaaS | Containers |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network protocol analysis | |
| x_mitre_data_sources | Network device logs | |
| x_mitre_data_sources | Netflow/Enclave netflow | |
[T1585] Establish Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Before compromising a victim, adversaries may create and cul | t | Adversaries may create and cultivate accounts with services |
| tivate accounts with services that can be used during target | | that can be used during targeting. Adversaries can create ac |
| ing. Adversaries can create accounts that can be used to bui | | counts that can be used to build a persona to further operat |
| ld a persona to further operations. Persona development cons | | ions. Persona development consists of the development of pub |
| ists of the development of public information, presence, his | | lic information, presence, history and appropriate affiliati |
| tory and appropriate affiliations. This development could be | | ons. This development could be applied to social media, webs |
| applied to social media, website, or other publicly availab | | ite, or other publicly available information that could be r |
| le information that could be referenced and scrutinized for | | eferenced and scrutinized for legitimacy over the course of |
| legitimacy over the course of an operation using that person | | an operation using that persona or identity.(Citation: NEWSC |
| a or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatR | | ASTER2014)(Citation: BlackHatRobinSage) For operations inco |
| obinSage) For operations incorporating social engineering, | | rporating social engineering, the utilization of an online p |
| the utilization of an online persona may be important. These | | ersona may be important. These personas may be fictitious or |
| personas may be fictitious or impersonate real people. The | | impersonate real people. The persona may exist on a single |
| persona may exist on a single site or across multiple sites | | site or across multiple sites (ex: Facebook, LinkedIn, Twitt |
| (ex: Facebook, LinkedIn, Twitter, Google, etc.). Establishin | | er, Google, GitHub, Docker Hub, etc.). Establishing a person |
| g a persona may require development of additional documentat | | a may require development of additional documentation to mak |
| ion to make them seem real. This could include filling out p | | e them seem real. This could include filling out profile inf |
| rofile information, developing social networks, or incorpora | | ormation, developing social networks, or incorporating photo |
| ting photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRob | | s.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage) E |
| inSage) Establishing accounts can also include the creation | | stablishing accounts can also include the creation of accoun |
| of accounts with email providers, which may be directly lev | | ts with email providers, which may be directly leveraged for |
| eraged for [Phishing for Information](https://attack.mitre.o | | [Phishing for Information](https://attack.mitre.org/techniq |
| rg/techniques/T1598) or [Phishing](https://attack.mitre.org/ | | ues/T1598) or [Phishing](https://attack.mitre.org/techniques |
| techniques/T1566).(Citation: Mandiant APT1) | | /T1566).(Citation: Mandiant APT1) |
Details
dictionary_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | ['Social media monitoring'] | |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-22 18:20:40.675000+00:00 | 2021-04-15 03:10:35.877000+00:00 |
| description | Before compromising a victim, adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) | Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
For operations incorporating social engineering, the utilization of an online persona may be important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, etc.). Establishing a persona may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) |
| x_mitre_version | 1.0 | 1.1 |
[T1190] Exploit Public-Facing Application
Current version: 2.3
Version changed from: 2.2 → 2.3
|
|
|---|
| t | Adversaries may attempt to take advantage of a weakness in a | t | Adversaries may attempt to take advantage of a weakness in a |
| n Internet-facing computer or program using software, data, | | n Internet-facing computer or program using software, data, |
| or commands in order to cause unintended or unanticipated be | | or commands in order to cause unintended or unanticipated be |
| havior. The weakness in the system can be a bug, a glitch, o | | havior. The weakness in the system can be a bug, a glitch, o |
| r a design vulnerability. These applications are often websi | | r a design vulnerability. These applications are often websi |
| tes, but can include databases (like SQL)(Citation: NVD CVE- | | tes, but can include databases (like SQL)(Citation: NVD CVE- |
| 2016-6662), standard services (like SMB(Citation: CIS Multip | | 2016-6662), standard services (like SMB(Citation: CIS Multip |
| le SMB Vulnerabilities) or SSH), network device administrati | | le SMB Vulnerabilities) or SSH), network device administrati |
| on and management protocols (like SNMP and Smart Install(Cit | | on and management protocols (like SNMP and Smart Install(Cit |
| ation: US-CERT TA18-106A Network Infrastructure Devices 2018 | | ation: US-CERT TA18-106A Network Infrastructure Devices 2018 |
| )(Citation: Cisco Blog Legacy Device Attacks)), and any othe | | )(Citation: Cisco Blog Legacy Device Attacks)), and any othe |
| r applications with Internet accessible open sockets, such a | | r applications with Internet accessible open sockets, such a |
| s web servers and related services.(Citation: NVD CVE-2014-7 | | s web servers and related services.(Citation: NVD CVE-2014-7 |
| 169) Depending on the flaw being exploited this may include | | 169) Depending on the flaw being exploited this may include |
| [Exploitation for Defense Evasion](https://attack.mitre.org/ | | [Exploitation for Defense Evasion](https://attack.mitre.org/ |
| techniques/T1211). If an application is hosted on cloud-ba | | techniques/T1211). If an application is hosted on cloud-ba |
| sed infrastructure, then exploiting it may lead to compromis | | sed infrastructure and/or is containerized, then exploiting |
| e of the underlying instance. This can allow an adversary a | | it may lead to compromise of the underlying instance or cont |
| path to access the cloud APIs or to take advantage of weak i | | ainer. This can allow an adversary a path to access the clou |
| dentity and access management policies. For websites and da | | d or container APIs, exploit container host access via [Esca |
| tabases, the OWASP top 10 and CWE top 25 highlight the most | | pe to Host](https://attack.mitre.org/techniques/T1611), or t |
| common web-based vulnerabilities.(Citation: OWASP Top 10)(Ci | | ake advantage of weak identity and access management policie |
| tation: CWE top 25) | | s. For websites and databases, the OWASP top 10 and CWE top |
| | | 25 highlight the most common web-based vulnerabilities.(Cit |
| | | ation: OWASP Top 10)(Citation: CWE top 25) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-21 01:10:54.358000+00:00 | 2021-04-12 18:25:16.409000+00:00 |
| description | Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), network device administration and management protocols (like SNMP and Smart Install(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure, then exploiting it may lead to compromise of the underlying instance. This can allow an adversary a path to access the cloud APIs or to take advantage of weak identity and access management policies.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) | Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL)(Citation: NVD CVE-2016-6662), standard services (like SMB(Citation: CIS Multiple SMB Vulnerabilities) or SSH), network device administration and management protocols (like SNMP and Smart Install(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)), and any other applications with Internet accessible open sockets, such as web servers and related services.(Citation: NVD CVE-2014-7169) Depending on the flaw being exploited this may include [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211).
If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs, exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.
For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25) |
| x_mitre_data_sources[0] | Azure activity logs | Application Log: Application Log Content |
| x_mitre_data_sources[1] | AWS CloudTrail logs | Network Traffic: Network Traffic Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | Windows | IaaS |
| x_mitre_platforms[2] | macOS | Network |
| x_mitre_platforms[3] | AWS | Linux |
| x_mitre_platforms[4] | GCP | macOS |
| x_mitre_platforms[5] | Azure | Containers |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Yossi Weizman, Azure Defender Research Team |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Stackdriver logs | |
| x_mitre_data_sources | Packet capture | |
| x_mitre_data_sources | Web logs | |
| x_mitre_data_sources | Web application firewall logs | |
| x_mitre_data_sources | Application logs | |
| x_mitre_platforms | Network | |
[T1068] Exploitation for Privilege Escalation
Current version: 1.3
Version changed from: 1.2 → 1.3
|
|
|---|
| t | Adversaries may exploit software vulnerabilities in an attem | t | Adversaries may exploit software vulnerabilities in an attem |
| pt to collect elevate privileges. Exploitation of a software | | pt to elevate privileges. Exploitation of a software vulnera |
| vulnerability occurs when an adversary takes advantage of a | | bility occurs when an adversary takes advantage of a program |
| programming error in a program, service, or within the oper | | ming error in a program, service, or within the operating sy |
| ating system software or kernel itself to execute adversary- | | stem software or kernel itself to execute adversary-controll |
| controlled code. Security constructs such as permission leve | | ed code. Security constructs such as permission levels will |
| ls will often hinder access to information and use of certai | | often hinder access to information and use of certain techni |
| n techniques, so adversaries will likely need to perform pri | | ques, so adversaries will likely need to perform privilege e |
| vilege escalation to include use of software exploitation to | | scalation to include use of software exploitation to circumv |
| circumvent those restrictions. When initially gaining acce | | ent those restrictions. When initially gaining access to a |
| ss to a system, an adversary may be operating within a lower | | system, an adversary may be operating within a lower privile |
| privileged process which will prevent them from accessing c | | ged process which will prevent them from accessing certain r |
| ertain resources on the system. Vulnerabilities may exist, u | | esources on the system. Vulnerabilities may exist, usually i |
| sually in operating system components and software commonly | | n operating system components and software commonly running |
| running at higher permissions, that can be exploited to gain | | at higher permissions, that can be exploited to gain higher |
| higher levels of access on the system. This could enable so | | levels of access on the system. This could enable someone to |
| meone to move from unprivileged or user level permissions to | | move from unprivileged or user level permissions to SYSTEM |
| SYSTEM or root permissions depending on the component that | | or root permissions depending on the component that is vulne |
| is vulnerable. This may be a necessary step for an adversary | | rable. This could also enable an adversary to move from a vi |
| compromising a endpoint system that has been properly confi | | rtualized environment, such as within a virtual machine or c |
| gured and limits other privilege escalation methods. | | ontainer, onto the underlying host. This may be a necessary |
| | | step for an adversary compromising an endpoint system that h |
| | | as been properly configured and limits other privilege escal |
| | | ation methods. Adversaries may bring a signed vulnerable dr |
| | | iver onto a compromised machine so that they can exploit the |
| | | vulnerability to execute code in kernel mode. This process |
| | | is sometimes referred to as Bring Your Own Vulnerable Driver |
| | | (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Uni |
| | | t42 AcidBox June 2020) Adversaries may include the vulnerabl |
| | | e driver with files delivered during Initial Access or downl |
| | | oad it to a compromised system via [Ingress Tool Transfer](h |
| | | ttps://attack.mitre.org/techniques/T1105) or [Lateral Tool T |
| | | ransfer](https://attack.mitre.org/techniques/T1570). |
New Mitigations:
- M1038: Execution Prevention
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Joas Antonio dos Santos, @C0d3Cr4zy, Inmetrics', 'Yaniv Agman, @AgmanYaniv, Team Nautilus Aqua Security', 'Idan Revivo, @idanr86, Team Nautilus Aqua Security'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-26 21:12:49.194000+00:00 | 2021-04-22 16:13:34.896000+00:00 |
| description | Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This may be a necessary step for an adversary compromising a endpoint system that has been properly configured and limits other privilege escalation methods. | Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable. This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host. This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.
Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode. This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).(Citation: ESET InvisiMole June 2020)(Citation: Unit42 AcidBox June 2020) Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) or [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570). |
| x_mitre_data_sources[0] | Windows Error Reporting | Driver: Driver Load |
| x_mitre_detection | Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery.
Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges. | Detecting software exploitation may be difficult depending on the tools available. Software exploits may not always succeed or may cause the exploited process to become unstable or crash. Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes. This could include suspicious files written to disk, evidence of [Process Injection](https://attack.mitre.org/techniques/T1055) for attempts to hide execution or evidence of Discovery. Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.(Citation: Microsoft Driver Block Rules)
Higher privileges are often necessary to perform additional actions such as some methods of [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Look for additional activity that may indicate an adversary has gained higher privileges. |
| x_mitre_version | 1.2 | 1.3 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'ESET InvisiMole June 2020', 'description': 'Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.', 'url': 'https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf'} |
| external_references | | {'source_name': 'Unit42 AcidBox June 2020', 'description': 'Reichel, D. and Idrizovic, E. (2020, June 17). AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations. Retrieved March 16, 2021.', 'url': 'https://unit42.paloaltonetworks.com/acidbox-rare-malware/'} |
| external_references | | {'source_name': 'Microsoft Driver Block Rules', 'description': 'Microsoft. (2020, October 15). Microsoft recommended driver block rules. Retrieved March 16, 2021.', 'url': 'https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules'} |
| x_mitre_platforms | | Containers |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Application logs | |
[T1491.002] Defacement: External Defacement
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-04-22 15:19:31.380000+00:00 | 2021-03-08 10:33:01.745000+00:00 |
| x_mitre_data_sources[0] | Web logs | File: File Modification |
| x_mitre_data_sources[1] | Web application firewall logs | File: File Creation |
| x_mitre_data_sources[2] | Packet capture | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1133] External Remote Services
Current version: 2.2
Version changed from: 2.1 → 2.2
|
|
|---|
| t | Adversaries may leverage external-facing remote services to | t | Adversaries may leverage external-facing remote services to |
| initially access and/or persist within a network. Remote ser | | initially access and/or persist within a network. Remote ser |
| vices such as VPNs, Citrix, and other access mechanisms allo | | vices such as VPNs, Citrix, and other access mechanisms allo |
| w users to connect to internal enterprise network resources | | w users to connect to internal enterprise network resources |
| from external locations. There are often remote service gate | | from external locations. There are often remote service gate |
| ways that manage connections and credential authentication f | | ways that manage connections and credential authentication f |
| or these services. Services such as [Windows Remote Manageme | | or these services. Services such as [Windows Remote Manageme |
| nt](https://attack.mitre.org/techniques/T1021/006) can also | | nt](https://attack.mitre.org/techniques/T1021/006) can also |
| be used externally. Access to [Valid Accounts](https://atta | | be used externally. Access to [Valid Accounts](https://atta |
| ck.mitre.org/techniques/T1078) to use the service is often a | | ck.mitre.org/techniques/T1078) to use the service is often a |
| requirement, which could be obtained through credential pha | | requirement, which could be obtained through credential pha |
| rming or by obtaining the credentials from users after compr | | rming or by obtaining the credentials from users after compr |
| omising the enterprise network.(Citation: Volexity Virtual P | | omising the enterprise network.(Citation: Volexity Virtual P |
| rivate Keylogging) Access to remote services may be used as | | rivate Keylogging) Access to remote services may be used as |
| a redundant or persistent access mechanism during an operati | | a redundant or persistent access mechanism during an operati |
| on. | | on. Access may also be gained through an exposed service th |
| | | at doesn’t require authentication. In containerized environm |
| | | ents, this may include an exposed Docker API, Kubernetes API |
| | | server, kubelet, or web application such as the Kubernetes |
| | | dashboard.(Citation: Trend Micro Exposed Docker Server)(Cita |
| | | tion: Unit 42 Hildegard Malware) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-19 20:07:09.600000+00:00 | 2021-04-22 20:22:02.443000+00:00 |
| description | Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.
Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. | Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.
Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.
Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware) |
| x_mitre_data_sources[0] | Authentication logs | Application Log: Application Log Content |
| x_mitre_detection | Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours. | Follow best practices for detecting adversary use of [Valid Accounts](https://attack.mitre.org/techniques/T1078) for authenticating to remote services. Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.
When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application. |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Trend Micro Exposed Docker Server', 'description': 'Remillano II, A., et al. (2020, June 20). XORDDoS, Kaiji Variants Target Exposed Docker Servers. Retrieved April 5, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html'} |
| external_references | | {'source_name': 'Unit 42 Hildegard Malware', 'description': 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.', 'url': 'https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/'} |
| x_mitre_contributors | | ExtraHop |
| x_mitre_contributors | | David Fiser, @anu4is, Trend Micro |
| x_mitre_contributors | | Alfredo Oliveira, Trend Micro |
| x_mitre_contributors | | Idan Frimark, Cisco |
| x_mitre_contributors | | Rory McCune, Aqua Security |
| x_mitre_contributors | | Yuval Avrahami, Palo Alto Networks |
| x_mitre_contributors | | Jay Chen, Palo Alto Networks |
| x_mitre_contributors | | Brad Geesaman, @bradgeesaman |
| x_mitre_contributors | | Magno Logan, @magnologan, Trend Micro |
| x_mitre_contributors | | Ariel Shuper, Cisco |
| x_mitre_contributors | | Yossi Weizman, Azure Defender Research Team |
| x_mitre_contributors | | Vishwas Manral, McAfee |
| x_mitre_data_sources | | Logon Session: Logon Session Metadata |
| x_mitre_data_sources | | Network Traffic: Network Traffic Flow |
| x_mitre_platforms | | Containers |
[T1606] Forge Web Credentials
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-01-22 21:07:45.925000+00:00 | 2021-04-14 14:29:27.631000+00:00 |
| x_mitre_data_sources[0] | Web logs | Logon Session: Logon Session Creation |
| x_mitre_data_sources[1] | Authentication logs | Web Credential: Web Credential Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Web Credential: Web Credential Usage |
| x_mitre_platforms | | Google Workspace |
[T1558.001] Steal or Forge Kerberos Tickets: Golden Ticket
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Itamar Mizrahi, Cymptom'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-31 12:59:10.840000+00:00 | 2020-11-05 16:07:03.779000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | Active Directory: Active Directory Credential Request |
| x_mitre_data_sources[1] | Windows event logs | Logon Session: Logon Session Metadata |
| x_mitre_version | 1.0 | 1.1 |
[T1574] Hijack Execution Flow
Current version: 1.1
Version changed from: 1.0 → 1.1
New Mitigations:
- M1013: Application Developer Guidance
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-17 15:15:28.288000+00:00 | 2021-04-27 19:55:20.290000+00:00 |
| x_mitre_data_sources[0] | Environment variable | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[1] | Loaded DLLs | Process: Process Creation |
| x_mitre_data_sources[2] | Process command-line parameters | Module: Module Load |
| x_mitre_data_sources[3] | Process monitoring | Command: Command Execution |
| x_mitre_data_sources[4] | File monitoring | Service: Service Metadata |
| x_mitre_data_sources[5] | DLL monitoring | File: File Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | File: File Modification |
[T1562] Impair Defenses
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 16:31:35.249000+00:00 | 2021-04-24 13:59:13.144000+00:00 |
| x_mitre_data_sources[0] | GCP audit logs | Process: Process Termination |
| x_mitre_data_sources[1] | Azure activity logs | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Windows Registry: Windows Registry Key Deletion |
| x_mitre_data_sources[3] | Anti-virus | Command: Command Execution |
| x_mitre_data_sources[4] | Services | Service: Service Metadata |
| x_mitre_data_sources[5] | API monitoring | Sensor Health: Host Status |
| x_mitre_data_sources[6] | Environment variable | Script: Script Execution |
| x_mitre_data_sources[7] | Authentication logs | Firewall: Firewall Disable |
| x_mitre_data_sources[8] | File monitoring | Firewall: Firewall Rule Modification |
| x_mitre_data_sources[9] | Process command-line parameters | Cloud Service: Cloud Service Modification |
| x_mitre_data_sources[10] | Process monitoring | Cloud Service: Cloud Service Disable |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | Windows | Office 365 |
| x_mitre_platforms[2] | macOS | IaaS |
| x_mitre_platforms[3] | AWS | Linux |
| x_mitre_platforms[4] | GCP | macOS |
| x_mitre_platforms[5] | Azure | Containers |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Windows Registry | |
[T1070] Indicator Removal on Host
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may delete or alter generated artifacts on a hos | t | Adversaries may delete or alter generated artifacts on a hos |
| t system, including logs or captured files such as quarantin | | t system, including logs or captured files such as quarantin |
| ed malware. Locations and format of logs are platform or pro | | ed malware. Locations and format of logs are platform or pro |
| duct-specific, however standard operating system logs are ca | | duct-specific, however standard operating system logs are ca |
| ptured as Windows events or Linux/macOS files such as [Bash | | ptured as Windows events or Linux/macOS files such as [Bash |
| History](https://attack.mitre.org/techniques/T1139) and /var | | History](https://attack.mitre.org/techniques/T1552/003) and |
| /log/*. These actions may interfere with event collection, | | /var/log/*. These actions may interfere with event collecti |
| reporting, or other notifications used to detect intrusion a | | on, reporting, or other notifications used to detect intrusi |
| ctivity. This that may compromise the integrity of security | | on activity. This that may compromise the integrity of secur |
| solutions by causing notable events to go unreported. This a | | ity solutions by causing notable events to go unreported. Th |
| ctivity may also impede forensic analysis and incident respo | | is activity may also impede forensic analysis and incident r |
| nse, due to lack of sufficient data to determine what occurr | | esponse, due to lack of sufficient data to determine what oc |
| ed. | | curred. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-16 18:09:49.074000+00:00 | 2021-04-24 13:35:09.065000+00:00 |
| description | Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1139) and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. | Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred. |
| x_mitre_data_sources[0] | File monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process monitoring | File: File Deletion |
| x_mitre_data_sources[2] | Process command-line parameters | File: File Modification |
| x_mitre_data_sources[3] | API monitoring | Windows Registry: Windows Registry Key Modification |
| x_mitre_data_sources[4] | Windows event logs | Windows Registry: Windows Registry Key Deletion |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Brad Geesaman, @bradgeesaman |
| x_mitre_data_sources | | Process: OS API Execution |
| x_mitre_data_sources | | Command: Command Execution |
| x_mitre_data_sources | | Network Traffic: Network Traffic Content |
| x_mitre_data_sources | | User Account: User Account Authentication |
| x_mitre_data_sources | | File: File Metadata |
| x_mitre_platforms | | Containers |
[T1534] Internal Spearphishing
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-17 18:26:41.796000+00:00 | 2021-04-14 14:32:14.273000+00:00 |
| x_mitre_data_sources[0] | SSL/TLS inspection | Application Log: Application Log Content |
| x_mitre_data_sources[1] | DNS records | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[2] | Anti-virus | Network Traffic: Network Traffic Content |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Web proxy | |
| x_mitre_data_sources | File monitoring | |
| x_mitre_data_sources | Mail server | |
| x_mitre_data_sources | Office 365 trace logs | |
[T1547.006] Boot or Logon Autostart Execution: Kernel Modules and Extensions
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may modify the kernel to automatically execute p | t | Adversaries may modify the kernel to automatically execute p |
| rograms on system boot. Loadable Kernel Modules (LKMs) are p | | rograms on system boot. Loadable Kernel Modules (LKMs) are p |
| ieces of code that can be loaded and unloaded into the kerne | | ieces of code that can be loaded and unloaded into the kerne |
| l upon demand. They extend the functionality of the kernel w | | l upon demand. They extend the functionality of the kernel w |
| ithout the need to reboot the system. For example, one type | | ithout the need to reboot the system. For example, one type |
| of module is the device driver, which allows the kernel to a | | of module is the device driver, which allows the kernel to a |
| ccess hardware connected to the system. (Citation: Linux Ker | | ccess hardware connected to the system. (Citation: Linux Ker |
| nel Programming) When used maliciously, LKMs can be a type | | nel Programming) When used maliciously, LKMs can be a type |
| of kernel-mode [Rootkit](https://attack.mitre.org/technique | | of kernel-mode [Rootkit](https://attack.mitre.org/technique |
| s/T1014) that run with the highest operating system privileg | | s/T1014) that run with the highest operating system privileg |
| e (Ring 0). (Citation: Linux Kernel Module Programming Guide | | e (Ring 0). (Citation: Linux Kernel Module Programming Guide |
| ) Common features of LKM based rootkits include: hiding itse | | ) Common features of LKM based rootkits include: hiding itse |
| lf, selective hiding of files, processes and network activit | | lf, selective hiding of files, processes and network activit |
| y, as well as log tampering, providing authenticated backdoo | | y, as well as log tampering, providing authenticated backdoo |
| rs and enabling root access to non-privileged users. (Citati | | rs and enabling root access to non-privileged users. (Citati |
| on: iDefense Rootkit Overview) Kernel extensions, also call | | on: iDefense Rootkit Overview) Kernel extensions, also call |
| ed kext, are used for macOS to load functionality onto a sys | | ed kext, are used for macOS to load functionality onto a sys |
| tem similar to LKMs for Linux. They are loaded and unloaded | | tem similar to LKMs for Linux. They are loaded and unloaded |
| through <code>kextload</code> and <code>kextunload</code> co | | through <code>kextload</code> and <code>kextunload</code> co |
| mmands. Adversaries can use LKMs and kexts to covertly pers | | mmands. Since macOS Catalina 10.15, kernel extensions have b |
| ist on a system and elevate privileges. Examples have been f | | een deprecated on macOS systems.(Citation: Apple Kernel Exte |
| ound in the wild and there are some open source projects. (C | | nsion Deprecation) Adversaries can use LKMs and kexts to co |
| itation: Volatility Phalanx2) (Citation: CrowdStrike Linux R | | vertly persist on a system and elevate privileges. Examples |
| ootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorp | | have been found in the wild and there are some open source p |
| hine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Cit | | rojects. (Citation: Volatility Phalanx2) (Citation: CrowdStr |
| ation: Synack Secure Kernel Extension Broken)(Citation: Secu | | ike Linux Rootkit) (Citation: GitHub Reptile) (Citation: Git |
| relist Ventir) (Citation: Trend Micro Skidmap) | | Hub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick W |
| | | ardle) (Citation: Synack Secure Kernel Extension Broken)(Cit |
| | | ation: Securelist Ventir) (Citation: Trend Micro Skidmap) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-30 21:23:15.188000+00:00 | 2021-03-30 00:59:53.716000+00:00 |
| description | Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming)
When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)
Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands.
Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap) | Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming)
When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)
Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.(Citation: Apple Kernel Extension Deprecation)
Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap) |
| external_references[4]['source_name'] | Volatility Phalanx2 | Apple Kernel Extension Deprecation |
| external_references[4]['description'] | Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018. | Apple. (n.d.). Deprecated Kernel Extensions and System Extension Alternatives. Retrieved November 4, 2020. |
| external_references[4]['url'] | https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html | https://developer.apple.com/support/kernel-extensions/ |
| external_references[5]['source_name'] | CrowdStrike Linux Rootkit | Volatility Phalanx2 |
| external_references[5]['description'] | Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017. | Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018. |
| external_references[5]['url'] | https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/ | https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html |
| external_references[6]['source_name'] | GitHub Reptile | CrowdStrike Linux Rootkit |
| external_references[6]['description'] | Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018. | Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017. |
| external_references[6]['url'] | https://github.com/f0rb1dd3n/Reptile | https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/ |
| external_references[7]['source_name'] | GitHub Diamorphine | GitHub Reptile |
| external_references[7]['description'] | Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018. | Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018. |
| external_references[7]['url'] | https://github.com/m0nad/Diamorphine | https://github.com/f0rb1dd3n/Reptile |
| external_references[8]['source_name'] | RSAC 2015 San Francisco Patrick Wardle | GitHub Diamorphine |
| external_references[8]['description'] | Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018. | Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018. |
| external_references[8]['url'] | https://www.rsaconference.com/writable/presentations/file_upload/ht-r03-malware-persistence-on-os-x-yosemite_final.pdf | https://github.com/m0nad/Diamorphine |
| external_references[9]['source_name'] | Synack Secure Kernel Extension Broken | RSAC 2015 San Francisco Patrick Wardle |
| external_references[9]['description'] | Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018. | Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018. |
| external_references[9]['url'] | https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/ | https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf |
| external_references[10]['source_name'] | Securelist Ventir | Synack Secure Kernel Extension Broken |
| external_references[10]['description'] | Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018. | Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018. |
| external_references[10]['url'] | https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/ | https://www.synack.com/2017/09/08/high-sierras-secure-kernel-extension-loading-is-broken/ |
| external_references[11]['source_name'] | Trend Micro Skidmap | Securelist Ventir |
| external_references[11]['description'] | Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. | Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018. |
| external_references[11]['url'] | https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/ | https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/ |
| external_references[12]['source_name'] | Linux Loadable Kernel Module Insert and Remove LKMs | Trend Micro Skidmap |
| external_references[12]['description'] | Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018. | Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. |
| external_references[12]['url'] | http://tldp.org/HOWTO/Module-HOWTO/x197.html | https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/ |
| external_references[13]['source_name'] | Wikipedia Loadable Kernel Module | Linux Loadable Kernel Module Insert and Remove LKMs |
| external_references[13]['description'] | Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018. | Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018. |
| external_references[13]['url'] | https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux | http://tldp.org/HOWTO/Module-HOWTO/x197.html |
| x_mitre_data_sources[0] | Process monitoring | Command: Command Execution |
| x_mitre_data_sources[1] | Process command-line parameters | File: File Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Wikipedia Loadable Kernel Module', 'description': 'Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.', 'url': 'https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux'} |
| x_mitre_contributors | | Wayne Silva, F-Secure Countercept |
| x_mitre_data_sources | | Kernel: Kernel Module Load |
[T1087.001] Account Discovery: Local Account
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Daniel Stepanic, Elastic'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-20 19:39:59.544000+00:00 | 2021-04-13 21:39:08.728000+00:00 |
| x_mitre_data_sources[0] | API monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process monitoring | Command: Command Execution |
| x_mitre_data_sources[2] | Process command-line parameters | File: File Access |
| x_mitre_detection | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
Monitor for processes that can be used to enumerate user accounts, such as net.exe and net1.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'} |
[T1078.003] Valid Accounts: Local Accounts
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-23 21:48:41.083000+00:00 | 2021-04-05 12:51:00.663000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
| x_mitre_platforms | | Containers |
[T1127.001] Trusted Developer Utilities Proxy Execution: MSBuild
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may use MSBuild to proxy execution of code throu | t | Adversaries may use MSBuild to proxy execution of code throu |
| gh a trusted Windows utility. MSBuild.exe (Microsoft Build E | | gh a trusted Windows utility. MSBuild.exe (Microsoft Build E |
| ngine) is a software build platform used by Visual Studio. I | | ngine) is a software build platform used by Visual Studio. I |
| t handles XML formatted project files that define requiremen | | t handles XML formatted project files that define requiremen |
| ts for loading and building various platforms and configurat | | ts for loading and building various platforms and configurat |
| ions.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild | | ions.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild |
| to proxy execution of malicious code. The inline task capab | | to proxy execution of malicious code. The inline task capab |
| ility of MSBuild that was introduced in .NET version 4 allow | | ility of MSBuild that was introduced in .NET version 4 allow |
| s for C# code to be inserted into an XML project file.(Citat | | s for C# or Visual Basic code to be inserted into an XML pro |
| ion: MSDN MSBuild) MSBuild will compile and execute the inli | | ject file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBui |
| ne task. MSBuild.exe is a signed Microsoft binary, so when i | | ld Inline Tasks 2017) MSBuild will compile and execute the i |
| t is used this way it can execute arbitrary code and bypass | | nline task. MSBuild.exe is a signed Microsoft binary, so whe |
| application control defenses that are configured to allow MS | | n it is used this way it can execute arbitrary code and bypa |
| Build.exe execution.(Citation: LOLBAS Msbuild) | | ss application control defenses that are configured to allow |
| | | MSBuild.exe execution.(Citation: LOLBAS Msbuild) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Carrie Roberts, @OrOneEqualsOne'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-08 23:29:28.074000+00:00 | 2021-03-05 22:25:48.777000+00:00 |
| description | Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)
Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# code to be inserted into an XML project file.(Citation: MSDN MSBuild) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild) | Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)
Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild) |
| external_references[2]['source_name'] | LOLBAS Msbuild | Microsoft MSBuild Inline Tasks 2017 |
| external_references[2]['description'] | LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019. | Microsoft. (2017, September 21). MSBuild inline tasks. Retrieved March 5, 2021. |
| external_references[2]['url'] | https://lolbas-project.github.io/lolbas/Binaries/Msbuild/ | https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild-inline-tasks?view=vs-2019#code-element |
| x_mitre_data_sources[0] | Process monitoring | Process: Process Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'LOLBAS Msbuild', 'description': 'LOLBAS. (n.d.). Msbuild.exe. Retrieved July 31, 2019.', 'url': 'https://lolbas-project.github.io/lolbas/Binaries/Msbuild/'} |
| x_mitre_data_sources | | Command: Command Execution |
[T1587.001] Develop Capabilities: Malware
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Before compromising a victim, adversaries may develop malwar | t | Adversaries may develop malware and malware components that |
| e and malware components that can be used during targeting. | | can be used during targeting. Building malicious software ca |
| Building malicious software can include the development of p | | n include the development of payloads, droppers, post-compro |
| ayloads, droppers, post-compromise tools, backdoors, packers | | mise tools, backdoors (including backdoored images), packers |
| , C2 protocols, and the creation of infected removable media | | , C2 protocols, and the creation of infected removable media |
| . Adversaries may develop malware to support their operation | | . Adversaries may develop malware to support their operation |
| s, creating a means for maintaining control of remote machin | | s, creating a means for maintaining control of remote machin |
| es, evading defenses, and executing post-compromise behavior | | es, evading defenses, and executing post-compromise behavior |
| s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita | | s.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Cita |
| tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As | | tion: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As |
| with legitimate development efforts, different skill sets m | | with legitimate development efforts, different skill sets m |
| ay be required for developing malware. The skills needed may | | ay be required for developing malware. The skills needed may |
| be located in-house, or may need to be contracted out. Use | | be located in-house, or may need to be contracted out. Use |
| of a contractor may be considered an extension of that adver | | of a contractor may be considered an extension of that adver |
| sary's malware development capabilities, provided the advers | | sary's malware development capabilities, provided the advers |
| ary plays a role in shaping requirements and maintains a deg | | ary plays a role in shaping requirements and maintains a deg |
| ree of exclusivity to the malware. Some aspects of malware | | ree of exclusivity to the malware. Some aspects of malware |
| development, such as C2 protocol development, may require ad | | development, such as C2 protocol development, may require ad |
| versaries to obtain additional infrastructure. For example, | | versaries to obtain additional infrastructure. For example, |
| malware developed that will communicate with Twitter for C2, | | malware developed that will communicate with Twitter for C2, |
| may require use of [Web Services](https://attack.mitre.org/ | | may require use of [Web Services](https://attack.mitre.org/ |
| techniques/T1583/006).(Citation: FireEye APT29) | | techniques/T1583/006).(Citation: FireEye APT29) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-22 13:05:43.492000+00:00 | 2021-04-15 03:08:33.165000+00:00 |
| description | Before compromising a victim, adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors, packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)
As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.
Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29) | Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)
As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.
Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29) |
| x_mitre_version | 1.0 | 1.1 |
[T1036] Masquerading
Current version: 1.4
Version changed from: 1.3 → 1.4
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-09 13:54:28.727000+00:00 | 2021-04-24 13:24:45.840000+00:00 |
| external_references[3]['source_name'] | Endgame Masquerade Ball | Elastic Masquerade Ball |
| x_mitre_data_sources[0] | Process command-line parameters | Image: Image Metadata |
| x_mitre_data_sources[1] | File monitoring | Command: Command Execution |
| x_mitre_data_sources[2] | Process monitoring | Service: Service Metadata |
| x_mitre_data_sources[3] | Binary file metadata | Service: Service Creation |
| x_mitre_detection | Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)
Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”. | Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)
Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE”. |
| x_mitre_version | 1.3 | 1.4 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Scheduled Job: Scheduled Job Metadata |
| x_mitre_data_sources | | Scheduled Job: Scheduled Job Modification |
| x_mitre_data_sources | | File: File Metadata |
| x_mitre_data_sources | | Process: Process Metadata |
| x_mitre_data_sources | | File: File Modification |
| x_mitre_platforms | | Containers |
[T1036.005] Masquerading: Match Legitimate Name or Location
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may match or approximate the name or location of | t | Adversaries may match or approximate the name or location of |
| legitimate files when naming/placing their files. This is d | | legitimate files or resources when naming/placing them. Thi |
| one for the sake of evading defenses and observation. This m | | s is done for the sake of evading defenses and observation. |
| ay be done by placing an executable in a commonly trusted di | | This may be done by placing an executable in a commonly trus |
| rectory (ex: under System32) or giving it the name of a legi | | ted directory (ex: under System32) or giving it the name of |
| timate, trusted program (ex: svchost.exe). Alternatively, th | | a legitimate, trusted program (ex: svchost.exe). In containe |
| e filename given may be a close approximation of legitimate | | rized environments, this may also be done by creating a reso |
| programs or something innocuous. Adversaries may also use t | | urce in a namespace that matches the naming convention of a |
| he same icon of the file they are trying to mimic. | | container pod or cluster. Alternatively, a file or container |
| | | image name given may be a close approximation to legitimate |
| | | programs/images or something innocuous. Adversaries may al |
| | | so use the same icon of the file they are trying to mimic. |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Yossi Weizman, Azure Defender Research Team', 'Vishwas Manral, McAfee'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-20 22:11:45.970000+00:00 | 2021-04-20 19:23:37.762000+00:00 |
| description | Adversaries may match or approximate the name or location of legitimate files when naming/placing their files. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). Alternatively, the filename given may be a close approximation of legitimate programs or something innocuous.
Adversaries may also use the same icon of the file they are trying to mimic. | Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
Adversaries may also use the same icon of the file they are trying to mimic. |
| external_references[2]['source_name'] | Endgame Masquerade Ball | Elastic Masquerade Ball |
| x_mitre_data_sources[0] | File monitoring | Image: Image Metadata |
| x_mitre_data_sources[1] | Process monitoring | File: File Metadata |
| x_mitre_data_sources[2] | Process command-line parameters | Process: Process Metadata |
| x_mitre_detection | Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Endgame Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update) | Collect file hashes; file names that do not match their expected hash are suspect. Perform file monitoring; files with known names but in unusual locations are suspect. Likewise, files that are modified outside of an update or patch are suspect.
If file names are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled. Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity. (Citation: Elastic Masquerade Ball) Do not focus on the possible names a file could have, but instead on the command-line arguments that are known to be used and are distinct because it will have a better rate of detection.(Citation: Twitter ItsReallyNick Masquerading Update)
In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.(Citation: Docker Images) Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users. |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Docker Images', 'description': 'Docker. (n.d.). Docker Images. Retrieved April 6, 2021.', 'url': 'https://docs.docker.com/engine/reference/commandline/images/'} |
| x_mitre_platforms | | Containers |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Binary file metadata | |
[T1578] Modify Cloud Compute Infrastructure
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:55:23.798000+00:00 | 2021-04-20 14:51:01.759000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Instance: Instance Stop |
| x_mitre_data_sources[1] | GCP audit logs | Instance: Instance Start |
| x_mitre_data_sources[2] | Azure activity logs | Instance: Instance Creation |
| x_mitre_data_sources[3] | AWS CloudTrail logs | Instance: Instance Modification |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Instance: Instance Deletion |
| x_mitre_data_sources | | Snapshot: Snapshot Creation |
| x_mitre_data_sources | | Snapshot: Snapshot Modification |
| x_mitre_data_sources | | Snapshot: Snapshot Deletion |
| x_mitre_data_sources | | Volume: Volume Creation |
| x_mitre_data_sources | | Volume: Volume Modification |
| x_mitre_data_sources | | Volume: Volume Deletion |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1218.007] Signed Binary Proxy Execution: Msiexec
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may abuse msiexec.exe to proxy execution of mali | t | Adversaries may abuse msiexec.exe to proxy execution of mali |
| cious payloads. Msiexec.exe is the command-line utility for | | cious payloads. Msiexec.exe is the command-line utility for |
| the Windows Installer and is thus commonly associated with e | | the Windows Installer and is thus commonly associated with e |
| xecuting installation packages (.msi).(Citation: Microsoft m | | xecuting installation packages (.msi).(Citation: Microsoft m |
| siexec) Msiexec.exe is digitally signed by Microsoft. Adver | | siexec) Msiexec.exe is digitally signed by Microsoft. Adver |
| saries may abuse msiexec.exe to launch local or network acce | | saries may abuse msiexec.exe to launch local or network acce |
| ssible MSI files. Msiexec.exe can also execute DLLs.(Citatio | | ssible MSI files. Msiexec.exe can also execute DLLs.(Citatio |
| n: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Si | | n: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Si |
| nce it is signed and native on Windows systems, msiexec.exe | | nce it is signed and native on Windows systems, msiexec.exe |
| can be used to bypass application control solutions that do | | can be used to bypass application control solutions that do |
| not account for its potential abuse. | | not account for its potential abuse. Msiexec.exe execution m |
| | | ay also be elevated to SYSTEM privileges if the <code>Always |
| | | InstallElevated</code> policy is enabled.(Citation: Microsof |
| | | t AlwaysInstallElevated 2018) |
New Mitigations:
- M1042: Disable or Remove Feature or Program
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Alexandros Pappas'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-20 22:38:14.154000+00:00 | 2020-12-14 18:40:45.170000+00:00 |
| description | Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft.
Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. | Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) Msiexec.exe is digitally signed by Microsoft.
Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs.(Citation: LOLBAS Msiexec)(Citation: TrendMicro Msiexec Feb 2018) Since it is signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.(Citation: Microsoft AlwaysInstallElevated 2018) |
| x_mitre_data_sources[0] | DLL monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process command-line parameters | Module: Module Load |
| x_mitre_data_sources[2] | Process monitoring | Command: Command Execution |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft AlwaysInstallElevated 2018', 'description': 'Microsoft. (2018, May 31). AlwaysInstallElevated. Retrieved December 14, 2020.', 'url': 'https://docs.microsoft.com/en-us/windows/win32/msi/alwaysinstallelevated'} |
| x_mitre_data_sources | | Network Traffic: Network Connection Creation |
[T1498] Network Denial of Service
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Yossi Weizman, Azure Defender Research Team', 'Vishwas Manral, McAfee'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:58:18.788000+00:00 | 2021-04-12 18:34:06.995000+00:00 |
| x_mitre_data_sources[0] | Sensor health and status | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network protocol analysis | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure AD | Linux |
| x_mitre_platforms[6] | SaaS | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_platforms[8] | Office 365 | Containers |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Netflow/Enclave netflow | |
| x_mitre_data_sources | Network intrusion detection system | |
| x_mitre_data_sources | Network device logs | |
[T1046] Network Service Scanning
Current version: 2.2
Version changed from: 2.1 → 2.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-11 19:55:53.828000+00:00 | 2021-04-09 14:56:26.562000+00:00 |
| x_mitre_data_sources[0] | Netflow/Enclave netflow | Command: Command Execution |
| x_mitre_data_sources[1] | Network protocol analysis | Cloud Service: Cloud Service Enumeration |
| x_mitre_data_sources[2] | Packet capture | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | Windows | IaaS |
| x_mitre_platforms[2] | macOS | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_platforms[4] | GCP | Containers |
| x_mitre_version | 2.1 | 2.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_data_sources | Process use of network | |
| x_mitre_platforms | Azure | |
[T1040] Network Sniffing
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 21:03:49.610000+00:00 | 2021-04-02 17:51:59.236000+00:00 |
| x_mitre_data_sources[0] | Network device logs | Process: Process Creation |
| x_mitre_data_sources[1] | Host network interface | Command: Command Execution |
| x_mitre_detection | Detecting the events leading up to sniffing network traffic may be the best method of detection. From the host level, an adversary would likely need to perform a man-in-the-middle attack against other devices on a wired network in order to capture traffic that was not to or from the current compromised system. This change in the flow of information is detectable at the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network devices is a bit more challenging. Auditing administrator logins, configuration changes, and device images is required to detect malicious changes. | Detecting the events leading up to sniffing network traffic may be the best method of detection. From the host level, an adversary would likely need to perform a [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) attack against other devices on a wired network in order to capture traffic that was not to or from the current compromised system. This change in the flow of information is detectable at the enclave network level. Monitor for ARP spoofing and gratuitous ARP broadcasts. Detecting compromised network devices is a bit more challenging. Auditing administrator logins, configuration changes, and device images is required to detect malicious changes. |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Network |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Netflow/Enclave netflow | |
| x_mitre_data_sources | Process monitoring | |
[T1550.002] Use Alternate Authentication Material: Pass the Hash
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may “pass the hash” using stolen password hashes | t | Adversaries may “pass the hash” using stolen password hashes |
| to move laterally within an environment, bypassing normal s | | to move laterally within an environment, bypassing normal s |
| ystem access controls. Pass the hash (PtH) is a method of au | | ystem access controls. Pass the hash (PtH) is a method of au |
| thenticating as a user without having access to the user's c | | thenticating as a user without having access to the user's c |
| leartext password. This method bypasses standard authenticat | | leartext password. This method bypasses standard authenticat |
| ion steps that require a cleartext password, moving directly | | ion steps that require a cleartext password, moving directly |
| into the portion of the authentication that uses the passwo | | into the portion of the authentication that uses the passwo |
| rd hash. In this technique, valid password hashes for the ac | | rd hash. When performing PtH, valid password hashes for the |
| count being used are captured using a Credential Access tech | | account being used are captured using a [Credential Access] |
| nique. Captured hashes are used with PtH to authenticate as | | (https://attack.mitre.org/tactics/TA0006) technique. Capture |
| that user. Once authenticated, PtH may be used to perform ac | | d hashes are used with PtH to authenticate as that user. Onc |
| tions on local or remote systems. Windows 7 and higher with | | e authenticated, PtH may be used to perform actions on local |
| KB2871997 require valid domain user credentials or RID 500 | | or remote systems. Adversaries may also use stolen passwor |
| administrator hashes.(Citation: NSA Spotting) | | d hashes to "overpass the hash." Similar to PtH, this involv |
| | | es using a password hash to authenticate as a user but also |
| | | uses the password hash to create a valid Kerberos ticket. Th |
| | | is ticket can then be used to perform [Pass the Ticket](http |
| | | s://attack.mitre.org/techniques/T1550/003) attacks.(Citation |
| | | : Stealthbits Overpass-the-Hash) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-23 16:24:34.766000+00:00 | 2021-03-15 21:04:33.228000+00:00 |
| description | Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
Windows 7 and higher with KB2871997 require valid domain user credentials or RID 500 administrator hashes.(Citation: NSA Spotting) | Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
When performing PtH, valid password hashes for the account being used are captured using a [Credential Access](https://attack.mitre.org/tactics/TA0006) technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
Adversaries may also use stolen password hashes to "overpass the hash." Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket. This ticket can then be used to perform [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) attacks.(Citation: Stealthbits Overpass-the-Hash) |
| external_references[2]['source_name'] | NSA Spotting | Stealthbits Overpass-the-Hash |
| external_references[2]['description'] | National Security Agency/Central Security Service Information Assurance Directorate. (2015, August 7). Spotting the Adversary with Windows Event Log Monitoring. Retrieved September 6, 2018. | Warren, J. (2019, February 26). How to Detect Overpass-the-Hash Attacks. Retrieved February 4, 2021. |
| external_references[2]['url'] | https://apps.nsa.gov/iaarchive/library/reports/spotting-the-adversary-with-windows-event-log-monitoring.cfm | https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_detection | Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious. | Audit all logon and credential use events and review for discrepancies. Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity. NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious.
Event ID 4768 and 4769 will also be generated on the Domain Controller when a user requests a new ticket granting ticket or service ticket. These events combined with the above activity may be indicative of an overpass the hash attempt.(Citation: Stealthbits Overpass-the-Hash) |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Blake Strom, Microsoft 365 Defender |
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
| x_mitre_data_sources | | Active Directory: Active Directory Credential Request |
[T1550.003] Use Alternate Authentication Material: Pass the Ticket
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may “pass the ticket” using stolen Kerberos tick | t | Adversaries may “pass the ticket” using stolen Kerberos tick |
| ets to move laterally within an environment, bypassing norma | | ets to move laterally within an environment, bypassing norma |
| l system access controls. Pass the ticket (PtT) is a method | | l system access controls. Pass the ticket (PtT) is a method |
| of authenticating to a system using Kerberos tickets without | | of authenticating to a system using Kerberos tickets without |
| having access to an account's password. Kerberos authentica | | having access to an account's password. Kerberos authentica |
| tion can be used as the first step to lateral movement to a | | tion can be used as the first step to lateral movement to a |
| remote system. In this technique, valid Kerberos tickets fo | | remote system. When preforming PtT, valid Kerberos tickets |
| r [Valid Accounts](https://attack.mitre.org/techniques/T1078 | | for [Valid Accounts](https://attack.mitre.org/techniques/T10 |
| ) are captured by [OS Credential Dumping](https://attack.mit | | 78) are captured by [OS Credential Dumping](https://attack.m |
| re.org/techniques/T1003). A user's service tickets or ticket | | itre.org/techniques/T1003). A user's service tickets or tick |
| granting ticket (TGT) may be obtained, depending on the lev | | et granting ticket (TGT) may be obtained, depending on the l |
| el of access. A service ticket allows for access to a partic | | evel of access. A service ticket allows for access to a part |
| ular resource, whereas a TGT can be used to request service | | icular resource, whereas a TGT can be used to request servic |
| tickets from the Ticket Granting Service (TGS) to access any | | e tickets from the Ticket Granting Service (TGS) to access a |
| resource the user has privileges to access.(Citation: ADSec | | ny resource the user has privileges to access.(Citation: ADS |
| urity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Tic | | ecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the T |
| ket) [Silver Ticket](https://attack.mitre.org/techniques/T1 | | icket) A [Silver Ticket](https://attack.mitre.org/technique |
| 558/002) can be obtained for services that use Kerberos as a | | s/T1558/002) can be obtained for services that use Kerberos |
| n authentication mechanism and are used to generate tickets | | as an authentication mechanism and are used to generate tick |
| to access that particular resource and the system that hosts | | ets to access that particular resource and the system that h |
| the resource (e.g., SharePoint).(Citation: ADSecurity AD Ke | | osts the resource (e.g., SharePoint).(Citation: ADSecurity A |
| rberos Attacks) [Golden Ticket](https://attack.mitre.org/te | | D Kerberos Attacks) A [Golden Ticket](https://attack.mitre. |
| chniques/T1558/001) can be obtained for the domain using the | | org/techniques/T1558/001) can be obtained for the domain usi |
| Key Distribution Service account KRBTGT account NTLM hash, | | ng the Key Distribution Service account KRBTGT account NTLM |
| which enables generation of TGTs for any account in Active D | | hash, which enables generation of TGTs for any account in Ac |
| irectory.(Citation: Campbell 2014) | | tive Directory.(Citation: Campbell 2014) Adversaries may al |
| | | so create a valid Kerberos ticket using other user informati |
| | | on, such as stolen password hashes or AES keys. For example, |
| | | "overpassing the hash" involves using a NTLM password hash |
| | | to authenticate as a user (i.e. [Pass the Hash](https://atta |
| | | ck.mitre.org/techniques/T1550/002)) while also using the pas |
| | | sword hash to create a valid Kerberos ticket.(Citation: Stea |
| | | lthbits Overpass-the-Hash) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-12 17:03:16.122000+00:00 | 2021-03-15 21:42:11.839000+00:00 |
| description | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
In this technique, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)
[Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)
[Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014) | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.(Citation: ADSecurity AD Kerberos Attacks)(Citation: GentilKiwi Pass the Ticket)
A [Silver Ticket](https://attack.mitre.org/techniques/T1558/002) can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint).(Citation: ADSecurity AD Kerberos Attacks)
A [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.(Citation: Campbell 2014)
Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. [Pass the Hash](https://attack.mitre.org/techniques/T1550/002)) while also using the password hash to create a valid Kerberos ticket.(Citation: Stealthbits Overpass-the-Hash) |
| external_references[5]['source_name'] | CERT-EU Golden Ticket Protection | Stealthbits Overpass-the-Hash |
| external_references[5]['description'] | Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017. | Warren, J. (2019, February 26). How to Detect Overpass-the-Hash Attacks. Retrieved February 4, 2021. |
| external_references[5]['url'] | https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf | https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/ |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'CERT-EU Golden Ticket Protection', 'description': 'Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017.', 'url': 'https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf'} |
| x_mitre_data_sources | | Logon Session: Logon Session Creation |
| x_mitre_data_sources | | Active Directory: Active Directory Credential Request |
[T1110.001] Brute Force: Password Guessing
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 22:43:45.126000+00:00 | 2021-04-21 16:41:35.269000+00:00 |
| external_references[2]['url'] | https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf | https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Office 365 account logs | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | Office 365 | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure AD | Linux |
| x_mitre_platforms[6] | AWS | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_platforms[8] | SaaS | Containers |
| x_mitre_version | 1.1 | 1.2 |
[T1110.003] Brute Force: Password Spraying
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-19 22:43:45.579000+00:00 | 2021-04-06 12:32:47.678000+00:00 |
| x_mitre_data_sources[0] | Authentication logs | User Account: User Account Authentication |
| x_mitre_data_sources[1] | Office 365 account logs | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_platforms[8] | SaaS | Containers |
| x_mitre_version | 1.1 | 1.2 |
[T1069] Permission Groups Discovery
Current version: 2.3
Version changed from: 2.2 → 2.3
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-08 17:36:01.675000+00:00 | 2021-03-30 12:29:56.512000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Process: Process Creation |
| x_mitre_data_sources[1] | GCP audit logs | Command: Command Execution |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Group: Group Enumeration |
| x_mitre_data_sources[3] | Azure activity logs | Group: Group Metadata |
| x_mitre_data_sources[4] | Office 365 account logs | Application Log: Application Log Content |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | Office 365 | SaaS |
| x_mitre_platforms[4] | Azure AD | IaaS |
| x_mitre_platforms[5] | AWS | Linux |
| x_mitre_platforms[6] | GCP | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_version | 2.2 | 2.3 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | API monitoring | |
| x_mitre_data_sources | Process monitoring | |
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_platforms | SaaS | |
[T1566] Phishing
Current version: 2.1
Version changed from: 2.0 → 2.1
|
|
|---|
| t | Adversaries may send phishing messages to gain access to vic | t | Adversaries may send phishing messages to gain access to vic |
| tim systems. All forms of phishing are electronically delive | | tim systems. All forms of phishing are electronically delive |
| red social engineering. Phishing can be targeted, known as s | | red social engineering. Phishing can be targeted, known as s |
| pearphishing. In spearphishing, a specific individual, compa | | pearphishing. In spearphishing, a specific individual, compa |
| ny, or industry will be targeted by the adversary. More gene | | ny, or industry will be targeted by the adversary. More gene |
| rally, adversaries can conduct non-targeted phishing, such a | | rally, adversaries can conduct non-targeted phishing, such a |
| s in mass malware spam campaigns. Adversaries may send vict | | s in mass malware spam campaigns. Adversaries may send vict |
| ims emails containing malicious attachments or links, typica | | ims emails containing malicious attachments or links, typica |
| lly to execute malicious code on victim systems or to gather | | lly to execute malicious code on victim systems. Phishing ma |
| credentials for use of [Valid Accounts](https://attack.mitr | | y also be conducted via third-party services, like social me |
| e.org/techniques/T1078). Phishing may also be conducted via | | dia platforms. Phishing may also involve social engineering |
| third-party services, like social media platforms. | | techniques, such as posing as a trusted source. |
New Mitigations:
- M1054: Software Configuration
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['Philip Winther'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-18 01:55:03.337000+00:00 | 2021-04-14 14:38:43.211000+00:00 |
| description | Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems or to gather credentials for use of [Valid Accounts](https://attack.mitre.org/techniques/T1078). Phishing may also be conducted via third-party services, like social media platforms. | Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source. |
| x_mitre_data_sources[0] | File monitoring | Application Log: Application Log Content |
| x_mitre_data_sources[1] | Packet capture | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[2] | Web proxy | Network Traffic: Network Traffic Content |
| x_mitre_detection | Network intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.
URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.
Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware.
Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs. | Network intrusion detection systems and email gateways can be used to detect phishing with malicious attachments in transit. Detonation chambers may also be used to identify malicious attachments. Solutions can be signature and behavior based, but adversaries may construct attachments in a way to avoid these systems.
Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)
URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.
Because most common third-party services used for phishing via service leverage TLS encryption, SSL/TLS inspection is generally required to detect the initial communication/delivery. With SSL/TLS inspection intrusion detection signatures or other security gateway appliances may be able to detect malware.
Anti-virus can potentially detect malicious documents and files that are downloaded on the user's computer. Many possible detections of follow-on behavior may take place once [User Execution](https://attack.mitre.org/techniques/T1204) occurs. |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Microsoft Anti Spoofing', 'description': 'Microsoft. (2020, October 13). Anti-spoofing protection in EOP. Retrieved October 19, 2020.', 'url': 'https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide'} |
| external_references | | {'source_name': 'ACSC Email Spoofing', 'description': 'Australian Cyber Security Centre. (2012, December). Mitigating Spoofed Emails Using Sender Policy Framework. Retrieved October 19, 2020.', 'url': 'https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf'} |
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Email gateway | |
| x_mitre_data_sources | Mail server | |
| x_mitre_data_sources | Network intrusion detection system | |
| x_mitre_data_sources | Detonation chamber | |
| x_mitre_data_sources | SSL/TLS inspection | |
| x_mitre_data_sources | Anti-virus | |
[T1598] Phishing for Information
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Before compromising a victim, adversaries may send phishing | t | Adversaries may send phishing messages to elicit sensitive i |
| messages to elicit sensitive information that can be used du | | nformation that can be used during targeting. Phishing for i |
| ring targeting. Phishing for information is an attempt to tr | | nformation is an attempt to trick targets into divulging inf |
| ick targets into divulging information, frequently credentia | | ormation, frequently credentials or other actionable informa |
| ls or other actionable information. Phishing for information | | tion. Phishing for information is different from [Phishing]( |
| is different from [Phishing](https://attack.mitre.org/techn | | https://attack.mitre.org/techniques/T1566) in that the objec |
| iques/T1566) in that the objective is gathering data from th | | tive is gathering data from the victim rather than executing |
| e victim rather than executing malicious code. All forms of | | malicious code. All forms of phishing are electronically d |
| phishing are electronically delivered social engineering. P | | elivered social engineering. Phishing can be targeted, known |
| hishing can be targeted, known as spearphishing. In spearphi | | as spearphishing. In spearphishing, a specific individual, |
| shing, a specific individual, company, or industry will be t | | company, or industry will be targeted by the adversary. More |
| argeted by the adversary. More generally, adversaries can co | | generally, adversaries can conduct non-targeted phishing, s |
| nduct non-targeted phishing, such as in mass credential harv | | uch as in mass credential harvesting campaigns. Adversaries |
| esting campaigns. Adversaries may also try to obtain inform | | may also try to obtain information directly through the exc |
| ation directly through the exchange of emails, instant messa | | hange of emails, instant messages, or other electronic conve |
| ges, or other electronic conversation means.(Citation: Threa | | rsation means.(Citation: ThreatPost Social Media Phishing)(C |
| tPost Social Media Phishing)(Citation: TrendMictro Phishing) | | itation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Ci |
| (Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Cit | | tation: Sophos Attachment)(Citation: GitHub Phishery) Phishi |
| ation: GitHub Phishery) Phishing for information frequently | | ng for information frequently involves social engineering te |
| involves social engineering techniques, such as posing as a | | chniques, such as posing as a source with a reason to collec |
| source with a reason to collect information (ex: [Establish | | t information (ex: [Establish Accounts](https://attack.mitre |
| Accounts](https://attack.mitre.org/techniques/T1585) or [Com | | .org/techniques/T1585) or [Compromise Accounts](https://atta |
| promise Accounts](https://attack.mitre.org/techniques/T1586) | | ck.mitre.org/techniques/T1586)) and/or sending multiple, see |
| ) and/or sending multiple, seemingly urgent messages. | | mingly urgent messages. |
New Mitigations:
- M1054: Software Configuration
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-25 19:44:58.292000+00:00 | 2021-04-15 03:43:13.134000+00:00 |
| description | Before compromising a victim, adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.
All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.
Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. | Adversaries may send phishing messages to elicit sensitive information that can be used during targeting. Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Phishing for information is different from [Phishing](https://attack.mitre.org/techniques/T1566) in that the objective is gathering data from the victim rather than executing malicious code.
All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.
Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.(Citation: ThreatPost Social Media Phishing)(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin)(Citation: Sophos Attachment)(Citation: GitHub Phishery) Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages. |
| x_mitre_data_sources[0] | Social media monitoring | Application Log: Application Log Content |
| x_mitre_data_sources[1] | Mail server | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[2] | Email gateway | Network Traffic: Network Traffic Content |
| x_mitre_detection | Depending on the specific method of spearphishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Also consider enabling DMARC to verify the sender of emails.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)
When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.
Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts). | Depending on the specific method of phishing, the detections can vary. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.(Citation: Microsoft Anti Spoofing)(Citation: ACSC Email Spoofing)
When it comes to following links, monitor for references to uncategorized or known-bad sites. URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.
Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts). |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | Philip Winther |
[T1498.002] Network Denial of Service: Reflection Amplification
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:58:18.490000+00:00 | 2021-03-29 16:13:53.747000+00:00 |
| x_mitre_data_sources[0] | Sensor health and status | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network protocol analysis | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | macOS | Windows |
| x_mitre_platforms[1] | Windows | Azure AD |
| x_mitre_platforms[2] | Linux | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | Office 365 | IaaS |
| x_mitre_platforms[5] | Azure AD | Linux |
| x_mitre_platforms[6] | GCP | macOS |
| x_mitre_platforms[7] | Azure | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Netflow/Enclave netflow | |
| x_mitre_data_sources | Network intrusion detection system | |
| x_mitre_data_sources | Network device logs | |
| x_mitre_platforms | SaaS | |
[T1074.002] Data Staged: Remote Data Staging
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-14 19:48:07.491000+00:00 | 2021-03-08 10:33:02.019000+00:00 |
| x_mitre_data_sources[0] | Process command-line parameters | File: File Access |
| x_mitre_data_sources[1] | Process monitoring | File: File Creation |
| x_mitre_data_sources[2] | File monitoring | Command: Command Execution |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1114.002] Email Collection: Remote Email Collection
Current version: 1.1
Version changed from: 1.0 → 1.1
|
|
|---|
| t | Adversaries may target an Exchange server or Office 365 to c | t | Adversaries may target an Exchange server, Office 365, or Go |
| ollect sensitive information. Adversaries may leverage a use | | ogle Workspace to collect sensitive information. Adversaries |
| r's credentials and interact directly with the Exchange serv | | may leverage a user's credentials and interact directly wit |
| er to acquire information from within a network. Adversaries | | h the Exchange server to acquire information from within a n |
| may also access externally facing Exchange services or Offi | | etwork. Adversaries may also access externally facing Exchan |
| ce 365 to access email using credentials or access tokens. T | | ge services, Office 365, or Google Workspace to access email |
| ools such as [MailSniper](https://attack.mitre.org/software/ | | using credentials or access tokens. Tools such as [MailSnip |
| S0413) can be used to automate searches for specific keyword | | er](https://attack.mitre.org/software/S0413) can be used to |
| s. | | automate searches for specific keywords. |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-02-19 20:53:50.908000+00:00 | 2021-03-25 13:12:56.909000+00:00 |
| description | Adversaries may target an Exchange server or Office 365 to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services or Office 365 to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords. | Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords. |
| x_mitre_data_sources[0] | Authentication logs | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[1] | Email gateway | Logon Session: Logon Session Creation |
| x_mitre_data_sources[2] | Mail server | Command: Command Execution |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_platforms | | Google Workspace |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Office 365 trace logs | |
[T1018] Remote System Discovery
Current version: 3.1
Version changed from: 3.0 → 3.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-17 12:26:53.669000+00:00 | 2021-04-13 21:40:23.368000+00:00 |
| x_mitre_data_sources[0] | Network protocol analysis | Process: Process Creation |
| x_mitre_data_sources[1] | Process monitoring | Command: Command Execution |
| x_mitre_data_sources[2] | Process use of network | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[3] | Process command-line parameters | File: File Access |
| x_mitre_detection | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001). | System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.
Normal, benign system and network events related to legitimate remote system discovery may be uncommon, depending on the environment and how they are used. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).
Monitor for processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.(Citation: Elastic - Koadiac Detection with EQL) |
| x_mitre_version | 3.0 | 3.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Elastic - Koadiac Detection with EQL', 'description': 'Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 30, 2020.', 'url': 'https://www.elastic.co/blog/embracing-offensive-tooling-building-detections-against-koadic-using-eql'} |
| x_mitre_contributors | | Daniel Stepanic, Elastic |
[T1496] Resource Hijacking
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may leverage the resources of co-opted systems i | t | Adversaries may leverage the resources of co-opted systems i |
| n order to solve resource intensive problems which may impac | | n order to solve resource intensive problems which may impac |
| t system and/or hosted service availability. One common pu | | t system and/or hosted service availability. One common pu |
| rpose for Resource Hijacking is to validate transactions of | | rpose for Resource Hijacking is to validate transactions of |
| cryptocurrency networks and earn virtual currency. Adversari | | cryptocurrency networks and earn virtual currency. Adversari |
| es may consume enough system resources to negatively impact | | es may consume enough system resources to negatively impact |
| and/or cause affected machines to become unresponsive.(Citat | | and/or cause affected machines to become unresponsive.(Citat |
| ion: Kaspersky Lazarus Under The Hood Blog 2017) Servers and | | ion: Kaspersky Lazarus Under The Hood Blog 2017) Servers and |
| cloud-based(Citation: CloudSploit - Unused AWS Regions) sys | | cloud-based(Citation: CloudSploit - Unused AWS Regions) sys |
| tems are common targets because of the high potential for av | | tems are common targets because of the high potential for av |
| ailable resources, but user endpoint systems may also be com | | ailable resources, but user endpoint systems may also be com |
| promised and used for Resource Hijacking and cryptocurrency | | promised and used for Resource Hijacking and cryptocurrency |
| mining. | | mining. Containerized environments may also be targeted due |
| | | to the ease of deployment via exposed APIs and the potential |
| | | for scaling mining activities by deploying or compromising |
| | | multiple containers within an environment or cluster.(Citati |
| | | on: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed |
| | | Docker APIs) Additionally, some cryptocurrency mining malw |
| | | are kills off processes for competing malware to ensure it’s |
| | | not competing for resources.(Citation: Trend Micro War of C |
| | | rypto Miners) |
Details
dictionary_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_contributors | | ['David Fiser, @anu4is, Trend Micro', 'Alfredo Oliveira, Trend Micro', 'Jay Chen, Palo Alto Networks', 'Magno Logan, @magnologan, Trend Micro', 'Vishwas Manral, McAfee', 'Yossi Weizman, Azure Defender Research Team'] |
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-14 19:29:17.574000+00:00 | 2021-04-14 12:06:32.187000+00:00 |
| description | Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability.
One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit - Unused AWS Regions) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. | Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability.
One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based(Citation: CloudSploit - Unused AWS Regions) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)
Additionally, some cryptocurrency mining malware kills off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners) |
| x_mitre_data_sources[0] | Azure activity logs | Process: Process Creation |
| x_mitre_data_sources[1] | Stackdriver logs | Command: Command Execution |
| x_mitre_data_sources[2] | AWS CloudTrail logs | File: File Creation |
| x_mitre_data_sources[3] | Process use of network | Network Traffic: Network Connection Creation |
| x_mitre_data_sources[4] | Process monitoring | Network Traffic: Network Traffic Flow |
| x_mitre_data_sources[5] | Network protocol analysis | Sensor Health: Host Status |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | IaaS |
| x_mitre_platforms[2] | Windows | Linux |
| x_mitre_platforms[3] | AWS | macOS |
| x_mitre_platforms[4] | GCP | Containers |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| external_references | | {'source_name': 'Unit 42 Hildegard Malware', 'description': 'Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.', 'url': 'https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/'} |
| external_references | | {'source_name': 'Trend Micro Exposed Docker APIs', 'description': 'Oliveira, A. (2019, May 30). Infected Containers Target Docker via Exposed APIs. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html'} |
| external_references | | {'source_name': 'Trend Micro War of Crypto Miners', 'description': 'Oliveira, A., Fiser, D. (2020, September 10). War of Linux Cryptocurrency Miners: A Battle for Resources. Retrieved April 6, 2021.', 'url': 'https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html'} |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Network device logs | |
| x_mitre_platforms | Azure | |
[T1578.004] Modify Cloud Compute Infrastructure: Revert Cloud Instance
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-06-17 17:36:24.531000+00:00 | 2021-03-08 10:33:02.128000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Instance: Instance Modification |
| x_mitre_data_sources[1] | GCP audit logs | Instance: Instance Start |
| x_mitre_data_sources[2] | Azure activity logs | Instance: Instance Stop |
| x_mitre_platforms[0] | AWS | IaaS |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | AWS CloudTrail logs | |
| x_mitre_platforms | GCP | |
| x_mitre_platforms | Azure | |
[T1606.002] Forge Web Credentials: SAML Tokens
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2021-01-22 21:07:42.451000+00:00 | 2021-04-14 14:29:27.290000+00:00 |
| x_mitre_data_sources[0] | Windows event logs | Logon Session: Logon Session Creation |
| x_mitre_data_sources[1] | Authentication logs | Web Credential: Web Credential Creation |
| x_mitre_version | 1.0 | 1.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | Web Credential: Web Credential Usage |
| x_mitre_platforms | | Google Workspace |
[T1053] Scheduled Task/Job
Current version: 2.1
Version changed from: 2.0 → 2.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-10-14 15:20:01.069000+00:00 | 2021-04-20 16:31:11.405000+00:00 |
| x_mitre_data_sources[0] | File monitoring | File: File Creation |
| x_mitre_data_sources[1] | Process monitoring | Container: Container Creation |
| x_mitre_data_sources[2] | Process command-line parameters | Scheduled Job: Scheduled Job Creation |
| x_mitre_data_sources[3] | Windows event logs | Command: Command Execution |
| x_mitre_version | 2.0 | 2.1 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | File: File Modification |
| x_mitre_data_sources | | Process: Process Creation |
| x_mitre_platforms | | Containers |
[T1518.001] Software Discovery: Security Software Discovery
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 19:36:16.978000+00:00 | 2021-03-29 16:05:00.198000+00:00 |
| x_mitre_data_sources[0] | Stackdriver logs | Firewall: Firewall Metadata |
| x_mitre_data_sources[1] | Azure activity logs | Firewall: Firewall Enumeration |
| x_mitre_data_sources[2] | AWS CloudTrail logs | Process: Process Creation |
| x_mitre_data_sources[3] | File monitoring | Command: Command Execution |
| x_mitre_data_sources[4] | Process monitoring | Process: OS API Execution |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Process command-line parameters | |
| x_mitre_platforms | SaaS | |
[T1499.002] Endpoint Denial of Service: Service Exhaustion Flood
Current version: 1.2
Version changed from: 1.1 → 1.2
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-09-16 15:56:03.131000+00:00 | 2021-03-29 16:11:12.815000+00:00 |
| x_mitre_data_sources[0] | Netflow/Enclave netflow | Sensor Health: Host Status |
| x_mitre_data_sources[1] | Network device logs | Application Log: Application Log Content |
| x_mitre_data_sources[2] | Network intrusion detection system | Network Traffic: Network Traffic Content |
| x_mitre_data_sources[3] | Web application firewall logs | Network Traffic: Network Traffic Flow |
| x_mitre_platforms[0] | Linux | Windows |
| x_mitre_platforms[1] | macOS | Azure AD |
| x_mitre_platforms[2] | Windows | Office 365 |
| x_mitre_platforms[3] | AWS | SaaS |
| x_mitre_platforms[4] | GCP | IaaS |
| x_mitre_platforms[5] | Azure | Linux |
| x_mitre_platforms[6] | Office 365 | macOS |
| x_mitre_platforms[7] | Azure AD | Google Workspace |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_removed| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | Web logs | |
| x_mitre_data_sources | SSL/TLS inspection | |
| x_mitre_platforms | SaaS | |
[T1489] Service Stop
Current version: 1.2
Version changed from: 1.1 → 1.2
|
|
|---|
| t | Adversaries may stop or disable services on a system to rend | t | Adversaries may stop or disable services on a system to rend |
| er those services unavailable to legitimate users. Stopping | | er those services unavailable to legitimate users. Stopping |
| critical services can inhibit or stop response to an inciden | | critical services or processes can inhibit or stop response |
| t or aid in the adversary's overall objectives to cause dama | | to an incident or aid in the adversary's overall objectives |
| ge to the environment.(Citation: Talos Olympic Destroyer 201 | | to cause damage to the environment.(Citation: Talos Olympic |
| 8)(Citation: Novetta Blockbuster) Adversaries may accompli | | Destroyer 2018)(Citation: Novetta Blockbuster) Adversaries |
| sh this by disabling individual services of high importance | | may accomplish this by disabling individual services of hig |
| to an organization, such as <code>MSExchangeIS</code>, which | | h importance to an organization, such as <code>MSExchangeIS< |
| will make Exchange content inaccessible (Citation: Novetta | | /code>, which will make Exchange content inaccessible (Citat |
| Blockbuster). In some cases, adversaries may stop or disable | | ion: Novetta Blockbuster). In some cases, adversaries may st |
| many or all services to render systems unusable.(Citation: | | op or disable many or all services to render systems unusabl |
| Talos Olympic Destroyer 2018) Services may not allow for mod | | e.(Citation: Talos Olympic Destroyer 2018) Services or proce |
| ification of their data stores while running. Adversaries ma | | sses may not allow for modification of their data stores whi |
| y stop services in order to conduct [Data Destruction](https | | le running. Adversaries may stop services or processes in or |
| ://attack.mitre.org/techniques/T1485) or [Data Encrypted for | | der to conduct [Data Destruction](https://attack.mitre.org/t |
| Impact](https://attack.mitre.org/techniques/T1486) on the d | | echniques/T1485) or [Data Encrypted for Impact](https://atta |
| ata stores of services like Exchange and SQL Server.(Citatio | | ck.mitre.org/techniques/T1486) on the data stores of service |
| n: SecureWorks WannaCry Analysis) | | s like Exchange and SQL Server.(Citation: SecureWorks WannaC |
| | | ry Analysis) |
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-07-24 15:36:08.042000+00:00 | 2021-03-02 22:11:32.017000+00:00 |
| description | Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis) | Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible (Citation: Novetta Blockbuster). In some cases, adversaries may stop or disable many or all services to render systems unusable.(Citation: Talos Olympic Destroyer 2018) Services or processes may not allow for modification of their data stores while running. Adversaries may stop services or processes in order to conduct [Data Destruction](https://attack.mitre.org/techniques/T1485) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) on the data stores of services like Exchange and SQL Server.(Citation: SecureWorks WannaCry Analysis) |
| x_mitre_data_sources[0] | File monitoring | Process: Process Creation |
| x_mitre_data_sources[1] | Process command-line parameters | Command: Command Execution |
| x_mitre_data_sources[2] | Process monitoring | Process: OS API Execution |
| x_mitre_data_sources[3] | Windows Registry | Service: Service Metadata |
| x_mitre_data_sources[4] | API monitoring | Windows Registry: Windows Registry Key Modification |
| x_mitre_version | 1.1 | 1.2 |
iterable_item_added| STIX Field | Old value | New Value |
|---|
| x_mitre_data_sources | | File: File Modification |
| x_mitre_data_sources | | Process: Process Termination |
[T1547.009] Boot or Logon Autostart Execution: Shortcut Modification
Current version: 1.1
Version changed from: 1.0 → 1.1
Details
values_changed| STIX Field | Old value | New Value |
|---|
| modified | 2020-03-25 17:21:27.487000+00:00 | 2021-04-13 21:30:24.555000+00:00 |
| x_mitre_data_sources[0] | File monitoring | File: File Creation |
| x_mitre_d |