Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols | |
Enterprise | T1059 | .001 | Command and Scripting Interpreter: PowerShell |
LitePower can use a PowerShell script to execute commands.[1] |
Enterprise | T1041 | Exfiltration Over C2 Channel |
LitePower can send collected data, including screenshots, over its C2 channel.[1] |
|
Enterprise | T1105 | Ingress Tool Transfer |
LitePower has the ability to download payloads containing system commands to a compromised host.[1] |
|
Enterprise | T1106 | Native API | ||
Enterprise | T1012 | Query Registry |
LitePower can query the Registry for keys added to execute COM hijacking.[1] |
|
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
LitePower can create a scheduled task to enable persistence mechanisms.[1] |
Enterprise | T1113 | Screen Capture |
LitePower can take system screenshots and save them to |
|
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery | |
Enterprise | T1082 | System Information Discovery |
LitePower has the ability to list local drives and enumerate the OS architecture.[1] |
|
Enterprise | T1033 | System Owner/User Discovery |
LitePower can determine if the current user has admin privileges.[1] |