Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1134 | .001 | Access Token Manipulation: Token Impersonation/Theft |
Tarrask leverages token theft to obtain |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.[1] |
Enterprise | T1564 | Hide Artifacts |
Tarrask is able to create "hidden" scheduled tasks by deleting the Security Descriptor ( |
|
Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
Tarrask creates a scheduled task called "WinUpdate" to re-establish any dropped C2 connections.[1] |
.005 | Masquerading: Match Legitimate Name or Location |
Tarrask has masqueraded as executable files such as |
||
Enterprise | T1112 | Modify Registry |
Tarrask is able to delete the Security Descriptor ( |
|
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
Tarrask is able to create "hidden" scheduled tasks for persistence.[1] |