Create or Modify System Process: Windows Service

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.[1] Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg.

Adversaries may install a new service or modify an existing service by using system utilities to interact with services, by directly modifying the Registry, or by using custom tools to interact with the Windows API. Adversaries may configure services to execute at startup in order to persist on a system.

An adversary may also incorporate Masquerading by using a service name from a related operating system or benign software, or by modifying existing services to make detection analysis more challenging. Modifying existing services may interrupt their functionality or may enable services that are disabled or otherwise not commonly used.

Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. Adversaries may also directly start services through Service Execution.

ID: T1543.003
Sub-technique of:  T1543
Platforms: Windows
Effective Permissions: Administrator, SYSTEM
Data Sources: Command: Command Execution, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Contributors: Matthew Demaske, Adaptforward; Pedro Harrison; Travis Smith, Tripwire
Version: 1.1
Created: 17 January 2020
Last Modified: 16 September 2020

Procedure Examples

ID Name Description
S0504 Anchor

Anchor can establish persistence by creating a service.[2]

S0584 AppleJeus

AppleJeus can install itself as a service.[3]

G0073 APT19

An APT19 Port 22 malware variant registers itself as a service.[4]

G0022 APT3

APT3 has a tool that creates a new service for persistence.[5]

G0050 APT32

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.[6][7][8]

G0096 APT41

APT41 modified legitimate Windows services to install malware backdoors.[9] APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.[10]

S0438 Attor

Attor's dispatcher can establish persistence by registering a new service.[11]

S0347 AuditCred

AuditCred is installed as a new service on the system.[12]

S0239 Bankshot

Bankshot can terminate a specific process by its process id.[13][14]

S0127 BBSRAT

BBSRAT can modify service configurations.[15]

S0570 BitPaymer

BitPaymer has attempted to install itself as a service to maintain persistence.[16]

S0089 BlackEnergy

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.[17]

G0108 Blue Mockingbird

Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.[18]

S0204 Briba

Briba installs a service pointing to a malicious DLL dropped to disk.[19]

G0008 Carbanak

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.[20]

S0335 Carbon

Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.[21]

S0261 Catchamas

Catchamas adds a new service named NetAdapter to establish persistence.[22]

G0080 Cobalt Group

Cobalt Group has created new services to establish persistence.[23]

S0154 Cobalt Strike

Cobalt Strike can install a new service.[24]

S0050 CosmicDuke

CosmicDuke uses Windows services typically named "javamtsup" for persistence.[25]

S0046 CozyCar

One persistence mechanism used by CozyCar is to register itself as a Windows service.[26]

G0105 DarkVishnya

DarkVishnya created new services for shellcode loaders distribution.[27]

S0567 Dtrack

Dtrack can add a service called WBService to establish persistence.[28]

S0038 Duqu

Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.[29]

S0024 Dyre

Dyre registers itself as a service by adding several Registry keys.[30]

S0081 Elise

Elise configures itself as a service.[31]

S0082 Emissary

Emissary is capable of configuring itself as a service.[32]

S0367 Emotet

Emotet has been observed creating new services to maintain persistence. [33][34]

S0363 Empire

Empire can utilize built-in modules to modify service binaries and restore them to their original state.[35]

S0343 Exaramel for Windows

The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV."[36]

S0181 FALLCHILL

FALLCHILL has been installed as a Windows service.[3]

G0046 FIN7

FIN7 created new Windows services and added them to the startup directories for persistence.[37]

S0182 FinFisher

FinFisher creates a new Windows service with the malicious executable for persistence.[38][39]

S0032 gh0st RAT

gh0st RAT can create a new service to establish persistence.[40][41]

S0493 GoldenSpy

GoldenSpy has established persistence by running in the background as an autostart service.[42]

S0342 GreyEnergy

GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.[43]

S0071 hcdLoader

hcdLoader installs itself as a service for persistence.[44][45]

G0072 Honeybee

Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL.[46]

S0203 Hydraq

Hydraq creates new services to establish persistence.[47][48][49]

S0259 InnaputRAT

Some InnaputRAT variants create a new Windows service to establish persistence.[50]

S0260 InvisiMole

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.[51]

S0044 JHUHUGIT

JHUHUGIT has registered itself as a service to establish persistence.[52]

S0265 Kazuar

Kazuar can install itself as a new service.[53]

G0004 Ke3chang

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.[54]

S0387 KeyBoy

KeyBoy installs a service pointing to a malicious DLL dropped to disk.[55]

G0094 Kimsuky

Kimsuky has created new services for persistence.[56][57]

S0236 Kwampirs

Kwampirs creates a new service named WmiApSrvEx to establish persistence.[58]

G0032 Lazarus Group

Several Lazarus Group malware families install themselves as new services on victims.[59][60]

S0451 LoudMiner

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.[61]

S0149 MoonWind

MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.[62]

S0205 Naid

Naid creates a new service to establish.[63]

S0210 Nerex

Nerex creates a Registry subkey that registers a new service.[64]

S0118 Nidiran

Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).[65]

S0439 Okrum

To establish persistence, Okrum can install itself as a new service named NtmSsvc.[66]

S0501 PipeMon

PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.[67]

S0013 PlugX

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.[68][69][70][71][72]

S0012 PoisonIvy

PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.[73]

S0194 PowerSploit

PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.[74][75]

G0056 PROMETHIUM

PROMETHIUM has created new services and modified existing services for persistence.[76]

S0481 Ragnar Locker

Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.[77]

S0169 RawPOS

RawPOS installs itself as a service to maintain persistence.[78][79][80]

S0495 RDAT

RDAT has created a service when it is installed on the victim machine.[81]

S0172 Reaver

Reaver installs itself as a new service.[82]

S0074 Sakula

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.[83]

S0345 Seasalt

Seasalt is capable of installing itself as a service.[84]

S0140 Shamoon

Shamoon creates a new service named "ntssrv" to execute the payload. Newer versions create the "MaintenaceSrv" and "hdv_725x" services.[85][86]

S0444 ShimRat

ShimRat has installed a Windows service to maintain persistence on victim machines.[87]

S0533 SLOTHFULMEDIA

SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.[88]

S0142 StreamEx

StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.[89]

S0491 StrongPity

StrongPity has created new services and modified existing services for persistence.[90]

S0164 TDTESS

If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.[91]

S0560 TEARDROP

TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.[92][93]

G0027 Threat Group-3390

A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence.[94]

S0004 TinyZBot

TinyZBot can install as a Windows service for persistence.[95]

S0266 TrickBot

TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.[96]

G0081 Tropic Trooper

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.[97]

S0263 TYPEFRAME

TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.[98]

S0386 Ursnif

Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.[99]

S0180 Volgmer

Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.[100][101][102]

S0366 WannaCry

WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."[103][104]

S0206 Wiarp

Wiarp creates a backdoor through which remote attackers can create a service.[105]

S0176 Wingbird

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.[106][107]

S0141 Winnti for Windows

Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.[108]

G0102 Wizard Spider

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.[109]

S0230 ZeroT

ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.[72]

S0086 ZLib

ZLib creates Registry keys to allow itself to run as various services.[110]

S0350 zwShell

zwShell has established persistence by adding itself as a new service.[111]

S0412 ZxShell

ZxShell can create a new service using the service parser function ProcessScCommand.[112]

Mitigations

ID Mitigation Description
M1047 Audit

Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.

M1018 User Account Management

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Detection

Monitor processes and command-line arguments for actions that could create or modify services. Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment. Services may also be modified through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data. Remote access tools with built-in features may also interact directly with the Windows API to perform these functions outside of typical system utilities. Collect service utility execution and service binary path arguments used for analysis. Service binary paths may even be changed to execute commands or scripts.

Look for changes to service Registry entries that do not correlate with known software, patch cycles, etc. Service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services. Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious. Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.[113]

Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 [114][115]). New, benign services may be created during installation of new software.

Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data. Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

References

  1. Microsoft. (n.d.). Services. Retrieved June 7, 2016.
  2. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  3. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  4. Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.
  5. Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.
  6. Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.
  7. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  8. Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.
  9. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  10. Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.
  11. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  12. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.
  13. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  14. US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
  15. Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
  16. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
  17. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  18. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
  19. Ladley, F. (2012, May 15). Backdoor.Briba. Retrieved February 21, 2018.
  20. Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
  21. ESET. (2017, March 30). Carbon Paper: Peering into Turla’s second stage backdoor. Retrieved November 7, 2018.
  22. Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved July 10, 2018.
  23. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  24. Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
  25. F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.
  26. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.
  27. Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.
  28. Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.
  29. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.
  30. Symantec Security Response. (2015, June 23). Dyre: Emerging threat on financial fraud landscape. Retrieved August 23, 2018.
  31. Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.
  32. Falcone, R. and Miller-Osborn, J.. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.
  33. US-CERT. (2018, July 20). Alert (TA18-201A) Emotet Malware. Retrieved March 25, 2019.
  34. Mclellan, M.. (2018, November 19). Lazy Passwords Become Rocket Fuel for Emotet SMB Spreader. Retrieved March 25, 2019.
  35. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  36. Cherepanov, A., Lipovsky, R. (2018, October 11). New TeleBots backdoor: First evidence linking Industroyer to NotPetya. Retrieved November 27, 2018.
  37. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  38. FinFisher. (n.d.). Retrieved December 20, 2017.
  39. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  40. Pantazopoulos, N. (2018, April 17). Decoding network data from a Gh0st RAT variant. Retrieved November 2, 2018.
  41. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  42. Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.
  43. Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.
  44. Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.
  45. Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.
  46. Sherstobitoff, R. (2018, March 02). McAfee Uncovers Operation Honeybee, a Malicious Document Campaign Targeting Humanitarian Aid Groups. Retrieved May 16, 2018.
  47. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  48. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  49. Fitzgerald, P. (2010, January 26). How Trojan.Hydraq Stays On Your Computer. Retrieved February 22, 2018.
  50. ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.
  51. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  52. ESET. (2016, October). En Route with Sednit - Part 1: Approaching the Target. Retrieved November 8, 2016.
  53. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  54. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  55. Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.
  56. Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.
  57. CISA, FBI, CNMF. (2020, October 27). https://us-cert.cisa.gov/ncas/alerts/aa20-301a. Retrieved November 4, 2020.
  58. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  1. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.
  2. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016.
  3. Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.
  4. Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.
  5. Neville, A. (2012, June 15). Trojan.Naid. Retrieved February 22, 2018.
  6. Ladley, F. (2012, May 15). Backdoor.Nerex. Retrieved February 23, 2018.
  7. Sponchioni, R.. (2016, March 11). Backdoor.Nidiran. Retrieved August 3, 2016.
  8. Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.
  9. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  10. Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
  11. Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
  12. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  13. FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
  14. Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.
  15. Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.
  16. PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
  17. PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
  18. Tudorica, R. et al. (2020, June 30). StrongPity APT - Revealing Trojanized Tools, Working Hours and Infrastructure. Retrieved July 20, 2020.
  19. SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.
  20. Nesbit, B. and Ackerman, D. (2017, January). Malware Analysis Report - RawPOS Malware: Deconstructing an Intruder’s Toolkit. Retrieved October 4, 2017.
  21. TrendLabs Security Intelligence Blog. (2015, April). RawPOS Technical Brief. Retrieved October 4, 2017.
  22. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  23. Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
  24. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.
  25. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  26. Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
  27. Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
  28. Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.
  29. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  30. DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.
  31. Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.
  32. Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.
  33. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  34. Check Point Research. (2020, December 22). SUNBURST, TEARDROP and the NetSec New Normal. Retrieved January 6, 2021.
  35. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  36. Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
  37. Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
  38. Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.
  39. Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.
  40. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  41. Trend Micro. (2014, December 11). PE_URSNIF.A2. Retrieved June 5, 2019.
  42. US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.
  43. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  44. Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.
  45. Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved March 25, 2019.
  46. Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.
  47. Zhou, R. (2012, May 15). Backdoor.Wiarp. Retrieved February 22, 2018.
  48. Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.
  49. Microsoft. (2017, November 9). Backdoor:Win32/Wingbird.A!dha. Retrieved November 27, 2017.
  50. Cap, P., et al. (2017, January 25). Detecting threat actors in recent German industrial attacks with Windows Defender ATP. Retrieved February 8, 2017.
  51. John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
  52. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  53. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
  54. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  55. Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.
  56. Miroshnikov, A. & Hall, J. (2017, April 18). 4697(S): A service was installed in the system. Retrieved August 7, 2018.
  57. Hardy, T. & Hall, J. (2018, February 15). Use Windows Event Forwarding to help with intrusion detection. Retrieved August 7, 2018.