Updates - April 2017

The April 2017 update contains several new techniques, new reports and content changes:

Expanded to 133 techniques with the addition of:

• Netsh Helper DLL
• Execution through Module Load
• Install Root Certificate
• Authentication Package
• Data Encoding
• External Remote Services

Updates to several existing techniques based on community input and new information, including:

• Bypass User Account Control - Updated description and UACMe information
• File System Permissions Weakness - Added executable installer variation
• Service Registry Permissions Weakness - Updated description to include system service accounts
• System Firmware - Added CHIPSEC references
• Input Capture - Added VPN credential capture reference
• Exfiltration Over Other Network Medium - Added Bluetooth/Flame example
• Port Monitors - Corrected registry key reference
• Execution through API - Added execution API list
• Regsvr32 - Added threat reference from recent reporting

Group additions:

• Winnti Group
• menuPass
• FIN7
• Gamaredon Group
• RTM

Software additions:

• Winnti
• StreamEx
• Flame
• ChChes
• POWERSOURCE
• TEXTMATE
• Pteranodon
• RTM
• MoonWind
• Added more details to the Software labels used within ATT&CK and added an additional "utility" category