{"description": "Enterprise techniques used by IOControl, ATT&CK software S9046 (v1.0)", "name": "IOControl (S9046)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1037", "showSubtechniques": true}, {"techniqueID": "T1037.004", "comment": "IOCONTROL has used an RC script (`/etc/rc3.d/S93InitSystemd.sh`) to establish persistence on a system across restarts.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1140", "comment": "IOCONTROL has used the AES-256-CBC algorithm to decrypt configuration files associated with the malware.(Citation: Claroty-IOCONTROL) (Citation: Dragos-2026-Year-In-Review)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.004", "comment": "IOCONTROL has removed the malware binary and associated log file (i.e., `/tmp/iocontrol.log`) from a system upon command.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070.009", "comment": "IOCONTROL has removed malware persistence from a system upon command. (Citation: Claroty-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027", "showSubtechniques": true}, {"techniqueID": "T1027.002", "comment": "IOCONTROL has used the Ultimate Packer for eXecutables (UPX) to pack the malware.(Citation: Claroty-IOCONTROL) (Citation: Dragos-2026-Year-In-Review)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.013", "comment": "IOCONTROL has used the Advanced Encryption Standard 256-bit Cypher Block Chaining (AES-256-CBC) algorithm to encrypt its configuration files which are used to store information like file paths and IP addresses to connect to. (Citation: Claroty-IOCONTROL) (Citation: Dragos-2026-Year-In-Review)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1082", "comment": "IOCONTROL has used the `uname -v` and `uname \u2013r` commands to obtain kernel version and release information as well as the `hostname` command to obtain the hostname of the system.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1033", "comment": "IOCONTROL has used the `whoami` command to get the current user on the system.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1124", "comment": "IOCONTROL has used the `date` and `timezone` commands to gather the system date and time information.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by IOControl", "color": "#66b1ff"}]}