Domain	ID	Name	Use
Enterprise	T1088	Bypass User Account Control	An older variant of PLAINTEE performs UAC bypass.^[1]
Enterprise	T1059	Command-Line Interface	PLAINTEE uses cmd.exe to execute commands on the victim’s machine.^[1]
Enterprise	T1094	Custom Command and Control Protocol	PLAINTEE uses a custom UDP protocol to communicate.^[1]
Enterprise	T1024	Custom Cryptographic Protocol	PLAINTEE encodes C2 beacons using XOR.^[1]
Enterprise	T1112	Modify Registry	PLAINTEE uses `reg add` to add a Registry Run key for persistence.^[1]
Enterprise	T1057	Process Discovery	PLAINTEE performs the `tasklist` command to list running processes.^[1]
Enterprise	T1060	Registry Run Keys / Startup Folder	PLAINTEE gains persistence by adding the Registry key `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce`.^[1]
Enterprise	T1105	Remote File Copy	PLAINTEE has downloaded and executed additional plugins.^[1]
Enterprise	T1082	System Information Discovery	PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.^[1]
Enterprise	T1016	System Network Configuration Discovery	PLAINTEE uses the `ipconfig /all` command to gather the victim’s IP address.^[1]

Groups

Groups that use this software:

Rancor

References